main · last commit
1 month ago ·
2npkec0r
tarantool-etcd-7mr UserAdd options.no_password decoded and dropped
Lined Up
bd update tarantool-etcd-7mr --claim
bd close tarantool-etcd-7mr
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-07-17T13:21:28Z |
| Updated | 2026-07-17T13:21:28Z |
etcd stores a passwordless user, refuses Authenticate for them, and returns ErrNoPasswordUser from UserChangePassword. app/etcd/auth.lua:462-478 never reads req.options (grep: 0 hits). The main-line --no-password path COINCIDENTALLY works (no chap-sha1 digest is stored, so auth fails anyway) — but no_password=true SENT WITH a password stores the password and lets the user authenticate, which is the actual bug. user_change_password (auth.lua:498-507) has no ErrNoPasswordUser guard. Low practical impact today: the CN-auth path this feature exists for needs TLS, which we do not have (tarantool-etcd-nbs).
no_password=true drops any supplied password and blocks Authenticate; UserChangePassword returns ErrNoPasswordUser; test pins the with-password case.
No outgoing dependencies.
Nothing depends on this issue.
| id | tarantool-etcd-7mr |
| content_hash | 480b25fdf5ff5cf67d194ef1d37dbc6ca998a14ea12872f13fe75ebb09d6ee12 |
| title | UserAdd options.no_password decoded and dropped |
| description | etcd stores a passwordless user, refuses Authenticate for them, and returns ErrNoPasswordUser from UserChangePassword. app/etcd/auth.lua:462-478 never reads req.options (grep: 0 hits). The main-line --no-password path COINCIDENTALLY works (no chap-sha1 digest is stored, so auth fails anyway) — but no_password=true SENT WITH a password stores the password and lets the user authenticate, which is the actual bug. user_change_password (auth.lua:498-507) has no ErrNoPasswordUser guard. Low practical impact today: the CN-auth path this feature exists for needs TLS, which we do not have (tarantool-etcd-nbs). |
| design | |
| acceptance_criteria | no_password=true drops any supplied password and blocks Authenticate; UserChangePassword returns ErrNoPasswordUser; test pins the with-password case. |
| notes | |
| status | open |
| priority | 3 |
| issue_type | bug |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-07-17T13:21:28Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-07-17T13:21:28Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | <binary> |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | NULL |
| is_blocked | 0 |
| issue_id | tarantool-etcd-7mr |
| label | etcd-changelog-sweep |
| id | 019f703d-372f-7ee8-81f5-e5d0e3e181f1 |
| issue_id | tarantool-etcd-7mr |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-07-17T16:21:27Z |
| id | 019f703d-3730-7849-adb7-500b2e210c90 |
| issue_id | tarantool-etcd-7mr |
| event_type | label_added |
| actor | Eugene Blikh |
| old_value | NULL |
| new_value | NULL |
| comment | Added label: etcd-changelog-sweep |
| created_at | 2026-07-17T16:21:27Z |
No comments.