opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-24 16:03:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

optimized(keystone): local sql auth by password (#22305)

Browse Source
This commit is contained in:
Zexi Li
2025-03-19 10:10:55 +08:00
committed by GitHub
parent ea36eb2e82
commit 9874b4af3f
2 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/keystone/models/passwords.go
+22 -3
View File
@@ -26,6 +26,7 @@ import (
"yunion.io/x/log"
"yunion.io/x/pkg/errors"
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
notifyapi "yunion.io/x/onecloud/pkg/apis/notify"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
@@ -107,12 +108,30 @@ func (manager *SPasswordManager) FetchLastPassword(localUserId int) (*SPassword,
return &passes[0], nil
}
func (manager *SPasswordManager) fetchByLocaluserId(localUserId int) ([]SPassword, error) {
passes := make([]SPassword, 0)
func (manager *SPasswordManager) getFetchByLocaluserIdQuery(localUserId int) *sqlchemy.SQuery {
passwords := manager.Query().SubQuery()
q := passwords.Query().Equals("local_user_id", localUserId)
q = q.Desc(passwords.Field("created_at_int"))
return q
}
func (manager *SPasswordManager) FetchByLocaluserIdNewestPassword(localUserId int) (*SPassword, error) {
obj, err := db.NewModelObject(manager)
if err != nil {
return nil, errors.Wrap(err, "new password object")
}
q := manager.getFetchByLocaluserIdQuery(localUserId).Limit(1)
if err := q.First(obj); err != nil {
return nil, errors.Wrap(err, "get newest password object")
}
return obj.(*SPassword), nil
}
func (manager *SPasswordManager) fetchByLocaluserId(localUserId int) ([]SPassword, error) {
passes := make([]SPassword, 0)
q := manager.getFetchByLocaluserIdQuery(localUserId)
err := db.FetchModelObjects(manager, q, &passes)
if err != nil && err != sql.ErrNoRows {
return nil, errors.Wrap(err, "db.FetchModelObjects")
pkg/keystone/models/users.go
+4 -4
View File
@@ -348,11 +348,11 @@ func VerifyPassword(user *api.SUserExtended, passwd string) error {
}
func localUserVerifyPassword(user *api.SUserExtended, passwd string) error {
passes, err := PasswordManager.fetchByLocaluserId(user.LocalId)
pass, err := PasswordManager.FetchByLocaluserIdNewestPassword(user.LocalId)
if err != nil {
return errors.Wrap(err, "fetchPassword")
}
if len(passes) == 0 {
if pass == nil {
return errors.Error("no valid password")
}
// password expiration check skip system account
@@ -360,14 +360,14 @@ func localUserVerifyPassword(user *api.SUserExtended, passwd string) error {
// return errors.Error("password expires")
// }
// password expires, no error returns but set user need to reset password silently
if passes[0].IsExpired() {
if pass.IsExpired() {
localUsr, err := LocalUserManager.fetchLocalUser("", "", user.LocalId)
if err != nil {
return errors.Wrap(err, "fetchLocalUser")
}
localUsr.markNeedResetPassword(true, api.PasswordResetHintExpire)
}
err = seclib2.BcryptVerifyPassword(passwd, passes[0].PasswordHash)
err = seclib2.BcryptVerifyPassword(passwd, pass.PasswordHash)
if err == nil {
return nil
}