From 23ab8983f72485a38f26f145c52c125f1793c51a Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 18 Feb 2025 12:41:41 -0500
Subject: [PATCH] Revert "Support CLI changing of a user's password without
 disabling existing auth settings for that user"

This reverts commit b25b6f7bf2e45080b22f45e1ba2e3714985b69b4.
---
 salt/manager/tools/sbin/so-user | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/salt/manager/tools/sbin/so-user b/salt/manager/tools/sbin/so-user
index e6cf661dc..e6ac9eb1f 100755
--- a/salt/manager/tools/sbin/so-user
+++ b/salt/manager/tools/sbin/so-user
@@ -46,11 +46,10 @@ function usage() {
             Optional parameters: 
               --skip-sync               (defers the Elastic sync until the next scheduled time)
   
-  password: Updates a user's password and disables MFA, SSO, etc
+  password: Updates a user's password and disables MFA
             Required parameters: 
               --email <email>
             Optional parameters: 
-              --password-only           (only updates the password, does not disable MFA or SSO)
               --skip-sync               (defers the Elastic sync until the next scheduled time)
   
    profile: Updates a user's profile information
@@ -120,8 +119,6 @@ while [[ $# -gt 0 ]]; do
       note=$(echo $1 | sed 's/"/\\"/g')
       shift
       ;;
-    --password-only) 
-      passwordOnly=1
     --skip-sync) 
       SKIP_SYNC=1
       ;;
@@ -239,11 +236,6 @@ function updatePassword() {
     # Update DB with new hash
     echo "update identity_credentials set config=CAST('{\"hashed_password\":\"$passwordHash\"}' as BLOB), created_at=datetime('now'), updated_at=datetime('now') where identity_id='${identityId}' and identity_credential_type_id=(select id from identity_credential_types where name='password');" | sqlite3 -cmd ".timeout ${databaseTimeout}" "$databasePath"
     [[ $? != 0 ]] && fail "Unable to update password"
-
-    if [[ $passwordOnly -eq 1 ]]; then
-      return
-    fi
-
     # Deactivate MFA
     echo "delete from identity_credential_identifiers where identity_credential_id in (select id from identity_credentials where identity_id='${identityId}' and identity_credential_type_id in (select id from identity_credential_types where name in ('totp', 'webauthn', 'oidc')));" | sqlite3 -cmd ".timeout ${databaseTimeout}" "$databasePath"
     [[ $? != 0 ]] && fail "Unable to clear aal2 identity IDs"