Add CLI tool to lock/unlock users #782

shiv-tyagi · 2025-02-07T16:14:45Z

As discussed in #640, this adds a property to the UserDB to mark a user enable/disabled. Before creating an authentication session in pam, we check if the user exists in the cache and is disabled.

This also adds the initial implementation of the authctl tool which can be used to enable/disable a user.

UDENG-8188

shiv-tyagi · 2025-02-07T16:15:41Z

@adombeck Does this look good?

I see that the tests are failing on main branch as well. So I am hoping that it is not me.

codecov-commenter · 2025-02-07T16:22:07Z

Codecov Report

❌ Patch coverage is 76.78571% with 26 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.90%. Comparing base (229aa56) to head (3585468).
⚠️ Report is 23 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/authctl/main.go	30.76%	9 Missing ⚠️
internal/users/db/migration.go	83.33%	4 Missing ⚠️
cmd/authctl/user/user.go	72.72%	3 Missing ⚠️
cmd/authctl/user/lock.go	71.42%	2 Missing ⚠️
cmd/authctl/user/unlock.go	71.42%	2 Missing ⚠️
internal/services/pam/pam.go	75.00%	2 Missing ⚠️
internal/services/user/user.go	85.71%	2 Missing ⚠️
internal/users/db/update.go	80.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #782      +/-   ##
==========================================
- Coverage   88.10%   87.90%   -0.21%     
==========================================
  Files          85       89       +4     
  Lines        6013     6125     +112     
  Branches      111      111              
==========================================
+ Hits         5298     5384      +86     
- Misses        659      685      +26     
  Partials       56       56

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

internal/services/pam/pam.go

adombeck · 2025-02-10T13:17:56Z

Hi @shiv-tyagi, yes this looks good, thanks! One small thing: I would prefer to have a Disabled field instead of Enabled, so that the default value (false) means that the user is enabled, even when we're not using NewUserDB to instantiate the UserDB struct (like we do here).

adombeck · 2025-02-10T13:20:16Z

There should also be a new test case "Error_when_user_is_disabled" in https://github.com/shiv-tyagi/authd/blob/fed39218cfcce6c23e80e0d02fe2a2d748d3d912/internal/brokers/manager_test.go#L187-L190.

adombeck · 2025-02-10T13:22:24Z

Oh and I don't think it makes sense to merge this before we have code which actually causes a user to be disabled (i.e. the command-line tool). If you still plan to work on that soon, feel free to repurpose this PR. Otherwise, I'll start working on that soon and would then cherry-pick your commits to a new branch.

shiv-tyagi · 2025-02-10T17:30:14Z

I would prefer to have a Disabled field instead of Enabled, so that the default value (false) means that the user is enabled, even when we're not using NewUserDB to instantiate the UserDB struct (like we do here).

Sure. I will do that.

There should also be a new test case "Error_when_user_is_disabled"

Noted.

If you still plan to work on that soon, feel free to repurpose this PR.

Yes, I really intend to work on that. I will push my work soon :)

internal/users/manager.go

internal/services/pam/pam.go

adombeck · 2025-02-18T14:31:00Z

I rebased on main and resolved the conflicts caused by #779.

shiv-tyagi · 2025-02-18T17:41:33Z

I rebased on main and resolved the conflicts caused by #779.

Thanks for this @adombeck. I had some more work which I had not pushed yet. I would need to fix that as well. Planning to push that work soon.

shiv-tyagi · 2025-02-19T06:53:46Z

I have finished the part till extending the GRPC API with new methods and adding unit tests for those. Now only the part of creating the CLI tool to call those methods remains.

shiv-tyagi · 2025-02-26T05:28:29Z

@adombeck I have added the initial implementation of the authctl tool. Please check if it looks good and provide any suggestions for me to proceed. This is my first time writing Go code, so I apologise if I made any rookie mistakes. I’ll be happy to fix them.

Thanks in advance.

adombeck

I've got a few comments but the overall code style is good! Thanks a lot, @shiv-tyagi!

internal/users/manager_test.go

internal/proto/authd/authd.proto

cmd/authctl/main.go

cmd/authctl/user/disable.go

cmd/authctl/user/user.go

shiv-tyagi · 2025-03-04T18:36:52Z

Thank you so much @adombeck for reviewing this. I have addressed all your suggestions. What next? How should I test it locally?

I don't know why, but specifying "Args: cobra.NoArgs" without a Run or RunE function has this effect.

I would expect a function called RunDaemon to start the daemon and block until it has finished running. StartDaemon makes it clear that the function returns once the daemon was started.

It can take a while to build and start the daemon. Lets add some logs to make it a bit clearer what is taking so long.

authctl shows these errors messages, so let's improve them. For example, instead of: no result matching "foo" in "users" use: user "foo" not found

The BuildDaemon() function is only called to build the daemon for integration tests with the example broker. Lets avoid passing the same arguments everywhere. Also renames the function to BuildDaemonWithExampleBroker.

Everywhere we called StartDaemon(), we registered the cleanup of the daemon process via t.Cleanup(). Let's avoid the duplicate code by inlining the cleanup registration into StartDaemon().

Lets be more consistent with other command-line tools which control system services, like systemctl and machinectl, and not print any output if the command succeeds (for example like `systemctl start`/`systemctl stop` or `machinectl kill`).

When trying to log in with a locked user, the following error message is printed: $ su [email protected] can't select broker: error PermissionDenied from server: can't start authentication transaction: rpc error: code = PermissionDenied desc = user [email protected] is locked The "can't start authentication transaction" part doesn't add any valuable information to the error message, which is already too long. By omitting it, we also avoid that the gRPC status is formatted to a string containing the error code, which would duplicate information which the caller adds to the error message. With this commit, the error message is simplified to: can't select broker: error PermissionDenied from server: user [email protected] is locked

Following up on the error message printed when trying to log in as a locked user, we can further improve the message: $ su [email protected] can't select broker: error PermissionDenied from server: user [email protected] is locked by omitting the "can't select broker:" part, which doesn't add any useful information. With this commit, the error message is simplified to: error PermissionDenied from server: user [email protected] is locked

Further improve the error message printed when trying to log in with a locked user from: error PermissionDenied from server: user [email protected] is locked to permission denied: user [email protected] is locked

Co-Authored-By: Adrian Dombeck <[email protected]>

Same as pam_unix, we now avoid leaking to unauthenticated users whether a user account is locked. That's achieved by only checking if the user is locked after they successfully authenticated to the broker, aborting login in that case. That has the side effect that locked users can still refresh the token and user info which the broker stores on disk. This commit also implements the same improvements to the "permission denied: user is locked" error message which were already implemented in the SelectBroker method. I'm not reverting the changes to the SelectBroker method because I think they are still improvements, even if they are not relevant for this specific error message anymore.

adombeck · 2025-09-23T13:54:04Z

Many thanks for the great contribution, @shiv-tyagi!

shiv-tyagi · 2025-09-23T13:56:56Z

Finally!!! Really happy.

Thanks to you @adombeck as you did most of the work and kept it alive. Grateful to you. I will continue contributing :)

shiv-tyagi requested a review from a team as a code owner February 7, 2025 16:14

shiv-tyagi changed the title ~~Check is a user is disabled before logging in~~ Check if a user is disabled before logging in Feb 10, 2025

adombeck reviewed Feb 10, 2025

View reviewed changes

internal/services/pam/pam.go Outdated Show resolved Hide resolved

shiv-tyagi force-pushed the user-disable branch from e6410f4 to a7d839c Compare February 10, 2025 17:27

3v1n0 reviewed Feb 11, 2025

View reviewed changes

internal/users/manager.go Outdated Show resolved Hide resolved

shiv-tyagi force-pushed the user-disable branch 4 times, most recently from 7183092 to 5e81b35 Compare February 15, 2025 18:22

adombeck reviewed Feb 17, 2025

View reviewed changes

internal/services/pam/pam.go Outdated Show resolved Hide resolved

adombeck force-pushed the user-disable branch from 5e81b35 to 54aae19 Compare February 18, 2025 14:30

shiv-tyagi force-pushed the user-disable branch 2 times, most recently from 7f1338f to fce5e88 Compare February 19, 2025 06:51

shiv-tyagi force-pushed the user-disable branch from fce5e88 to 7208138 Compare February 26, 2025 05:20

shiv-tyagi changed the title ~~Check if a user is disabled before logging in~~ Add functionality to Enable/Disable users Feb 26, 2025

adombeck reviewed Feb 26, 2025

View reviewed changes

shiv-tyagi force-pushed the user-disable branch from 7208138 to 33ddd8c Compare March 4, 2025 18:25

shiv-tyagi force-pushed the user-disable branch from 33ddd8c to 5152313 Compare March 4, 2025 18:56

adombeck mentioned this pull request Mar 7, 2025

Removing user via command-line tool should also delete user data from brokers #830

Open

adombeck and others added 25 commits September 23, 2025 15:24

authctl: Improve long description

19542a3

Fix authctl exiting with 0 when called with unknown command

c36380f

I don't know why, but specifying "Args: cobra.NoArgs" without a Run or RunE function has this effect.

Return gRPC errors in API methods

e526eec

authctl: Add tests for root command

39734fd

authctl: Add integration test for authctl user

14c9ab3

refactor: Rename RunDaemon -> StartDaemon

1fd692c

I would expect a function called RunDaemon to start the daemon and block until it has finished running. StartDaemon makes it clear that the function returns once the daemon was started.

Improve error message

681d9fb

Add debug logs to testutils

0358df8

It can take a while to build and start the daemon. Lets add some logs to make it a bit clearer what is taking so long.

authctl: Add integration test for authctl user lock

1ab59c8

Improve error messages

4318e1c

authctl shows these errors messages, so let's improve them. For example, instead of: no result matching "foo" in "users" use: user "foo" not found

refactor: Inline extra args in BuildDaemon()

62280a1

The BuildDaemon() function is only called to build the daemon for integration tests with the example broker. Lets avoid passing the same arguments everywhere. Also renames the function to BuildDaemonWithExampleBroker.

refactor: Add WithCurrentUserAsRoot option for testutils.StartDaemon()

90d6a71

refactor: Register cleanup of daemon process as part of StartDaemon()

7ec389a

Everywhere we called StartDaemon(), we registered the cleanup of the daemon process via t.Cleanup(). Let's avoid the duplicate code by inlining the cleanup registration into StartDaemon().

authctl: Print no output on success

fb1f746

Lets be more consistent with other command-line tools which control system services, like systemctl and machinectl, and not print any output if the command succeeds (for example like `systemctl start`/`systemctl stop` or `machinectl kill`).

Further improve error message

b17cfff

Further improve the error message printed when trying to log in with a locked user from: error PermissionDenied from server: user [email protected] is locked to permission denied: user [email protected] is locked

pam/integration-tests/ssh: Add a simple lock/unlock test via SSH

f642c13

Co-Authored-By: Adrian Dombeck <[email protected]>

refactor: Extract GoBuildFlags()

f57b189

Pass GoBuildFlags to authctl built in tests

7f44cbf

refactor: Use WithCurrentUserAsRoot option for testutils.runAuthd()

778f1ac

Use lowercase username in UpdateLockedFieldForUser

5d2a434

Prefix socket URI with "unix://" if no scheme is set.

5548b4f

Ensure that we exit with a status code smaller than 256.

b07bbde

adombeck force-pushed the user-disable branch from 7fe83cb to b07bbde Compare September 23, 2025 13:45

adombeck merged commit a91dc7f into ubuntu:main Sep 23, 2025
10 of 13 checks passed

adombeck mentioned this pull request Sep 23, 2025

Support deletion of users and groups via authctl #640

Open

Uh oh!

Add CLI tool to lock/unlock users #782

Add CLI tool to lock/unlock users #782

Uh oh!

Conversation

shiv-tyagi commented Feb 7, 2025 • edited by adombeck Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

shiv-tyagi commented Feb 7, 2025

Uh oh!

codecov-commenter commented Feb 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

adombeck commented Feb 10, 2025

Uh oh!

adombeck commented Feb 10, 2025

Uh oh!

adombeck commented Feb 10, 2025

Uh oh!

shiv-tyagi commented Feb 10, 2025

Uh oh!

Uh oh!

Uh oh!

adombeck commented Feb 18, 2025

Uh oh!

shiv-tyagi commented Feb 18, 2025

Uh oh!

shiv-tyagi commented Feb 19, 2025

Uh oh!

shiv-tyagi commented Feb 26, 2025

Uh oh!

adombeck left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shiv-tyagi commented Mar 4, 2025

Uh oh!

Uh oh!

adombeck commented Sep 23, 2025

Uh oh!

shiv-tyagi commented Sep 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

shiv-tyagi commented Feb 7, 2025 •

edited by adombeck

Loading

codecov-commenter commented Feb 7, 2025 •

edited

Loading