[security] Resetting password outside the Decko system

[tukanos]

Hi Ethan,

I wonder if this is possible. Imagine situation where Decko is not yet configured with email-out. Is there a way to reset a user password directly from shell?

Thank you._

[ethn]

There's not a super easy way, but you could open a console (decko console) and run

Card::Auth.as_bot
Card[USERCARDNAME, :account, :password].update_attributes! content: NEW_PASSWORD

An event on the password card will encrypt the content.

[tukanos]

I see. Quite simple, but still I get SIGNIN: Wrong password same as when changing it via GUI. I'm probably missing something.

[smalltalk@localhost test_postgresql]$ decko console
Loading production environment (Rails 5.1.4)
2.3.0 :001 > Card::Auth.as_bot
 => nil 


2.3.0 :004 > Card['tukan', :account, :password].update_attributes! content: 'xxxx'
initialize: tukan+*account+*password
tukan+*account+*password: assign_action
tukan+*account+*password: only_notify_on_web_requests
tukan+*account+*password: handle_subcard_errors
initialize: tukan+*account+*password
prepare_to_validate: tukan+*account+*password
tukan+*account+*password: reject_empty_subcards
tukan+*account+*password: set_stamper
tukan+*account+*password: validate_password_present
tukan+*account+*password: handle_subcard_errors
prepare_to_validate: tukan+*account+*password
validate: tukan+*account+*password
tukan+*account+*password: check_permissions
tukan+*account+*password: recaptcha
tukan+*account+*password: validate_password
tukan+*account+*password: handle_subcard_errors
validate: tukan+*account+*password
prepare_to_store: tukan+*account+*password
tukan+*account+*password: handle_subcard_errors
prepare_to_store: tukan+*account+*password
store: tukan+*account+*password
tukan+*account+*password: set_content
tukan+*account+*password: encrypt_password
tukan+*account+*password: handle_subcard_errors
finalize: tukan+*account+*password
tukan+*account+*password: expire_related
tukan+*account+*password: finalize_action
tukan+*account+*password: finalize_act
tukan+*account+*password: handle_subcard_errors
finalize: tukan+*account+*password
integrate: tukan+*account+*password
tukan+*account+*password: observer_update
tukan+*account+*password: handle_subcard_errors
integrate: tukan+*account+*password
after_integrate: tukan+*account+*password
tukan+*account+*password: handle_subcard_errors
after_integrate: tukan+*account+*password
integrate_with_delay: tukan+*account+*password
tukan+*account+*password: handle_subcard_errors
integrate_with_delay: tukan+*account+*password
tukan+*account+*password: remove_empty_act
Enqueued Card::Set::Event::DelayedEvent::IntegrateWithDelayJob (Job ID: e3fadb45-e5d8-41de-830b-f2c6cddcde4c) to DelayedJob(remove_empty_act) with arguments: 8661, #<GlobalID:0x000000042e6450 @uri=#<URI::GID gid://test-postgresql/Card/2060>>, {:action=>:update, :supercard=>nil, :superleft=>nil, :current_action=>nil, :comment=>nil, :update_referers=>nil, :update_all_users=>nil, :silent_change=>true, :last_action_id_before_edit=>nil, :only_storage_phase=>nil, :changed_attributes=>{"updated_at"=>Mon, 05 Mar 2018 08:21:58 UTC +00:00, "updater_id"=>2048}}, {:main_name=>nil, :params=>{}}, {:as_id=>1, :current_id=>1}, "remove_empty_act_without_callbacks"
 => true 

[ethn]

Hey, I apologize that the response is late. And I'm afraid a full response will be later; I'm organizing to leave home for about 3 weeks, and it looks like my kid may have just gotten chicken pox.

The brief update is that Philipp tried and failed to reproduce this problem. When I get a chance, I'll look at code to see if I have any ideas, but it may be another day or two yet :(

[tukanos]

Ah, don't worry be happy :). Enjoy your vacation/leave. I have two kids and we are sick all the time.

I know reproducing is always a pain in the behind. Tell me if you think I could give you more information.

[ethn]

How about this. Using the console, try:

Card::Auth.authenticate [email], [password]

If that fails, it might be informative. If it works, it suggest the problem is higher up.

Also curious to know whether there are any specific characters causing problems...

[tukanos]

Hi Ethan,

sorry for the delay but real-life issues kicked in.

I've used:

2.3.0 :001 > Card::Auth.authenticate 'tukan@ceq.cz', 'testing'
 => nil 

The password is not accepted anyways.

Also curious to know whether there are any specific characters causing problems...

Not to my best knowledge. I'm using only ASCII characters.

[ethn]

OK, well that rules out a lot of things.

Basically, the content of the +*password is encrypted in the database using a salt that is stored in a +*salt card. I would check the raw content of those two fields to see if there are any clues. Card[cardname].content. I suspect something is going funny with the salt...

[tukanos]

Hi Ethan, I see. I'll have to debug that because I could not find anything fishy there.