3 namespace MediaWiki\Auth
;
5 use MediaWiki\MediaWikiServices
;
6 use Wikimedia\TestingAccessWrapper
;
11 * @covers MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider
13 class LocalPasswordPrimaryAuthenticationProviderTest
extends \MediaWikiTestCase
{
15 private $manager = null;
16 private $config = null;
17 private $validity = null;
20 * Get an instance of the provider
22 * $provider->checkPasswordValidity is mocked to return $this->validity,
23 * because we don't need to test that here.
25 * @param bool $loginOnly
26 * @return LocalPasswordPrimaryAuthenticationProvider
28 protected function getProvider( $loginOnly = false ) {
29 if ( !$this->config
) {
30 $this->config
= new \
HashConfig();
32 $config = new \
MultiConfig( [
34 MediaWikiServices
::getInstance()->getMainConfig()
37 if ( !$this->manager
) {
38 $this->manager
= new AuthManager( new \
FauxRequest(), $config );
40 $this->validity
= \Status
::newGood();
42 $provider = $this->getMockBuilder( LocalPasswordPrimaryAuthenticationProvider
::class )
43 ->setMethods( [ 'checkPasswordValidity' ] )
44 ->setConstructorArgs( [ [ 'loginOnly' => $loginOnly ] ] )
46 $provider->expects( $this->any() )->method( 'checkPasswordValidity' )
47 ->will( $this->returnCallback( function () {
48 return $this->validity
;
50 $provider->setConfig( $config );
51 $provider->setLogger( new \Psr\Log\
NullLogger() );
52 $provider->setManager( $this->manager
);
57 public function testBasics() {
58 $user = $this->getMutableTestUser()->getUser();
59 $userName = $user->getName();
60 $lowerInitialUserName = mb_strtolower( $userName[0] ) . substr( $userName, 1 );
62 $provider = new LocalPasswordPrimaryAuthenticationProvider();
65 PrimaryAuthenticationProvider
::TYPE_CREATE
,
66 $provider->accountCreationType()
69 $this->assertTrue( $provider->testUserExists( $userName ) );
70 $this->assertTrue( $provider->testUserExists( $lowerInitialUserName ) );
71 $this->assertFalse( $provider->testUserExists( 'DoesNotExist' ) );
72 $this->assertFalse( $provider->testUserExists( '<invalid>' ) );
74 $provider = new LocalPasswordPrimaryAuthenticationProvider( [ 'loginOnly' => true ] );
77 PrimaryAuthenticationProvider
::TYPE_NONE
,
78 $provider->accountCreationType()
81 $this->assertTrue( $provider->testUserExists( $userName ) );
82 $this->assertFalse( $provider->testUserExists( 'DoesNotExist' ) );
84 $req = new PasswordAuthenticationRequest
;
85 $req->action
= AuthManager
::ACTION_CHANGE
;
86 $req->username
= '<invalid>';
87 $provider->providerChangeAuthenticationData( $req );
90 public function testTestUserCanAuthenticate() {
91 $user = $this->getMutableTestUser()->getUser();
92 $userName = $user->getName();
93 $dbw = wfGetDB( DB_MASTER
);
95 $provider = $this->getProvider();
97 $this->assertFalse( $provider->testUserCanAuthenticate( '<invalid>' ) );
99 $this->assertFalse( $provider->testUserCanAuthenticate( 'DoesNotExist' ) );
101 $this->assertTrue( $provider->testUserCanAuthenticate( $userName ) );
102 $lowerInitialUserName = mb_strtolower( $userName[0] ) . substr( $userName, 1 );
103 $this->assertTrue( $provider->testUserCanAuthenticate( $lowerInitialUserName ) );
107 [ 'user_password' => \PasswordFactory
::newInvalidPassword()->toString() ],
108 [ 'user_name' => $userName ]
110 $this->assertFalse( $provider->testUserCanAuthenticate( $userName ) );
115 [ 'user_password' => '0123456789abcdef0123456789abcdef' ],
116 [ 'user_name' => $userName ]
118 $this->assertTrue( $provider->testUserCanAuthenticate( $userName ) );
121 public function testSetPasswordResetFlag() {
123 $this->getProvider();
125 /// @todo: Because we're currently using User, which uses the global config...
126 $this->setMwGlobals( [ 'wgPasswordExpireGrace' => 100 ] );
128 $this->config
->set( 'PasswordExpireGrace', 100 );
129 $this->config
->set( 'InvalidPasswordReset', true );
131 $provider = new LocalPasswordPrimaryAuthenticationProvider();
132 $provider->setConfig( $this->config
);
133 $provider->setLogger( new \Psr\Log\
NullLogger() );
134 $provider->setManager( $this->manager
);
135 $providerPriv = TestingAccessWrapper
::newFromObject( $provider );
137 $user = $this->getMutableTestUser()->getUser();
138 $userName = $user->getName();
139 $dbw = wfGetDB( DB_MASTER
);
140 $row = $dbw->selectRow(
143 [ 'user_name' => $userName ],
147 $this->manager
->removeAuthenticationSessionData( null );
148 $row->user_password_expires
= wfTimestamp( TS_MW
, time() +
200 );
149 $providerPriv->setPasswordResetFlag( $userName, \Status
::newGood(), $row );
150 $this->assertNull( $this->manager
->getAuthenticationSessionData( 'reset-pass' ) );
152 $this->manager
->removeAuthenticationSessionData( null );
153 $row->user_password_expires
= wfTimestamp( TS_MW
, time() - 200 );
154 $providerPriv->setPasswordResetFlag( $userName, \Status
::newGood(), $row );
155 $ret = $this->manager
->getAuthenticationSessionData( 'reset-pass' );
156 $this->assertNotNull( $ret );
157 $this->assertSame( 'resetpass-expired', $ret->msg
->getKey() );
158 $this->assertTrue( $ret->hard
);
160 $this->manager
->removeAuthenticationSessionData( null );
161 $row->user_password_expires
= wfTimestamp( TS_MW
, time() - 1 );
162 $providerPriv->setPasswordResetFlag( $userName, \Status
::newGood(), $row );
163 $ret = $this->manager
->getAuthenticationSessionData( 'reset-pass' );
164 $this->assertNotNull( $ret );
165 $this->assertSame( 'resetpass-expired-soft', $ret->msg
->getKey() );
166 $this->assertFalse( $ret->hard
);
168 $this->manager
->removeAuthenticationSessionData( null );
169 $row->user_password_expires
= null;
170 $status = \Status
::newGood();
171 $status->error( 'testing' );
172 $providerPriv->setPasswordResetFlag( $userName, $status, $row );
173 $ret = $this->manager
->getAuthenticationSessionData( 'reset-pass' );
174 $this->assertNotNull( $ret );
175 $this->assertSame( 'resetpass-validity-soft', $ret->msg
->getKey() );
176 $this->assertFalse( $ret->hard
);
179 public function testAuthentication() {
180 $testUser = $this->getMutableTestUser();
181 $userName = $testUser->getUser()->getName();
183 $dbw = wfGetDB( DB_MASTER
);
184 $id = \User
::idFromName( $userName );
186 $req = new PasswordAuthenticationRequest();
187 $req->action
= AuthManager
::ACTION_LOGIN
;
188 $reqs = [ PasswordAuthenticationRequest
::class => $req ];
190 $provider = $this->getProvider();
194 AuthenticationResponse
::newAbstain(),
195 $provider->beginPrimaryAuthentication( [] )
198 $req->username
= 'foo';
199 $req->password
= null;
201 AuthenticationResponse
::newAbstain(),
202 $provider->beginPrimaryAuthentication( $reqs )
205 $req->username
= null;
206 $req->password
= 'bar';
208 AuthenticationResponse
::newAbstain(),
209 $provider->beginPrimaryAuthentication( $reqs )
212 $req->username
= '<invalid>';
213 $req->password
= 'WhoCares';
214 $ret = $provider->beginPrimaryAuthentication( $reqs );
216 AuthenticationResponse
::newAbstain(),
217 $provider->beginPrimaryAuthentication( $reqs )
220 $req->username
= 'DoesNotExist';
221 $req->password
= 'DoesNotExist';
222 $ret = $provider->beginPrimaryAuthentication( $reqs );
224 AuthenticationResponse
::FAIL
,
229 $ret->message
->getKey()
232 // Validation failure
233 $req->username
= $userName;
234 $req->password
= $testUser->getPassword();
235 $this->validity
= \Status
::newFatal( 'arbitrary-failure' );
236 $ret = $provider->beginPrimaryAuthentication( $reqs );
238 AuthenticationResponse
::FAIL
,
243 $ret->message
->getKey()
247 $this->manager
->removeAuthenticationSessionData( null );
248 $this->validity
= \Status
::newGood();
250 AuthenticationResponse
::newPass( $userName ),
251 $provider->beginPrimaryAuthentication( $reqs )
253 $this->assertNull( $this->manager
->getAuthenticationSessionData( 'reset-pass' ) );
255 // Successful auth after normalizing name
256 $this->manager
->removeAuthenticationSessionData( null );
257 $this->validity
= \Status
::newGood();
258 $req->username
= mb_strtolower( $userName[0] ) . substr( $userName, 1 );
260 AuthenticationResponse
::newPass( $userName ),
261 $provider->beginPrimaryAuthentication( $reqs )
263 $this->assertNull( $this->manager
->getAuthenticationSessionData( 'reset-pass' ) );
264 $req->username
= $userName;
266 // Successful auth with reset
267 $this->manager
->removeAuthenticationSessionData( null );
268 $this->validity
->error( 'arbitrary-warning' );
270 AuthenticationResponse
::newPass( $userName ),
271 $provider->beginPrimaryAuthentication( $reqs )
273 $this->assertNotNull( $this->manager
->getAuthenticationSessionData( 'reset-pass' ) );
276 $this->validity
= \Status
::newGood();
277 $req->password
= 'Wrong';
278 $ret = $provider->beginPrimaryAuthentication( $reqs );
280 AuthenticationResponse
::FAIL
,
285 $ret->message
->getKey()
288 // Correct handling of legacy encodings
289 $password = ':B:salt:' . md5( 'salt-' . md5( "\xe1\xe9\xed\xf3\xfa" ) );
290 $dbw->update( 'user', [ 'user_password' => $password ], [ 'user_name' => $userName ] );
291 $req->password
= 'áéÃóú';
292 $ret = $provider->beginPrimaryAuthentication( $reqs );
294 AuthenticationResponse
::FAIL
,
299 $ret->message
->getKey()
302 $this->config
->set( 'LegacyEncoding', true );
304 AuthenticationResponse
::newPass( $userName ),
305 $provider->beginPrimaryAuthentication( $reqs )
308 $req->password
= 'áéÃóú Wrong';
309 $ret = $provider->beginPrimaryAuthentication( $reqs );
311 AuthenticationResponse
::FAIL
,
316 $ret->message
->getKey()
319 // Correct handling of really old password hashes
320 $this->config
->set( 'PasswordSalt', false );
321 $password = md5( 'FooBar' );
322 $dbw->update( 'user', [ 'user_password' => $password ], [ 'user_name' => $userName ] );
323 $req->password
= 'FooBar';
325 AuthenticationResponse
::newPass( $userName ),
326 $provider->beginPrimaryAuthentication( $reqs )
329 $this->config
->set( 'PasswordSalt', true );
330 $password = md5( "$id-" . md5( 'FooBar' ) );
331 $dbw->update( 'user', [ 'user_password' => $password ], [ 'user_name' => $userName ] );
332 $req->password
= 'FooBar';
334 AuthenticationResponse
::newPass( $userName ),
335 $provider->beginPrimaryAuthentication( $reqs )
340 * @dataProvider provideProviderAllowsAuthenticationDataChange
341 * @param string $type
342 * @param string $user
343 * @param \Status $validity Result of the password validity check
344 * @param \StatusValue $expect1 Expected result with $checkData = false
345 * @param \StatusValue $expect2 Expected result with $checkData = true
347 public function testProviderAllowsAuthenticationDataChange( $type, $user, \Status
$validity,
348 \StatusValue
$expect1, \StatusValue
$expect2
350 if ( $type === PasswordAuthenticationRequest
::class ) {
352 } elseif ( $type === PasswordDomainAuthenticationRequest
::class ) {
353 $req = new $type( [] );
355 $req = $this->createMock( $type );
357 $req->action
= AuthManager
::ACTION_CHANGE
;
358 $req->username
= $user;
359 $req->password
= 'NewPassword';
360 $req->retype
= 'NewPassword';
362 $provider = $this->getProvider();
363 $this->validity
= $validity;
364 $this->assertEquals( $expect1, $provider->providerAllowsAuthenticationDataChange( $req, false ) );
365 $this->assertEquals( $expect2, $provider->providerAllowsAuthenticationDataChange( $req, true ) );
367 $req->retype
= 'BadRetype';
370 $provider->providerAllowsAuthenticationDataChange( $req, false )
373 $expect2->getValue() === 'ignored' ?
$expect2 : \StatusValue
::newFatal( 'badretype' ),
374 $provider->providerAllowsAuthenticationDataChange( $req, true )
377 $provider = $this->getProvider( true );
379 \StatusValue
::newGood( 'ignored' ),
380 $provider->providerAllowsAuthenticationDataChange( $req, true ),
381 'loginOnly mode should claim to ignore all changes'
385 public static function provideProviderAllowsAuthenticationDataChange() {
386 $err = \StatusValue
::newGood();
387 $err->error( 'arbitrary-warning' );
390 [ AuthenticationRequest
::class, 'UTSysop', \Status
::newGood(),
391 \StatusValue
::newGood( 'ignored' ), \StatusValue
::newGood( 'ignored' ) ],
392 [ PasswordAuthenticationRequest
::class, 'UTSysop', \Status
::newGood(),
393 \StatusValue
::newGood(), \StatusValue
::newGood() ],
394 [ PasswordAuthenticationRequest
::class, 'uTSysop', \Status
::newGood(),
395 \StatusValue
::newGood(), \StatusValue
::newGood() ],
396 [ PasswordAuthenticationRequest
::class, 'UTSysop', \Status
::wrap( $err ),
397 \StatusValue
::newGood(), $err ],
398 [ PasswordAuthenticationRequest
::class, 'UTSysop', \Status
::newFatal( 'arbitrary-error' ),
399 \StatusValue
::newGood(), \StatusValue
::newFatal( 'arbitrary-error' ) ],
400 [ PasswordAuthenticationRequest
::class, 'DoesNotExist', \Status
::newGood(),
401 \StatusValue
::newGood(), \StatusValue
::newGood( 'ignored' ) ],
402 [ PasswordDomainAuthenticationRequest
::class, 'UTSysop', \Status
::newGood(),
403 \StatusValue
::newGood( 'ignored' ), \StatusValue
::newGood( 'ignored' ) ],
408 * @dataProvider provideProviderChangeAuthenticationData
409 * @param callable|bool $usernameTransform
410 * @param string $type
411 * @param bool $loginOnly
412 * @param bool $changed
414 public function testProviderChangeAuthenticationData(
415 $usernameTransform, $type, $loginOnly, $changed ) {
416 $testUser = $this->getMutableTestUser();
417 $user = $testUser->getUser()->getName();
418 if ( is_callable( $usernameTransform ) ) {
419 $user = call_user_func( $usernameTransform, $user );
421 $cuser = ucfirst( $user );
422 $oldpass = $testUser->getPassword();
423 $newpass = 'NewPassword';
425 $dbw = wfGetDB( DB_MASTER
);
426 $oldExpiry = $dbw->selectField( 'user', 'user_password_expires', [ 'user_name' => $cuser ] );
428 $this->mergeMwGlobalArrayValue( 'wgHooks', [
429 'ResetPasswordExpiration' => [ function ( $user, &$expires ) {
430 $expires = '30001231235959';
434 $provider = $this->getProvider( $loginOnly );
437 $loginReq = new PasswordAuthenticationRequest();
438 $loginReq->action
= AuthManager
::ACTION_LOGIN
;
439 $loginReq->username
= $user;
440 $loginReq->password
= $oldpass;
441 $loginReqs = [ PasswordAuthenticationRequest
::class => $loginReq ];
443 AuthenticationResponse
::newPass( $cuser ),
444 $provider->beginPrimaryAuthentication( $loginReqs ),
448 if ( $type === PasswordAuthenticationRequest
::class ) {
449 $changeReq = new $type();
451 $changeReq = $this->createMock( $type );
453 $changeReq->action
= AuthManager
::ACTION_CHANGE
;
454 $changeReq->username
= $user;
455 $changeReq->password
= $newpass;
456 $provider->providerChangeAuthenticationData( $changeReq );
458 if ( $loginOnly && $changed ) {
461 $expectExpiry = null;
462 } elseif ( $changed ) {
465 $expectExpiry = '30001231235959';
469 $expectExpiry = $oldExpiry;
472 $loginReq->password
= $oldpass;
473 $ret = $provider->beginPrimaryAuthentication( $loginReqs );
474 if ( $old === 'pass' ) {
476 AuthenticationResponse
::newPass( $cuser ),
478 'old password should pass'
482 AuthenticationResponse
::FAIL
,
484 'old password should fail'
488 $ret->message
->getKey(),
489 'old password should fail'
493 $loginReq->password
= $newpass;
494 $ret = $provider->beginPrimaryAuthentication( $loginReqs );
495 if ( $new === 'pass' ) {
497 AuthenticationResponse
::newPass( $cuser ),
499 'new password should pass'
503 AuthenticationResponse
::FAIL
,
505 'new password should fail'
509 $ret->message
->getKey(),
510 'new password should fail'
518 $dbw->selectField( 'user', 'user_password_expires', [ 'user_name' => $cuser ] )
523 public static function provideProviderChangeAuthenticationData() {
525 [ false, AuthenticationRequest
::class, false, false ],
526 [ false, PasswordAuthenticationRequest
::class, false, true ],
527 [ false, AuthenticationRequest
::class, true, false ],
528 [ false, PasswordAuthenticationRequest
::class, true, true ],
529 [ 'ucfirst', PasswordAuthenticationRequest
::class, false, true ],
530 [ 'ucfirst', PasswordAuthenticationRequest
::class, true, true ],
534 public function testTestForAccountCreation() {
535 $user = \User
::newFromName( 'foo' );
536 $req = new PasswordAuthenticationRequest();
537 $req->action
= AuthManager
::ACTION_CREATE
;
538 $req->username
= 'Foo';
539 $req->password
= 'Bar';
540 $req->retype
= 'Bar';
541 $reqs = [ PasswordAuthenticationRequest
::class => $req ];
543 $provider = $this->getProvider();
545 \StatusValue
::newGood(),
546 $provider->testForAccountCreation( $user, $user, [] ),
547 'No password request'
551 \StatusValue
::newGood(),
552 $provider->testForAccountCreation( $user, $user, $reqs ),
553 'Password request, validated'
556 $req->retype
= 'Baz';
558 \StatusValue
::newFatal( 'badretype' ),
559 $provider->testForAccountCreation( $user, $user, $reqs ),
560 'Password request, bad retype'
562 $req->retype
= 'Bar';
564 $this->validity
->error( 'arbitrary warning' );
565 $expect = \StatusValue
::newGood();
566 $expect->error( 'arbitrary warning' );
569 $provider->testForAccountCreation( $user, $user, $reqs ),
570 'Password request, not validated'
573 $provider = $this->getProvider( true );
574 $this->validity
->error( 'arbitrary warning' );
576 \StatusValue
::newGood(),
577 $provider->testForAccountCreation( $user, $user, $reqs ),
578 'Password request, not validated, loginOnly'
582 public function testAccountCreation() {
583 $user = \User
::newFromName( 'Foo' );
585 $req = new PasswordAuthenticationRequest();
586 $req->action
= AuthManager
::ACTION_CREATE
;
587 $reqs = [ PasswordAuthenticationRequest
::class => $req ];
589 $provider = $this->getProvider( true );
591 $provider->beginPrimaryAccountCreation( $user, $user, [] );
592 $this->fail( 'Expected exception was not thrown' );
593 } catch ( \BadMethodCallException
$ex ) {
595 'Shouldn\'t call this when accountCreationType() is NONE', $ex->getMessage()
600 $provider->finishAccountCreation( $user, $user, AuthenticationResponse
::newPass() );
601 $this->fail( 'Expected exception was not thrown' );
602 } catch ( \BadMethodCallException
$ex ) {
604 'Shouldn\'t call this when accountCreationType() is NONE', $ex->getMessage()
608 $provider = $this->getProvider( false );
611 AuthenticationResponse
::newAbstain(),
612 $provider->beginPrimaryAccountCreation( $user, $user, [] )
615 $req->username
= 'foo';
616 $req->password
= null;
618 AuthenticationResponse
::newAbstain(),
619 $provider->beginPrimaryAccountCreation( $user, $user, $reqs )
622 $req->username
= null;
623 $req->password
= 'bar';
625 AuthenticationResponse
::newAbstain(),
626 $provider->beginPrimaryAccountCreation( $user, $user, $reqs )
629 $req->username
= 'foo';
630 $req->password
= 'bar';
632 $expect = AuthenticationResponse
::newPass( 'Foo' );
633 $expect->createRequest
= clone $req;
634 $expect->createRequest
->username
= 'Foo';
635 $this->assertEquals( $expect, $provider->beginPrimaryAccountCreation( $user, $user, $reqs ) );
637 // We have to cheat a bit to avoid having to add a new user to
638 // the database to test the actual setting of the password works right
639 $dbw = wfGetDB( DB_MASTER
);
641 $user = \User
::newFromName( 'UTSysop' );
642 $req->username
= $user->getName();
643 $req->password
= 'NewPassword';
644 $expect = AuthenticationResponse
::newPass( 'UTSysop' );
645 $expect->createRequest
= $req;
647 $res2 = $provider->beginPrimaryAccountCreation( $user, $user, $reqs );
648 $this->assertEquals( $expect, $res2, 'Sanity check' );
650 $ret = $provider->beginPrimaryAuthentication( $reqs );
651 $this->assertEquals( AuthenticationResponse
::FAIL
, $ret->status
, 'sanity check' );
653 $this->assertNull( $provider->finishAccountCreation( $user, $user, $res2 ) );
654 $ret = $provider->beginPrimaryAuthentication( $reqs );
655 $this->assertEquals( AuthenticationResponse
::PASS
, $ret->status
, 'new password is set' );