Merge "Bootstrap: enable and reset password for existing users" into stable/mitaka

2 files changed, 40 insertions, 0 deletions

diff --git a/keystone/cmd/cli.py b/keystone/cmd/cli.py
index f95007e0e..a1f614fcf 100644
--- a/keystone/cmd/cli.py
+++ b/keystone/cmd/cli.py
@@ -215,6 +215,24 @@ class BootStrap(BaseApp):
                                                           default_domain['id'])
             LOG.info(_LI('User %s already exists, skipping creation.'),
                      self.username)
+
+            # Remember whether the user was enabled or not, so that we can
+            # provide useful logging output later.
+            was_enabled = user['enabled']
+
+            # To keep bootstrap idempotent, try to reset the user's password
+            # and ensure that they are enabled. This allows bootstrap to act as
+            # a recovery tool, without having to create a new user.
+            user = self.identity_manager.update_user(
+                user['id'],
+                {'enabled': True,
+                 'password': self.password})
+            LOG.info(_LI('Reset password for user %s.'), self.username)
+            if not was_enabled and user['enabled']:
+                # Although we always try to enable the user, this log message
+                # only makes sense if we know that the user was previously
+                # disabled.
+                LOG.info(_LI('Enabled user %s.'), self.username)
         except exception.UserNotFound:
             user = self.identity_manager.create_user(
                 user_ref={'name': self.username,
diff --git a/keystone/tests/unit/test_cli.py b/keystone/tests/unit/test_cli.py
index 06f2e1727..7e53ca624 100644
--- a/keystone/tests/unit/test_cli.py
+++ b/keystone/tests/unit/test_cli.py
@@ -118,6 +118,28 @@ class CliBootStrapTestCase(unit.SQLDriverOverrides, unit.TestCase):
         self._do_test_bootstrap(bootstrap)
         self._do_test_bootstrap(bootstrap)
 
+    def test_bootstrap_recovers_user(self):
+        bootstrap = cli.BootStrap()
+        self._do_test_bootstrap(bootstrap)
+
+        # Completely lock the user out.
+        user_id = bootstrap.identity_manager.get_user_by_name(
+            bootstrap.username,
+            'default')['id']
+        bootstrap.identity_manager.update_user(
+            user_id,
+            {'enabled': False,
+             'password': uuid.uuid4().hex})
+
+        # The second bootstrap run will recover the account.
+        self._do_test_bootstrap(bootstrap)
+
+        # Sanity check that the original password works again.
+        bootstrap.identity_manager.authenticate(
+            {},
+            user_id,
+            bootstrap.password)
+
 
 class CliBootStrapTestCaseWithEnvironment(CliBootStrapTestCase):