fix: 1. CAS user fail to create totp credential 2. do not try password

auth for CAS users

pkg/apis/identity/aksk.go

@@ -19,6 +19,8 @@ import (
 )
 
 const (
+	DEFAULT_PROJECT = "default"
+
 	ACCESS_SECRET_TYPE    = "aksk"
 	TOTP_TYPE             = "totp"
 	RECOVERY_SECRETS_TYPE = "recovery_secret"

pkg/apis/identity/consts.go

@@ -78,6 +78,11 @@ const (
 var (
 	AUTH_METHODS = []string{AUTH_METHOD_PASSWORD, AUTH_METHOD_TOKEN, AUTH_METHOD_AKSK, AUTH_METHOD_CAS}
 
+	PASSWORD_PROTECTED_IDPS = []string{
+		IdentityDriverSQL,
+		IdentityDriverLDAP,
+	}
+
 	SensitiveDomainConfigMap = map[string]string{
 		"ldap": "password",
 	}

pkg/keystone/models/credentials.go

@@ -107,24 +107,17 @@ func (manager *SCredentialManager) ValidateCreateData(ctx context.Context, userC
 	if !data.Contains("type") {
 		return nil, httperrors.NewInputParameterError("missing input feild type")
 	}
-	userId, _ := data.GetString("user_id")
 	projectId, _ := data.GetString("project_id")
+	userId := ownerId.GetUserId()
 	if len(userId) == 0 {
 		userId = userCred.GetUserId()
-		data.Set("user_id", jsonutils.NewString(userId))
-	} else {
-		_, err := UserManager.FetchById(userId)
-		if err != nil {
-			if err == sql.ErrNoRows {
-				return nil, httperrors.NewResourceNotFoundError2(UserManager.Keyword(), userId)
-			} else {
-				return nil, httperrors.NewGeneralError(err)
-			}
-		}
 	}
+	data.Set("user_id", jsonutils.NewString(userId))
 	if len(projectId) == 0 {
 		projectId = userCred.GetProjectId()
 		data.Set("project_id", jsonutils.NewString(projectId))
+	} else if projectId == api.DEFAULT_PROJECT {
+		// do nothing
 	} else {
 		_, err := ProjectManager.FetchById(projectId)
 		if err != nil {

pkg/keystone/models/id_mappings.go

@@ -21,7 +21,8 @@ import (
 	"time"
 
 	"github.com/golang-plus/uuid"
-	"github.com/pkg/errors"
+
+	"yunion.io/x/pkg/errors"
 
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"

pkg/keystone/models/identity_provider.go

@@ -819,3 +819,8 @@ func (manager *SIdentityProviderManager) FetchIdentityProviderById(idstr string)
 	}
 	return obj.(*SIdentityProvider), nil
 }
+
+func (manager *SIdentityProviderManager) FetchPasswordProtectedIdpIdsQuery() *sqlchemy.SSubQuery {
+	q := manager.Query("id").In("driver", api.PASSWORD_PROTECTED_IDPS)
+	return q.SubQuery()
+}

pkg/keystone/tokens/auth.go

@@ -70,7 +70,15 @@ func authUserByIdentity(ctx context.Context, ident mcclient.SAuthenticationIdent
 		return nil, ErrEmptyAuth
 	}
 	if len(ident.Password.User.Name) > 0 && len(ident.Password.User.Id) == 0 && len(ident.Password.User.Domain.Id) == 0 && len(ident.Password.User.Domain.Name) == 0 {
-		q := models.UserManager.Query().Equals("name", ident.Password.User.Name)
+		users := models.UserManager.Query().SubQuery()
+		idMappings := models.IdmappingManager.Query().SubQuery()
+		q := users.Query()
+		q = q.LeftJoin(idMappings, sqlchemy.Equals(idMappings.Field("public_id"), users.Field("id")))
+		q = q.Filter(sqlchemy.Equals(users.Field("name"), ident.Password.User.Name))
+		q = q.Filter(sqlchemy.OR(
+			sqlchemy.IsNull(idMappings.Field("domain_id")),
+			sqlchemy.In(idMappings.Field("domain_id"), models.IdentityProviderManager.FetchPasswordProtectedIdpIdsQuery()),
+		))
 		usrCnt, err := q.CountWithError()
 		if err != nil {
 			return nil, errors.Wrap(err, "Query user by name")

pkg/mcclient/modules/mod_credentials.go

@@ -34,7 +34,7 @@ type SCredentialManager struct {
 }
 
 const (
-	DEFAULT_PROJECT = "default"
+	DEFAULT_PROJECT = api.DEFAULT_PROJECT
 
 	ACCESS_SECRET_TYPE    = api.ACCESS_SECRET_TYPE
 	TOTP_TYPE             = api.TOTP_TYPE