apiProvisioning reset password does not work with user-key encryption

[phil-davis]

Provisioning API tests for resetting a user password were added in core PR owncloud/core#32749

https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiProvisioning-v1/resetUserPassword.feature

The following fail when user-keys encryption is enabled:

  Scenario: reset user password
    Given these users have been created:
      | username       | password  | displayname | email                    |
      | brand-new-user | %regular% | New user    | brand.new.user@oc.com.np |
    When the administrator resets the password of user "brand-new-user" to "%alt1%" using the provisioning API
    Then the OCS status code should be "100"
    And the HTTP status code should be "200"
    And the content of file "textfile0.txt" for user "brand-new-user" using password "%alt1%" should be "ownCloud test text file 0" plus end-of-line
    But user "brand-new-user" using password "%regular%" should not be able to download file "textfile0.txt"

  Scenario: subadmin should be able to reset the password of a user in their group
    Given these users have been created:
      | username       | password   | displayname | email                    |
      | brand-new-user | %regular%  | New user    | brand.new.user@oc.com.np |
      | subadmin       | %subadmin% | Sub Admin   | sub.admin@oc.com.np      |
    And group "new-group" has been created
    And user "brand-new-user" has been added to group "new-group"
    And user "subadmin" has been made a subadmin of group "new-group"
    When user "subadmin" resets the password of user "brand-new-user" to "%alt1%" using the provisioning API
    Then the OCS status code should be "100"
    And the HTTP status code should be "200"
    And the content of file "textfile0.txt" for user "brand-new-user" using password "%alt1%" should be "ownCloud test text file 0" plus end-of-line
    But user "brand-new-user" using password "%regular%" should not be able to download file "textfile0.txt"

with test log output like:
https://drone.owncloud.com/owncloud/encryption/230/1079

  Scenario: reset user password                                                                                                                      # /var/www/owncloud/tests/acceptance/features/apiProvisioning-v1/resetUserPassword.feature:11
    Given these users have been created:                                                                                                             # FeatureContext::theseUsersHaveBeenCreated()
      | username       | password  | displayname | email                    |
      | brand-new-user | %regular% | New user    | brand.new.user@oc.com.np |
    When the administrator resets the password of user "brand-new-user" to "%alt1%" using the provisioning API                                       # FeatureContext::adminResetsPasswordOfUserUsingTheProvisioningApi()
    Then the OCS status code should be "100"                                                                                                         # FeatureContext::theOCSStatusCodeShouldBe()
    And the HTTP status code should be "200"                                                                                                         # FeatureContext::theHTTPStatusCodeShouldBe()
    And the content of file "textfile0.txt" for user "brand-new-user" using password "%alt1%" should be "ownCloud test text file 0" plus end-of-line # FeatureContext::contentOfFileForUserUsingPasswordShouldBePlusEndOfLine()
      Failed asserting that two strings are equal.
      --- Expected
      +++ Actual
      @@ @@
      -'ownCloud test text file 0
      +'<?xml version="1.0" encoding="utf-8"?>
      +<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
      +  <s:exception>Sabre\DAV\Exception\Forbidden</s:exception>
      +  <s:message>Encryption not ready: Private Key missing for user: please try to log-out and log-in again</s:message>
      +</d:error>
       '

  Scenario: subadmin should be able to reset the password of a user in their group                                                                   # /var/www/owncloud/tests/acceptance/features/apiProvisioning-v1/resetUserPassword.feature:27
    Given these users have been created:                                                                                                             # FeatureContext::theseUsersHaveBeenCreated()
      | username       | password   | displayname | email                    |
      | brand-new-user | %regular%  | New user    | brand.new.user@oc.com.np |
      | subadmin       | %subadmin% | Sub Admin   | sub.admin@oc.com.np      |
    And group "new-group" has been created                                                                                                           # FeatureContext::groupHasBeenCreated()
    And user "brand-new-user" has been added to group "new-group"                                                                                    # FeatureContext::userHasBeenAddedToGroup()
    And user "subadmin" has been made a subadmin of group "new-group"                                                                                # FeatureContext::adminMakesUserSubadminOfGroupUsingTheProvisioningApi()
    When user "subadmin" resets the password of user "brand-new-user" to "%alt1%" using the provisioning API                                         # FeatureContext::userResetsPasswordOfUserUsingTheProvisioningApi()
    Then the OCS status code should be "100"                                                                                                         # FeatureContext::theOCSStatusCodeShouldBe()
    And the HTTP status code should be "200"                                                                                                         # FeatureContext::theHTTPStatusCodeShouldBe()
    And the content of file "textfile0.txt" for user "brand-new-user" using password "%alt1%" should be "ownCloud test text file 0" plus end-of-line # FeatureContext::contentOfFileForUserUsingPasswordShouldBePlusEndOfLine()
      Failed asserting that two strings are equal.
      --- Expected
      +++ Actual
      @@ @@
      -'ownCloud test text file 0
      +'<?xml version="1.0" encoding="utf-8"?>
      +<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
      +  <s:exception>Sabre\DAV\Exception\Forbidden</s:exception>
      +  <s:message>Encryption not ready: Private Key missing for user: please try to log-out and log-in again</s:message>
      +</d:error>

--- Failed scenarios:

/var/www/owncloud/tests/acceptance/features/apiProvisioning-v1/resetUserPassword.feature:11
/var/www/owncloud/tests/acceptance/features/apiProvisioning-v1/resetUserPassword.feature:27

The same test scenarios fail in both of Provisioning API v1 and v2, against both of core master and stable10.

[phil-davis]

@PVince81 @DeepDiver1975
What should work here?
How should an administrator reset the password for a user who has user-key encryption enabled?

Is this something to fix in server code, or do we skip these tests for user-key encryption?

[PVince81]

With user-key it would technically only be possible if a recovery key is set. In that case an admin could manually set a new password of their choice after entering the recovery key in the UI.
I don't think the provisioning API provides a way to do that.

Also, sending a password reset email will not work either because the receiving user would need either the previous forgotten password or the recovery key to migrate the encryption keys to a new password...

I suggest skipping then.

[PVince81]

Side note for how LDAP password reset works with user-key encryption: the admin can change the user's password in LDAP. Then the user is prompted to go to the personal settings and enter their old password and new password there to migrate the keys. In this scenario it is assumed that the old password is still known.

[phil-davis]

Some options to move forward:

1. Skip the tests on user-key encryption and get on with life ;)
2. Modify the provisioning API so that it gives an error status (with appropriate message content) if the caller tries to reset the password of a user that has user-key encryption setup.
3. Modify the provisioning API so that the necessary recovery key, and/or old user password... can be provided in the request.

For 2 and 3, we skip the tests for the moment, until one of them can be implemented.

I vote for number 2!

[phil-davis]

Assigned myself and put in QA sprint just to remind myself to skip the tests for now, with tagged reference to this issue.

[phil-davis]

Tests are skipped by owncloud/core#33076 - so that will "fix" the nightly CI until the issue is resolved.

[PVince81]

I'd also prefer 2 when time permits

[phil-davis]

QA-team could sort out some acceptance test that demonstrates the current "unusual" behaviour.