nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-06-07 11:40:31 -05:00
Code

[PM-20225] Block no-userkey legacy users (#5640)

Browse Source 
* Block legacy users on all clients over 2025.5

* Update message

* Fix test

* Fix test

* Update blocked version
This commit is contained in:
Bernd Schoolmann 2025-06-02 22:04:01 +02:00 committed by GitHub
parent 8bac7f0145
commit 14e68428f6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/Core/Constants.cs
View File

@ -23,6 +23,7 @@ public static class Constants
public const string Fido2KeyCipherMinimumVersion = "2023.10.0"; public const string Fido2KeyCipherMinimumVersion = "2023.10.0";
public const string SSHKeyCipherMinimumVersion = "2024.12.0"; public const string SSHKeyCipherMinimumVersion = "2024.12.0";
public const string DenyLegacyUserMinimumVersion = "2025.6.0";
/// <summary> /// <summary>
/// Used by IdentityServer to identify our own provider. /// Used by IdentityServer to identify our own provider.

2
src/Identity/IdentityServer/RequestValidators/BaseRequestValidator.cs
View File

@ -193,7 +193,7 @@ public abstract class BaseRequestValidator<T> where T : class
protected async Task FailAuthForLegacyUserAsync(User user, T context) protected async Task FailAuthForLegacyUserAsync(User user, T context)
{ {
await BuildErrorResultAsync( await BuildErrorResultAsync(
$"Encryption key migration is required. Please log in to the web vault at {_globalSettings.BaseServiceUri.VaultWithHash}", $"Legacy encryption without a userkey is no longer supported. To recover your account, please contact support",
false, context, user); false, context, user);
} }

3
src/Identity/IdentityServer/RequestValidators/CustomTokenRequestValidator.cs
View File

@ -27,6 +27,7 @@ public class CustomTokenRequestValidator : BaseRequestValidator<CustomTokenReque
{ {
private readonly UserManager<User> _userManager; private readonly UserManager<User> _userManager;
private readonly IUpdateInstallationCommand _updateInstallationCommand; private readonly IUpdateInstallationCommand _updateInstallationCommand;
private readonly Version _denyLegacyUserMinimumVersion = new(Constants.DenyLegacyUserMinimumVersion);
public CustomTokenRequestValidator( public CustomTokenRequestValidator(
UserManager<User> userManager, UserManager<User> userManager,
@ -73,7 +74,7 @@ public class CustomTokenRequestValidator : BaseRequestValidator<CustomTokenReque
{ {
// Force legacy users to the web for migration // Force legacy users to the web for migration
if (await _userService.IsLegacyUser(GetSubject(context)?.GetSubjectId()) && if (await _userService.IsLegacyUser(GetSubject(context)?.GetSubjectId()) &&
context.Result.ValidatedRequest.ClientId != "web") (context.Result.ValidatedRequest.ClientId != "web" || CurrentContext.ClientVersion >= _denyLegacyUserMinimumVersion))
{ {
await FailAuthForLegacyUserAsync(null, context); await FailAuthForLegacyUserAsync(null, context);
return; return;

4
test/Identity.IntegrationTest/Endpoints/IdentityServerTests.cs
View File

@ -238,7 +238,7 @@ public class IdentityServerTests : IClassFixture<IdentityApplicationFactory>
} }
[Theory, BitAutoData, RegisterFinishRequestModelCustomize] [Theory, BitAutoData, RegisterFinishRequestModelCustomize]
public async Task TokenEndpoint_GrantTypeClientCredentials_AsLegacyUser_NotOnWebClient_Fails( public async Task TokenEndpoint_GrantTypeClientCredentials_AsLegacyUser_Fails(
RegisterFinishRequestModel model, RegisterFinishRequestModel model,
string deviceId) string deviceId)
{ {
@ -277,7 +277,7 @@ public class IdentityServerTests : IClassFixture<IdentityApplicationFactory>
var errorBody = await AssertHelper.AssertResponseTypeIs<JsonDocument>(context); var errorBody = await AssertHelper.AssertResponseTypeIs<JsonDocument>(context);
var error = AssertHelper.AssertJsonProperty(errorBody.RootElement, "ErrorModel", JsonValueKind.Object); var error = AssertHelper.AssertJsonProperty(errorBody.RootElement, "ErrorModel", JsonValueKind.Object);
var message = AssertHelper.AssertJsonProperty(error, "Message", JsonValueKind.String).GetString(); var message = AssertHelper.AssertJsonProperty(error, "Message", JsonValueKind.String).GetString();
Assert.StartsWith("Encryption key migration is required.", message); Assert.StartsWith("Legacy encryption without a userkey is no longer supported.", message);
} }

3
test/Identity.Test/IdentityServer/BaseRequestValidatorTests.cs
View File

@ -373,8 +373,7 @@ public class BaseRequestValidatorTests
// Assert // Assert
Assert.True(context.GrantResult.IsError); Assert.True(context.GrantResult.IsError);
var errorResponse = (ErrorResponseModel)context.GrantResult.CustomResponse["ErrorModel"]; var errorResponse = (ErrorResponseModel)context.GrantResult.CustomResponse["ErrorModel"];
var expectedMessage = $"Encryption key migration is required. Please log in to the web " + var expectedMessage = "Legacy encryption without a userkey is no longer supported. To recover your account, please contact support";
$"vault at {_globalSettings.BaseServiceUri.VaultWithHash}";
Assert.Equal(expectedMessage, errorResponse.Message); Assert.Equal(expectedMessage, errorResponse.Message);
} }