When the OpenID login creates a user, or adds a user to groups from the
groups claim, it writes these changes to user.cfg. The permissions it
returns for the web UI however got computed with the copy of user.cfg
the RPC environment loaded at the start of the request, which does not
know about the new user or group memberships yet.
So a user logging in for the first time got no permissions from the
ACLs of its groups in this session, and buttons like "Create VM" stayed
disabled, until the next login. The same happened to existing users on
the login that added them to a new group.
Add a helper to reload the user config of the RPC environment, and use
it after the login changed user.cfg, before computing the permissions,
as suggested in the bug.
Add a test for both cases, which mocks the OpenID provider and keeps
user.cfg in memory.
Signed-off-by: Michal Fox <me@dualfroz.com>
Both plugins rejected the password with a plain boolean check, and in
Perl the string "0" is false. So a user whose password is "0" could
never log in, getting a generic authentication failure.
Only reject undefined or empty passwords.
Signed-off-by: Michal Fox <me@dualfroz.com>
upstream
dualfroz