478749 - Let administrators import user accounts from an external authentication server

Status: NEW

(Bugzilla :: User Accounts, enhancement)

Description

[Eric Olson]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6) Gecko/2009011913 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Build Identifier: 3.2.2

Adding a new user should allow for empty passwords if LDAP authentication is enabled in user_verify_class. Currently, adding a new user requires a password of at least 3 characters. This means users may have two passwords that are valid to log in to Bugzilla, one which may violate local security policy (e.g. too weak a password). 

I'd like my real users to have to authenticate against our LDAP directory, but also be able to create local Bugzilla-only accounts, like a Bugzilla administrator account.

I assume the same should be true if RADIUS is enabled instead of LDAP, but I don't use it.

Reproducible: Always




Related to bug 478748.

Comment 1

[Frédéric Buclin]

I'm morphing the bug summary to better reflect what we will do: adding new user accounts with an empty password means anyone could log into Bugzilla without typing any password, which we obviously don't want. To do what you want, the encrypted password must be '*'. This forces the user account to be validated against an external authentication server (currently: LDAP or RADIUS). What you want here is the ability to import a valid LDAP (or RADIUS) account into Bugzilla, so that you can e.g. CC him without having to wait for him to log into Bugzilla for the first time (which has the side effect of automatically create an account in Bugzilla, but with '*' as password).

manu said on IRC that similar code already exists in contrib/syncLDAP.pl, so we could reuse it to allow user account import from editusers.cgi.

Comment 2

[Eric Olson]

I'll agree that you've described what I'm trying to do fairly accurately.  

In my testing, however, for a user where cryptpassword is either an empty string or NULL, I don't seem to be able to log in with an empty password field. Is the '*' in cryptpassword really necessary?

Comment 3

[Michael Thomas (Mockodin)]

Eric what happens if down the road you turn on LDAP,DB? With out the '*' users would then be able fail over to DB login using a blank password. So yes, I think it it.

Comment 4

[Eric Olson]

You are correct. I must have had authentication set to only LDAP when I tested this, but thought I was testing with LDAP,DB. A NULL in the cryptpassword field does, indeed, mean you can log in with no password at all.