[AMBARI-25201] Updating a user's password does not validate the administrator's current password.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.0
• Fix Version/s: 2.8.0, 2.7.4
• Component/s: ambari-server, ambari-web
• Labels: pull-request-available
• Assignee: Balázs Bence Sári
• Reporter: Robert Levas
• Created: 19/Mar/19 16:19
• Updated: 08/Nov/22 18:37
• Resolved: 12/Apr/19 17:39

Description

When updating a user's password as an Ambari Administrator via the UI, the acting administrator user is prompted for their password...

The password is never validated by the backend to end sure it is correct for the acting user. Either the text box needs to be removed from the UI, or the backend should verify the administrator's password before changing the user's password.

The current implementation does require that if the acting user is not an Ambari Administrator user, the acting user may only change their own password and must supply their current password as well as the new password:

Example:

curl -H "X-Requested-By:ambari"  -u user_a:hadoop -X PUT -d '{ "Users" : { "old_password" : "hadoop", "password" : "hadoop_1234" } }' http://localhost:8080/api/v1/users/user_a

Issue Links

• Blocked: AMBARI-25238 Updating a user's password does not validate the administrator's current password.
• links to: GitHub PR#3444
• links to: GitHub Pull Request #2924