policies: add unique password policy #10631

verkaufer · 2024-07-25T04:53:29Z

Details

Adds a "Password Uniqueness" policy to the set of configurable flow policies.

Documentation PR: #11000

How it works

After at least one (1) Flow has a UniquePasswordPolicy binding attached & enabled, the system records every user's hashed password when the user changes their own password.

When the user submits a new password during a password-change Flow, the system will check if the new password is identical to any of the user's previous passwords. The check will hash the new password against the Hasher originally used to hash the old password. This ensures backwards compatiblity if Authentik decides to change hashing algorithsm.

This check only occurs if the Flow Stage has a Unique Password Policy attached.

Configuration

Admins can configure how many previous passwords the system should evaluate.

The configured number of passwords to evaluate also defines the number of passwords retained for each user.

Admins may also define which field they wish to use as the "password" field in a Stage. This is similar to the Password Policy configuration.

Data considerations

The system purges the password history table after the last enabled UniquePasswordPolicy binding is deleted.

Because the number of passwords we save is configurable, it's important admins understand that whatever value they configure will end up saving up to n^m passwords, were n is the configured policy value & m is the number of users.

Checklist

Local tests pass (ak test authentik/)
The code has been formatted (make lint-fix)

If an API change has been made

The API schema has been updated (make gen-build)

If changes to the frontend have been made

The code has been formatted (make web)

If applicable

The documentation has been updated
The documentation has been formatted (make website)

netlify · 2024-07-25T04:53:48Z

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	`4ff7b9b`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/66c0f50d6677050008d68b7f
😎 Deploy Preview	https://deploy-preview-10631--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

netlify · 2024-07-25T04:53:49Z

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	`4ff7b9b`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/66c0f50d42f5d2000835eea1
😎 Deploy Preview	https://deploy-preview-10631--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

authentik/core/tasks.py

authentik/events/signals.py

verkaufer · 2024-07-31T04:46:16Z

authentik/policies/password/models.py

+        for history in password_history:
+            old_password = history.change.get("old_password")
+            if not old_password:
+                # TODO: how do we handle missing password?


Feedback requested: how should the policy behave if the UserPasswordHistory record doesn't have an old_password key?

If we indeed go with a field on the object, we avoid having to ask ourselves those questions.

authentik/core/models.py

verkaufer · 2024-07-31T04:49:31Z

authentik/policies/password/models.py

+            LOGGER.warning(
+                "Could not load hash algorithm for old password.",
+            )
+            # TODO: Define behavior if hasher cannot be identified or is unsupported


Should the policy fail if the Password hash algorithm was removed from Django? I know at least 2 are scheduled for deprecation in 5.1.

I think we should just ignore unknown algos, and maybe schedule a task to remove ones we don't know about?

Ignoring them works for me. Django won't be able to compare against that password, and in this implementation it might as well not exist.

Ignore passwords where we can't identify the algo

maybe schedule a task to remove ones we don't know about

I'm not sure the overhead of running a task (and spending the time to write it) would get us much in return. Passwords are already cleared out in a LIFO-esque way, so eventually the unknown password would age out.

codecov · 2024-08-01T17:45:05Z

Codecov Report

Attention: Patch coverage is 29.09091% with 156 lines in your changes missing coverage. Please review.

Project coverage is 50.84%. Comparing base (3ab9750) to head (8a89b13).
Report is 28 commits behind head on main.

Files	Patch %	Lines
authentik/policies/password/tests/test_policy.py	0.00%	42 Missing ⚠️
authentik/core/tests/test_tasks.py	0.00%	34 Missing ⚠️
authentik/stages/user_write/tests.py	0.00%	27 Missing ⚠️
authentik/policies/password/models.py	34.21%	25 Missing ⚠️
authentik/core/tasks.py	25.92%	20 Missing ⚠️
authentik/policies/signals.py	58.33%	5 Missing ⚠️
authentik/events/signals.py	78.57%	3 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (3ab9750) and HEAD (8a89b13). Click for more details.

HEAD has 2 uploads less than BASE

Flag BASE (3ab9750) HEAD (8a89b13)

unit 2 0

Additional details and impacted files

@@             Coverage Diff             @@
##             main   #10631       +/-   ##
===========================================
- Coverage   92.59%   50.84%   -41.75%     
===========================================
  Files         720      718        -2     
  Lines       35254    35196       -58     
===========================================
- Hits        32642    17896    -14746     
- Misses       2612    17300    +14688

Flag	Coverage Δ
e2e	`49.49% <29.09%> (-0.25%)`	⬇️
integration	`25.30% <19.09%> (-0.05%)`	⬇️
unit	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

rissson

Some design comments, most of which will need to be checked by @BeryJu anyway

No specific review on the frontend, cause I wouldn't know what I'm saying.

I think we should also provide a way for administrators to clear the password history of a specific user (and all users?) so that a user can be unblocked from changing their password if needed.

All in all, a pretty solid implementation

authentik/events/signals.py

authentik/core/models.py

authentik/core/tasks.py

authentik/policies/password/models.py

authentik/core/models.py

authentik/policies/password/models.py

rissson · 2024-08-01T17:54:32Z

authentik/policies/password/models.py

+        for history in password_history:
+            old_password = history.change.get("old_password")
+            if not old_password:
+                # TODO: how do we handle missing password?


If we indeed go with a field on the object, we avoid having to ask ourselves those questions.

rissson · 2024-08-01T17:55:01Z

authentik/policies/password/models.py

+                fields=request.context.keys(),
+            )
+            return PolicyResult(False, _("Password not set in context"))
+        password = str(password)


I think this should already be the case?

It should be 🤷 The other Password policy applies the same str casting and I figured that was done on purpose.

I can remove if @BeryJu feels the same way

authentik/policies/signals.py

verkaufer · 2024-08-09T04:30:52Z

@rissson I've applied the suggested changes. Namely:

move UniquePasswordPolicy to its own policies sub-app
move UserPasswordHistory out of core and into policies.unique_password
add a Model Manager for finding all instances of in-use PolicyBindings for a Policy type[1]: PolicyBindings.in_use.for_policy(<Policy>)

❗ One issue I'm stumped on:
When I moved the "write password on user_write signal" code, I'm no longer able to get my test_stages.pytests to pass. It seems like user_write is not received inside the policies.unique_password package.

~~When I had the code alongside the events listener for user_write it worked~~

Resolved after fixing #10631 (comment)

[1] Name of the model manager method is definitely up for discussion

verkaufer · 2024-08-09T04:31:11Z

Also I'll rebase and get the schema conflict resolved before merging

authentik/policies/unique_password/apps.py

authentik/policies/models.py

rissson · 2024-08-09T10:23:37Z

authentik/policies/models.py

+    """QuerySet for filtering enabled bindings for a Policy type"""
+
+    def for_policy(self, policy: "Policy"):
+        return self.filter(policy__in=policy._default_manager.all()).filter(enabled=True)


Just to make sure I understand, why are we referring to the default manager here?

I chose _default_manager because I wanted to preserve the behavior of the InheritanceManager() managers on the different Policy subclasses. Is that unnecessary here?

…ry table If the UniquePasswordPolicy is enabled anywhere, we now record the user's hashed password.

…bound to anything

The system should aim to keep the number of historical passwords to a minimum to avoid wasting storage space. Admins can configure how many passwords they want to preserve. If multiple instances of the UniquePasswordPolicy exist, the system takes the max() value of all enabled policies to determine how many passwords should remain after trimming.

…ings Querying within post_delete for other PolicyBindings will include the PolicyBinding we're deleting. We have to account for that by checking for bindings other than the one we're looking at.

…ssword app

…nc task instead of prior to execution

… to a provided policy type

…PasswordPolicyForm

…rom ManagedAppConfig.

Relates to goauthentik#10631

verkaufer · 2024-08-21T02:50:17Z

Added public documentation in a separate PR: #11000

verkaufer requested review from a team as code owners July 25, 2024 04:53

verkaufer force-pushed the dg/8307-unique-passwords branch 3 times, most recently from 90a6866 to 8a89b13 Compare July 31, 2024 04:23

verkaufer changed the title ~~Draft: Implement a 'unique password required' policy~~ Implement a 'unique password required' policy Jul 31, 2024

verkaufer commented Jul 31, 2024

View reviewed changes

verkaufer changed the title ~~Implement a 'unique password required' policy~~ core/policy: Implement a 'unique password required' policy Jul 31, 2024

rissson requested changes Aug 1, 2024

View reviewed changes

BeryJu changed the title ~~core/policy: Implement a 'unique password required' policy~~ policy: Implement a 'unique password required' policy Aug 8, 2024

rissson changed the title ~~policy: Implement a 'unique password required' policy~~ policies: add unique password policy Aug 8, 2024

rissson reviewed Aug 9, 2024

View reviewed changes

authentik/policies/unique_password/apps.py Outdated Show resolved Hide resolved

rissson reviewed Aug 9, 2024

View reviewed changes

authentik/policies/models.py Show resolved Hide resolved

rissson reviewed Aug 9, 2024

View reviewed changes

verkaufer added 11 commits August 17, 2024 11:05

Add UniquePasswordPolicy model and migration

eb56da4

Add UserPasswordHistory model and migration.

798af64

Add serializer for UniquePasswordPolicy

f57d7fb

Add UniquePasswordPolicy config to schema

7ee7115

Implement UniquePasswordPolicy algorithm

771ef97

fix: Return error message when UniquePasswordPolicy fails

8de2221

on_user_write signal now records user's password to UserPasswordHisto…

f067fd9

…ry table If the UniquePasswordPolicy is enabled anywhere, we now record the user's hashed password.

Introduce PasswordPolicyUniquenessForm to PolicyWizard

ff79ad6

Update UniquePasswordPolicy component property

909aaaa

Delete all UserPasswordHistory records when UniquePasswordPolicy not …

94f7d69

…bound to anything

verkaufer added 14 commits August 17, 2024 11:05

fix: Exit purge_password_history if there are 2 or more existing bind…

be3b144

…ings Querying within post_delete for other PolicyBindings will include the PolicyBinding we're deleting. We have to account for that by checking for bindings other than the one we're looking at.

Add comment to root policies/app.py explaining app structure

e942c3e

Move UniquePasswordPolicy to its own policies sub-app

ee06b8a

Move unique password policy tasks and signals into policies.unique_pa…

8c93822

…ssword app

Move signal handler for password history updates to unique_password app

4d812c0

purge_password_history_table now checks for other bindings during asy…

0a6bcef

…nc task instead of prior to execution

Add BoundPolicyQuerySet to filter for enabled policy bindings related…

8da0e12

… to a provided policy type

Add flow test for unique password policy

836efed

move PasswordPolicyUniquenessForm to its own module; rename to Unique…

9f6a7d8

…PasswordPolicyForm

fix: UniquePasswordPolicyViewset uses correct ModelViewSet class

32cbdd9

Move UserPasswordHistory and store old password in CharField

a3ac49e

Move test for user_write

7676939

fix: Resolve schema conflict, UniquePasswordPolicy app now inherits f…

61edb52

…rom ManagedAppConfig.

fix: UniquePasswordPolicy form defaults numHistoricalPasswords to 1

4ff7b9b

verkaufer force-pushed the dg/8307-unique-passwords branch from e98fc6a to 4ff7b9b Compare August 17, 2024 19:07

verkaufer requested a review from rissson August 17, 2024 19:09

verkaufer added a commit to verkaufer/authentik that referenced this pull request Aug 21, 2024

Add documentation for the Password Uniqueness Policy

c047260

Relates to goauthentik#10631

verkaufer mentioned this pull request Aug 21, 2024

website/docs: document the Password Uniqueness Policy #11000

Open

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

policies: add unique password policy #10631

policies: add unique password policy #10631

verkaufer commented Jul 25, 2024 •

edited

Loading

netlify bot commented Jul 25, 2024 •

edited

Loading

netlify bot commented Jul 25, 2024 •

edited

Loading

verkaufer Jul 31, 2024

rissson Aug 1, 2024

verkaufer Jul 31, 2024

rissson Aug 1, 2024

verkaufer Aug 2, 2024 •

edited

Loading

codecov bot commented Aug 1, 2024 •

edited

Loading

rissson left a comment

rissson Aug 1, 2024

rissson Aug 1, 2024

verkaufer Aug 2, 2024

verkaufer commented Aug 9, 2024 •

edited

Loading

verkaufer commented Aug 9, 2024

rissson Aug 9, 2024

verkaufer Aug 17, 2024

verkaufer commented Aug 21, 2024

policies: add unique password policy #10631

Are you sure you want to change the base?

policies: add unique password policy #10631

Conversation

verkaufer commented Jul 25, 2024 • edited Loading

Details

How it works

Configuration

Data considerations

Checklist

netlify bot commented Jul 25, 2024 • edited Loading

✅ Deploy Preview for authentik-storybook ready!

netlify bot commented Jul 25, 2024 • edited Loading

✅ Deploy Preview for authentik-docs ready!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

verkaufer Aug 2, 2024 • edited Loading

Choose a reason for hiding this comment

codecov bot commented Aug 1, 2024 • edited Loading

Codecov Report

rissson left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

verkaufer commented Aug 9, 2024 • edited Loading

verkaufer commented Aug 9, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

verkaufer commented Aug 21, 2024

verkaufer commented Jul 25, 2024 •

edited

Loading

netlify bot commented Jul 25, 2024 •

edited

Loading

netlify bot commented Jul 25, 2024 •

edited

Loading

verkaufer Aug 2, 2024 •

edited

Loading

codecov bot commented Aug 1, 2024 •

edited

Loading

verkaufer commented Aug 9, 2024 •

edited

Loading