Merge pull request #4597 from jmcrawford45/PS-4716-3888

Add option to change user password (fixes #3888)

CHANGELOG.rst

@@ -4,9 +4,9 @@ Changelog
 Unreleased
 ~~~~~~~~~~~~~~~~~~~~
 Added ability to limit authority creation to admins only using config option `ADMIN_ONLY_AUTHORITY_CREATION`.
+User passwords can now be updated by admins with the update user endpoint.
 Route53 find_zone_dns now selects the maximum suffix match for zone id (previously we selected the first match).
 
-
 1.5.0 - `2023-07-05`
 ~~~~~~~~~~~~~~~~~~~~
 Fixed a bug where S3 deletes wouldn't work due to not respecting the configured exportPlugin.

lemur/users/service.py

@@ -13,7 +13,6 @@
 from lemur.logs import service as log_service
 from lemur.users.models import User
 
-
 STRICT_ENFORCEMENT_DEFAULT_ROLES = ["admin", "operator", "read-only"]
 
 
@@ -46,7 +45,7 @@ def create(username, password, email, active, profile_picture, roles):
     return database.create(user)
 
 
-def update(user_id, username, email, active, profile_picture, roles):
+def update(user_id, username, email, active, profile_picture, roles, password=None):
     """
     Updates an existing user
 
@@ -56,6 +55,7 @@ def update(user_id, username, email, active, profile_picture, roles):
     :param active:
     :param profile_picture:
     :param roles:
+    :param password:
     :return:
     """
     strict_role_enforcement = current_app.config.get("LEMUR_STRICT_ROLE_ENFORCEMENT", False)
@@ -68,6 +68,8 @@ def update(user_id, username, email, active, profile_picture, roles):
     user.email = email
     user.active = active
     user.profile_picture = profile_picture
+    if password:
+        user.password = password
     update_roles(user, roles)
 
     log_service.audit_log("update_user", username, f"Updating user with id {user_id}")

lemur/users/views.py

@@ -8,23 +8,19 @@
 from flask import g, Blueprint
 from flask_restful import reqparse, Api
 
-from lemur.common.schema import validate_schema
-from lemur.common.utils import paginated_parser
-
-from lemur.auth.service import AuthenticatedResource
 from lemur.auth.permissions import admin_permission
-
-from lemur.users import service
+from lemur.auth.service import AuthenticatedResource
 from lemur.certificates import service as certificate_service
+from lemur.common.schema import validate_schema
+from lemur.common.utils import paginated_parser
 from lemur.roles import service as role_service
-
+from lemur.users import service
 from lemur.users.schemas import (
     user_input_schema,
     user_output_schema,
     users_output_schema,
 )
 
-
 mod = Blueprint("users", __name__)
 api = Api(mod)
 
@@ -282,6 +278,7 @@ def put(self, user_id, data=None):
             data["active"],
             None,
             data["roles"],
+            data.get("password")
         )