3 namespace MediaWiki\Auth
;
5 use MediaWiki\MediaWikiServices
;
10 * @covers MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider
12 class LocalPasswordPrimaryAuthenticationProviderTest
extends \MediaWikiTestCase
{
14 private $manager = null;
15 private $config = null;
16 private $validity = null;
19 * Get an instance of the provider
21 * $provider->checkPasswordValidity is mocked to return $this->validity,
22 * because we don't need to test that here.
24 * @param bool $loginOnly
25 * @return LocalPasswordPrimaryAuthenticationProvider
27 protected function getProvider( $loginOnly = false ) {
28 if ( !$this->config
) {
29 $this->config
= new \
HashConfig();
31 $config = new \
MultiConfig( [
33 MediaWikiServices
::getInstance()->getMainConfig()
36 if ( !$this->manager
) {
37 $this->manager
= new AuthManager( new \
FauxRequest(), $config );
39 $this->validity
= \Status
::newGood();
41 $provider = $this->getMockBuilder( LocalPasswordPrimaryAuthenticationProvider
::class )
42 ->setMethods( [ 'checkPasswordValidity' ] )
43 ->setConstructorArgs( [ [ 'loginOnly' => $loginOnly ] ] )
45 $provider->expects( $this->any() )->method( 'checkPasswordValidity' )
46 ->will( $this->returnCallback( function () {
47 return $this->validity
;
49 $provider->setConfig( $config );
50 $provider->setLogger( new \Psr\Log\
NullLogger() );
51 $provider->setManager( $this->manager
);
56 public function testBasics() {
57 $user = $this->getMutableTestUser()->getUser();
58 $userName = $user->getName();
59 $lowerInitialUserName = mb_strtolower( $userName[0] ) . substr( $userName, 1 );
61 $provider = new LocalPasswordPrimaryAuthenticationProvider();
64 PrimaryAuthenticationProvider
::TYPE_CREATE
,
65 $provider->accountCreationType()
68 $this->assertTrue( $provider->testUserExists( $userName ) );
69 $this->assertTrue( $provider->testUserExists( $lowerInitialUserName ) );
70 $this->assertFalse( $provider->testUserExists( 'DoesNotExist' ) );
71 $this->assertFalse( $provider->testUserExists( '<invalid>' ) );
73 $provider = new LocalPasswordPrimaryAuthenticationProvider( [ 'loginOnly' => true ] );
76 PrimaryAuthenticationProvider
::TYPE_NONE
,
77 $provider->accountCreationType()
80 $this->assertTrue( $provider->testUserExists( $userName ) );
81 $this->assertFalse( $provider->testUserExists( 'DoesNotExist' ) );
83 $req = new PasswordAuthenticationRequest
;
84 $req->action
= AuthManager
::ACTION_CHANGE
;
85 $req->username
= '<invalid>';
86 $provider->providerChangeAuthenticationData( $req );
89 public function testTestUserCanAuthenticate() {
90 $user = $this->getMutableTestUser()->getUser();
91 $userName = $user->getName();
92 $dbw = wfGetDB( DB_MASTER
);
94 $provider = $this->getProvider();
96 $this->assertFalse( $provider->testUserCanAuthenticate( '<invalid>' ) );
98 $this->assertFalse( $provider->testUserCanAuthenticate( 'DoesNotExist' ) );
100 $this->assertTrue( $provider->testUserCanAuthenticate( $userName ) );
101 $lowerInitialUserName = mb_strtolower( $userName[0] ) . substr( $userName, 1 );
102 $this->assertTrue( $provider->testUserCanAuthenticate( $lowerInitialUserName ) );
106 [ 'user_password' => \PasswordFactory
::newInvalidPassword()->toString() ],
107 [ 'user_name' => $userName ]
109 $this->assertFalse( $provider->testUserCanAuthenticate( $userName ) );
114 [ 'user_password' => '0123456789abcdef0123456789abcdef' ],
115 [ 'user_name' => $userName ]
117 $this->assertTrue( $provider->testUserCanAuthenticate( $userName ) );
120 public function testSetPasswordResetFlag() {
122 $this->getProvider();
124 /// @todo: Because we're currently using User, which uses the global config...
125 $this->setMwGlobals( [ 'wgPasswordExpireGrace' => 100 ] );
127 $this->config
->set( 'PasswordExpireGrace', 100 );
128 $this->config
->set( 'InvalidPasswordReset', true );
130 $provider = new LocalPasswordPrimaryAuthenticationProvider();
131 $provider->setConfig( $this->config
);
132 $provider->setLogger( new \Psr\Log\
NullLogger() );
133 $provider->setManager( $this->manager
);
134 $providerPriv = \TestingAccessWrapper
::newFromObject( $provider );
136 $user = $this->getMutableTestUser()->getUser();
137 $userName = $user->getName();
138 $dbw = wfGetDB( DB_MASTER
);
139 $row = $dbw->selectRow(
142 [ 'user_name' => $userName ],
146 $this->manager
->removeAuthenticationSessionData( null );
147 $row->user_password_expires
= wfTimestamp( TS_MW
, time() +
200 );
148 $providerPriv->setPasswordResetFlag( $userName, \Status
::newGood(), $row );
149 $this->assertNull( $this->manager
->getAuthenticationSessionData( 'reset-pass' ) );
151 $this->manager
->removeAuthenticationSessionData( null );
152 $row->user_password_expires
= wfTimestamp( TS_MW
, time() - 200 );
153 $providerPriv->setPasswordResetFlag( $userName, \Status
::newGood(), $row );
154 $ret = $this->manager
->getAuthenticationSessionData( 'reset-pass' );
155 $this->assertNotNull( $ret );
156 $this->assertSame( 'resetpass-expired', $ret->msg
->getKey() );
157 $this->assertTrue( $ret->hard
);
159 $this->manager
->removeAuthenticationSessionData( null );
160 $row->user_password_expires
= wfTimestamp( TS_MW
, time() - 1 );
161 $providerPriv->setPasswordResetFlag( $userName, \Status
::newGood(), $row );
162 $ret = $this->manager
->getAuthenticationSessionData( 'reset-pass' );
163 $this->assertNotNull( $ret );
164 $this->assertSame( 'resetpass-expired-soft', $ret->msg
->getKey() );
165 $this->assertFalse( $ret->hard
);
167 $this->manager
->removeAuthenticationSessionData( null );
168 $row->user_password_expires
= null;
169 $status = \Status
::newGood();
170 $status->error( 'testing' );
171 $providerPriv->setPasswordResetFlag( $userName, $status, $row );
172 $ret = $this->manager
->getAuthenticationSessionData( 'reset-pass' );
173 $this->assertNotNull( $ret );
174 $this->assertSame( 'resetpass-validity-soft', $ret->msg
->getKey() );
175 $this->assertFalse( $ret->hard
);
178 public function testAuthentication() {
179 $testUser = $this->getMutableTestUser();
180 $userName = $testUser->getUser()->getName();
182 $dbw = wfGetDB( DB_MASTER
);
183 $id = \User
::idFromName( $userName );
185 $req = new PasswordAuthenticationRequest();
186 $req->action
= AuthManager
::ACTION_LOGIN
;
187 $reqs = [ PasswordAuthenticationRequest
::class => $req ];
189 $provider = $this->getProvider();
193 AuthenticationResponse
::newAbstain(),
194 $provider->beginPrimaryAuthentication( [] )
197 $req->username
= 'foo';
198 $req->password
= null;
200 AuthenticationResponse
::newAbstain(),
201 $provider->beginPrimaryAuthentication( $reqs )
204 $req->username
= null;
205 $req->password
= 'bar';
207 AuthenticationResponse
::newAbstain(),
208 $provider->beginPrimaryAuthentication( $reqs )
211 $req->username
= '<invalid>';
212 $req->password
= 'WhoCares';
213 $ret = $provider->beginPrimaryAuthentication( $reqs );
215 AuthenticationResponse
::newAbstain(),
216 $provider->beginPrimaryAuthentication( $reqs )
219 $req->username
= 'DoesNotExist';
220 $req->password
= 'DoesNotExist';
221 $ret = $provider->beginPrimaryAuthentication( $reqs );
223 AuthenticationResponse
::newAbstain(),
224 $provider->beginPrimaryAuthentication( $reqs )
227 // Validation failure
228 $req->username
= $userName;
229 $req->password
= $testUser->getPassword();
230 $this->validity
= \Status
::newFatal( 'arbitrary-failure' );
231 $ret = $provider->beginPrimaryAuthentication( $reqs );
233 AuthenticationResponse
::FAIL
,
238 $ret->message
->getKey()
242 $this->manager
->removeAuthenticationSessionData( null );
243 $this->validity
= \Status
::newGood();
245 AuthenticationResponse
::newPass( $userName ),
246 $provider->beginPrimaryAuthentication( $reqs )
248 $this->assertNull( $this->manager
->getAuthenticationSessionData( 'reset-pass' ) );
250 // Successful auth after normalizing name
251 $this->manager
->removeAuthenticationSessionData( null );
252 $this->validity
= \Status
::newGood();
253 $req->username
= mb_strtolower( $userName[0] ) . substr( $userName, 1 );
255 AuthenticationResponse
::newPass( $userName ),
256 $provider->beginPrimaryAuthentication( $reqs )
258 $this->assertNull( $this->manager
->getAuthenticationSessionData( 'reset-pass' ) );
259 $req->username
= $userName;
261 // Successful auth with reset
262 $this->manager
->removeAuthenticationSessionData( null );
263 $this->validity
->error( 'arbitrary-warning' );
265 AuthenticationResponse
::newPass( $userName ),
266 $provider->beginPrimaryAuthentication( $reqs )
268 $this->assertNotNull( $this->manager
->getAuthenticationSessionData( 'reset-pass' ) );
271 $this->validity
= \Status
::newGood();
272 $req->password
= 'Wrong';
273 $ret = $provider->beginPrimaryAuthentication( $reqs );
275 AuthenticationResponse
::FAIL
,
280 $ret->message
->getKey()
283 // Correct handling of legacy encodings
284 $password = ':B:salt:' . md5( 'salt-' . md5( "\xe1\xe9\xed\xf3\xfa" ) );
285 $dbw->update( 'user', [ 'user_password' => $password ], [ 'user_name' => $userName ] );
286 $req->password
= 'áéÃóú';
287 $ret = $provider->beginPrimaryAuthentication( $reqs );
289 AuthenticationResponse
::FAIL
,
294 $ret->message
->getKey()
297 $this->config
->set( 'LegacyEncoding', true );
299 AuthenticationResponse
::newPass( $userName ),
300 $provider->beginPrimaryAuthentication( $reqs )
303 $req->password
= 'áéÃóú Wrong';
304 $ret = $provider->beginPrimaryAuthentication( $reqs );
306 AuthenticationResponse
::FAIL
,
311 $ret->message
->getKey()
314 // Correct handling of really old password hashes
315 $this->config
->set( 'PasswordSalt', false );
316 $password = md5( 'FooBar' );
317 $dbw->update( 'user', [ 'user_password' => $password ], [ 'user_name' => $userName ] );
318 $req->password
= 'FooBar';
320 AuthenticationResponse
::newPass( $userName ),
321 $provider->beginPrimaryAuthentication( $reqs )
324 $this->config
->set( 'PasswordSalt', true );
325 $password = md5( "$id-" . md5( 'FooBar' ) );
326 $dbw->update( 'user', [ 'user_password' => $password ], [ 'user_name' => $userName ] );
327 $req->password
= 'FooBar';
329 AuthenticationResponse
::newPass( $userName ),
330 $provider->beginPrimaryAuthentication( $reqs )
335 * @dataProvider provideProviderAllowsAuthenticationDataChange
336 * @param string $type
337 * @param string $user
338 * @param \Status $validity Result of the password validity check
339 * @param \StatusValue $expect1 Expected result with $checkData = false
340 * @param \StatusValue $expect2 Expected result with $checkData = true
342 public function testProviderAllowsAuthenticationDataChange( $type, $user, \Status
$validity,
343 \StatusValue
$expect1, \StatusValue
$expect2
345 if ( $type === PasswordAuthenticationRequest
::class ) {
347 } elseif ( $type === PasswordDomainAuthenticationRequest
::class ) {
348 $req = new $type( [] );
350 $req = $this->createMock( $type );
352 $req->action
= AuthManager
::ACTION_CHANGE
;
353 $req->username
= $user;
354 $req->password
= 'NewPassword';
355 $req->retype
= 'NewPassword';
357 $provider = $this->getProvider();
358 $this->validity
= $validity;
359 $this->assertEquals( $expect1, $provider->providerAllowsAuthenticationDataChange( $req, false ) );
360 $this->assertEquals( $expect2, $provider->providerAllowsAuthenticationDataChange( $req, true ) );
362 $req->retype
= 'BadRetype';
365 $provider->providerAllowsAuthenticationDataChange( $req, false )
368 $expect2->getValue() === 'ignored' ?
$expect2 : \StatusValue
::newFatal( 'badretype' ),
369 $provider->providerAllowsAuthenticationDataChange( $req, true )
372 $provider = $this->getProvider( true );
374 \StatusValue
::newGood( 'ignored' ),
375 $provider->providerAllowsAuthenticationDataChange( $req, true ),
376 'loginOnly mode should claim to ignore all changes'
380 public static function provideProviderAllowsAuthenticationDataChange() {
381 $err = \StatusValue
::newGood();
382 $err->error( 'arbitrary-warning' );
385 [ AuthenticationRequest
::class, 'UTSysop', \Status
::newGood(),
386 \StatusValue
::newGood( 'ignored' ), \StatusValue
::newGood( 'ignored' ) ],
387 [ PasswordAuthenticationRequest
::class, 'UTSysop', \Status
::newGood(),
388 \StatusValue
::newGood(), \StatusValue
::newGood() ],
389 [ PasswordAuthenticationRequest
::class, 'uTSysop', \Status
::newGood(),
390 \StatusValue
::newGood(), \StatusValue
::newGood() ],
391 [ PasswordAuthenticationRequest
::class, 'UTSysop', \Status
::wrap( $err ),
392 \StatusValue
::newGood(), $err ],
393 [ PasswordAuthenticationRequest
::class, 'UTSysop', \Status
::newFatal( 'arbitrary-error' ),
394 \StatusValue
::newGood(), \StatusValue
::newFatal( 'arbitrary-error' ) ],
395 [ PasswordAuthenticationRequest
::class, 'DoesNotExist', \Status
::newGood(),
396 \StatusValue
::newGood(), \StatusValue
::newGood( 'ignored' ) ],
397 [ PasswordDomainAuthenticationRequest
::class, 'UTSysop', \Status
::newGood(),
398 \StatusValue
::newGood( 'ignored' ), \StatusValue
::newGood( 'ignored' ) ],
403 * @dataProvider provideProviderChangeAuthenticationData
404 * @param callable|bool $usernameTransform
405 * @param string $type
406 * @param bool $loginOnly
407 * @param bool $changed
409 public function testProviderChangeAuthenticationData(
410 $usernameTransform, $type, $loginOnly, $changed ) {
411 $testUser = $this->getMutableTestUser();
412 $user = $testUser->getUser()->getName();
413 if ( is_callable( $usernameTransform ) ) {
414 $user = call_user_func( $usernameTransform, $user );
416 $cuser = ucfirst( $user );
417 $oldpass = $testUser->getPassword();
418 $newpass = 'NewPassword';
420 $dbw = wfGetDB( DB_MASTER
);
421 $oldExpiry = $dbw->selectField( 'user', 'user_password_expires', [ 'user_name' => $cuser ] );
423 $this->mergeMwGlobalArrayValue( 'wgHooks', [
424 'ResetPasswordExpiration' => [ function ( $user, &$expires ) {
425 $expires = '30001231235959';
429 $provider = $this->getProvider( $loginOnly );
432 $loginReq = new PasswordAuthenticationRequest();
433 $loginReq->action
= AuthManager
::ACTION_LOGIN
;
434 $loginReq->username
= $user;
435 $loginReq->password
= $oldpass;
436 $loginReqs = [ PasswordAuthenticationRequest
::class => $loginReq ];
438 AuthenticationResponse
::newPass( $cuser ),
439 $provider->beginPrimaryAuthentication( $loginReqs ),
443 if ( $type === PasswordAuthenticationRequest
::class ) {
444 $changeReq = new $type();
446 $changeReq = $this->createMock( $type );
448 $changeReq->action
= AuthManager
::ACTION_CHANGE
;
449 $changeReq->username
= $user;
450 $changeReq->password
= $newpass;
451 $provider->providerChangeAuthenticationData( $changeReq );
453 if ( $loginOnly && $changed ) {
456 $expectExpiry = null;
457 } elseif ( $changed ) {
460 $expectExpiry = '30001231235959';
464 $expectExpiry = $oldExpiry;
467 $loginReq->password
= $oldpass;
468 $ret = $provider->beginPrimaryAuthentication( $loginReqs );
469 if ( $old === 'pass' ) {
471 AuthenticationResponse
::newPass( $cuser ),
473 'old password should pass'
477 AuthenticationResponse
::FAIL
,
479 'old password should fail'
483 $ret->message
->getKey(),
484 'old password should fail'
488 $loginReq->password
= $newpass;
489 $ret = $provider->beginPrimaryAuthentication( $loginReqs );
490 if ( $new === 'pass' ) {
492 AuthenticationResponse
::newPass( $cuser ),
494 'new password should pass'
498 AuthenticationResponse
::FAIL
,
500 'new password should fail'
504 $ret->message
->getKey(),
505 'new password should fail'
511 $dbw->selectField( 'user', 'user_password_expires', [ 'user_name' => $cuser ] )
515 public static function provideProviderChangeAuthenticationData() {
517 [ false, AuthenticationRequest
::class, false, false ],
518 [ false, PasswordAuthenticationRequest
::class, false, true ],
519 [ false, AuthenticationRequest
::class, true, false ],
520 [ false, PasswordAuthenticationRequest
::class, true, true ],
521 [ 'ucfirst', PasswordAuthenticationRequest
::class, false, true ],
522 [ 'ucfirst', PasswordAuthenticationRequest
::class, true, true ],
526 public function testTestForAccountCreation() {
527 $user = \User
::newFromName( 'foo' );
528 $req = new PasswordAuthenticationRequest();
529 $req->action
= AuthManager
::ACTION_CREATE
;
530 $req->username
= 'Foo';
531 $req->password
= 'Bar';
532 $req->retype
= 'Bar';
533 $reqs = [ PasswordAuthenticationRequest
::class => $req ];
535 $provider = $this->getProvider();
537 \StatusValue
::newGood(),
538 $provider->testForAccountCreation( $user, $user, [] ),
539 'No password request'
543 \StatusValue
::newGood(),
544 $provider->testForAccountCreation( $user, $user, $reqs ),
545 'Password request, validated'
548 $req->retype
= 'Baz';
550 \StatusValue
::newFatal( 'badretype' ),
551 $provider->testForAccountCreation( $user, $user, $reqs ),
552 'Password request, bad retype'
554 $req->retype
= 'Bar';
556 $this->validity
->error( 'arbitrary warning' );
557 $expect = \StatusValue
::newGood();
558 $expect->error( 'arbitrary warning' );
561 $provider->testForAccountCreation( $user, $user, $reqs ),
562 'Password request, not validated'
565 $provider = $this->getProvider( true );
566 $this->validity
->error( 'arbitrary warning' );
568 \StatusValue
::newGood(),
569 $provider->testForAccountCreation( $user, $user, $reqs ),
570 'Password request, not validated, loginOnly'
574 public function testAccountCreation() {
575 $user = \User
::newFromName( 'Foo' );
577 $req = new PasswordAuthenticationRequest();
578 $req->action
= AuthManager
::ACTION_CREATE
;
579 $reqs = [ PasswordAuthenticationRequest
::class => $req ];
581 $provider = $this->getProvider( true );
583 $provider->beginPrimaryAccountCreation( $user, $user, [] );
584 $this->fail( 'Expected exception was not thrown' );
585 } catch ( \BadMethodCallException
$ex ) {
587 'Shouldn\'t call this when accountCreationType() is NONE', $ex->getMessage()
592 $provider->finishAccountCreation( $user, $user, AuthenticationResponse
::newPass() );
593 $this->fail( 'Expected exception was not thrown' );
594 } catch ( \BadMethodCallException
$ex ) {
596 'Shouldn\'t call this when accountCreationType() is NONE', $ex->getMessage()
600 $provider = $this->getProvider( false );
603 AuthenticationResponse
::newAbstain(),
604 $provider->beginPrimaryAccountCreation( $user, $user, [] )
607 $req->username
= 'foo';
608 $req->password
= null;
610 AuthenticationResponse
::newAbstain(),
611 $provider->beginPrimaryAccountCreation( $user, $user, $reqs )
614 $req->username
= null;
615 $req->password
= 'bar';
617 AuthenticationResponse
::newAbstain(),
618 $provider->beginPrimaryAccountCreation( $user, $user, $reqs )
621 $req->username
= 'foo';
622 $req->password
= 'bar';
624 $expect = AuthenticationResponse
::newPass( 'Foo' );
625 $expect->createRequest
= clone( $req );
626 $expect->createRequest
->username
= 'Foo';
627 $this->assertEquals( $expect, $provider->beginPrimaryAccountCreation( $user, $user, $reqs ) );
629 // We have to cheat a bit to avoid having to add a new user to
630 // the database to test the actual setting of the password works right
631 $dbw = wfGetDB( DB_MASTER
);
633 $user = \User
::newFromName( 'UTSysop' );
634 $req->username
= $user->getName();
635 $req->password
= 'NewPassword';
636 $expect = AuthenticationResponse
::newPass( 'UTSysop' );
637 $expect->createRequest
= $req;
639 $res2 = $provider->beginPrimaryAccountCreation( $user, $user, $reqs );
640 $this->assertEquals( $expect, $res2, 'Sanity check' );
642 $ret = $provider->beginPrimaryAuthentication( $reqs );
643 $this->assertEquals( AuthenticationResponse
::FAIL
, $ret->status
, 'sanity check' );
645 $this->assertNull( $provider->finishAccountCreation( $user, $user, $res2 ) );
646 $ret = $provider->beginPrimaryAuthentication( $reqs );
647 $this->assertEquals( AuthenticationResponse
::PASS
, $ret->status
, 'new password is set' );