lib/account_manager/directory.rb
#
# Verify that the account exists; verify that the username and password
# match; activate the account if it isn't active; AS THE USER, set the
# password and password change date. If this is an admin reset, the
# account is not activated, but the password can be set.
#
# If args[:reset] is true, this is a user-initiated password reset. We
# already know it's authorized by the reset token, so we just use admin
# rights to update the directory attributes.
#
Verify that the account exists; verify that the username and password
match; activate the account if it isn't active; AS THE USER, set the
password and password change date. If this is an admin reset, the
account is not activated, but the password can be set.

If args[:reset] is true, this is a user-initiated password reset. We
already know it's authorized by the reset token, so we just use admin
rights to update the directory attributes.
Verify that the account exists ; verify that the username and password match ; activate the account if it isn ' t active ; AS THE USER set the password and password change date . If this is an admin reset the account is not activated but the password can be set . If args [ : reset ] is true this is a user - initiated password reset . We already know it ' s authorized by the reset token so we just use admin rights to update the directory attributes .
def change_password(args)
        uid            = args[:uid]
        new_password   = args[:new_password]
        old_password   = args[:old_password]
        admin          = args[:admin]
        admin_password = args[:admin_password]
         Figure out if this is an admin reset and set the bind credentials
        bind_uid = admin || uid
        password = admin_password || old_password
         Get a timestamp and record whether this is a temporary activation
         (should it be deactivated if password change fails?)
        timestamp = new_timestamp
        temporary_activation = false
         Indicate that the account doesn't exist if it doesn't
        return :no_such_account unless exists? uid
         If this is a user (non-admin), temporarily activate an inactive
         account so they can perform the password change themselves.
        unless activated?(uid) || admin
          activate uid, timestamp
          temporary_activation = true
        end
         If the user or admin can bind successfully, perform the password
         change. If they can't, deactivate any temporary activations and
         indicate a bind failure.
        if args[:reset] or can_bind? bind_uid, password
           The result of the ldap operation
          result = nil
           This block performs the actual ldap.modify action. Put it in a
           block so we can call it in either an admin or user context.
          blk = lambda do |ldap|
            ldap.modify(
              dn: bind_dn(uid),
              operations: [
                [:replace, :userpassword, new_password],
                [:replace, :passwordchangedate, timestamp]
              ]
            )
            result = ldap.get_operation_result
          end
          args[:reset] ? open_as_admin(&blk) : open_as(bind_uid, password, &blk)
           If we got an LDAP Insufficient Access Rights error, the admin user
           doesn't have the rights to perform this action. If the account
           isn't activated, we indicate that the password changed but the
           account is inactive. Otherwise just indicate success.
          if result.message == 'Insufficient Access Rights'
            :not_admin
          elsif deactivated?(uid)
            :success_inactive
          else
            :success
          end
        else
          deactivate uid if temporary_activation
          :bind_failure
        end
      end
def change_password ( args ) uid = args [ :uid ] new_password = args [ :new_password ] old_password = args [ :old_password ] admin = args [ :admin ] admin_password = args [ :admin_password ] bind_uid = admin || uid password = admin_password || old_password timestamp = new_timestamp temporary_activation = false return :no_such_account unless exists? uid unless activated? ( uid ) || admin activate uid , timestamp temporary_activation = true end if args [ :reset ] or can_bind? bind_uid , password result = nil blk = lambda do | ldap | ldap . modify ( dn : bind_dn ( uid ) , operations : [ [ :replace , :userpassword , new_password ] , [ :replace , :passwordchangedate , timestamp ] ] ) result = ldap . get_operation_result end args [ :reset ] ? open_as_admin ( & blk ) : open_as ( bind_uid , password , & blk ) if result . message == 'Insufficient Access Rights' :not_admin elsif deactivated? ( uid ) :success_inactive else :success end else deactivate uid if temporary_activation :bind_failure end end
Verify that the account exists; verify that the username and password
match; activate the account if it isn't active; AS THE USER, set the
password and password change date.
Verify that the account exists ; verify that the username and password match ; activate the account if it isn ' t active ; AS THE USER set the password and password change date .
# Assign arguments # # Figure out if this is an admin reset and set the bind credentials # # Get a timestamp and record whether this is a temporary activation # (should it be deactivated if password change fails?) # # Indicate that the account doesn't exist if it doesn't # # If this is a user (non-admin), temporarily activate an inactive # account so they can perform the password change themselves. # # If the user or admin can bind successfully, perform the password # change. If they can't, deactivate any temporary activations and # indicate a bind failure. # # The result of the ldap operation # # This block performs the actual ldap.modify action. Put it in a # block so we can call it in either an admin or user context. # # If we got an LDAP Insufficient Access Rights error, the admin user # doesn't have the rights to perform this action. If the account # isn't activated, we indicate that the password changed but the # account is inactive. Otherwise just indicate success. #
args
<not_specific>