From ebcef8adbd11b91a5bbcfec0865dde1d1c8cb7ea Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Mon, 12 Aug 2024 13:35:06 -0400 Subject: [PATCH] fix issue with reset pw and mfa --- salt/manager/tools/sbin/so-user | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/salt/manager/tools/sbin/so-user b/salt/manager/tools/sbin/so-user index 69b4fdb50..40e0b01f8 100755 --- a/salt/manager/tools/sbin/so-user +++ b/salt/manager/tools/sbin/so-user @@ -234,10 +234,14 @@ function updatePassword() { passwordHash=$(hashPassword "$password") # Update DB with new hash echo "update identity_credentials set config=CAST('{\"hashed_password\":\"$passwordHash\"}' as BLOB), created_at=datetime('now'), updated_at=datetime('now') where identity_id='${identityId}' and identity_credential_type_id=(select id from identity_credential_types where name='password');" | sqlite3 -cmd ".timeout ${databaseTimeout}" "$databasePath" - # Deactivate MFA - echo "delete from identity_credential_identifiers where identity_credential_id=(select id from identity_credentials where identity_id='${identityId}' and identity_credential_type_id=(select id from identity_credential_types where name in ('totp', 'webauthn', 'oidc')));" | sqlite3 -cmd ".timeout ${databaseTimeout}" "$databasePath" - echo "delete from identity_credentials where identity_id='${identityId}' and identity_credential_type_id=(select id from identity_credential_types where name in ('totp', 'webauthn', 'oidc'));" | sqlite3 -cmd ".timeout ${databaseTimeout}" "$databasePath" [[ $? != 0 ]] && fail "Unable to update password" + # Deactivate MFA + echo "delete from identity_credential_identifiers where identity_credential_id in (select id from identity_credentials where identity_id='${identityId}' and identity_credential_type_id in (select id from identity_credential_types where name in ('totp', 'webauthn', 'oidc')));" | sqlite3 -cmd ".timeout ${databaseTimeout}" "$databasePath" + [[ $? != 0 ]] && fail "Unable to clear aal2 identity IDs" + echo "delete from identity_credentials where identity_id='${identityId}' and identity_credential_type_id in (select id from identity_credential_types where name in ('totp', 'webauthn', 'oidc'));" | sqlite3 -cmd ".timeout ${databaseTimeout}" "$databasePath" + [[ $? != 0 ]] && fail "Unable to clear aal2 identity credentials" + echo "update identities set available_aal='aal1' where id='${identityId}';" | sqlite3 -cmd ".timeout ${databaseTimeout}" "$databasePath" + [[ $? != 0 ]] && fail "Unable to reset aal" fi }