univention.management.console.modules.passwordreset package

univention.management.console.modules.passwordreset.forward_to_master(func)

univention.management.console.modules.passwordreset.forward_to_master_if_authentication_disabled(func)

class univention.management.console.modules.passwordreset.ScanSettings(url: str, timeout: int, cafile: str | None, max_files: int)

Bases: NamedTuple

Settings of the malware scan, see malware_scan_settings().

Create new instance of ScanSettings(url, timeout, cafile, max_files)

url: str

Alias for field number 0

timeout: int

Alias for field number 1

cafile: str | None

Alias for field number 2

max_files: int

Alias for field number 3

univention.management.console.modules.passwordreset.scan_files_for_malware(files: list[tuple[str, bytes]], settings: ScanSettings, username: str | None) → None

Scan uploaded files with the ICAP server. This runs in a worker thread.

The function only gets prepared data, see uploaded_files() and malware_scan_settings(), so that it doesn’t touch shared state of the module. All scans of one request together must finish within the configured timeout.

Parameters:

• files (list) – Pairs of property name and decoded file content.

• settings (ScanSettings) – The URL, the timeout and the CA file of the ICAP server.

• username (str) – The name of the user, for the log messages.

Raises:

UMC_Error – If the ICAP server finds malware or cannot scan a file.

univention.management.console.modules.passwordreset.malware_scan_settings() → ScanSettings

Get the settings of the malware scan: the URL, the timeout and the CA file of the ICAP server and the maximum number of files in one request.

The environment variables SELF_SERVICE_MALWARE_SCAN_ICAP_URL, SELF_SERVICE_MALWARE_SCAN_ICAP_TIMEOUT, SELF_SERVICE_MALWARE_SCAN_ICAP_CA_FILE and SELF_SERVICE_MALWARE_SCAN_MAX_FILES have priority over the UCR variables umc/self-service/malware-scan/icap/url, …/icap/timeout, …/icap/ca-file and …/max-files. Empty or invalid environment variables are ignored.

Returns:

The settings. The URL is empty if the scan is disabled, the CA file is None if the CA certificates of the system are used.

univention.management.console.modules.passwordreset.upload_values(property_descriptions: dict[str, Any], attributes: dict[str, Any]) → list[tuple[str, Any]]

Collect the non-empty values of the attributes with an upload syntax from UPLOAD_SYNTAXES, for example jpegPhoto, without decoding them. Multivalue attributes, also extended attributes, give one entry per value.

Parameters:

• property_descriptions (dict) – The UDM property descriptions of the users/user module.

• attributes (dict) – The attribute values that the user sent.

Returns:

Pairs of property name and submitted value.

univention.management.console.modules.passwordreset.check_upload_limit(property_descriptions: dict[str, Any], attributes: dict[str, Any], settings: ScanSettings) → None

Reject a request with more uploaded files than allowed, before any file is decoded, validated or scanned.

The limit only applies when the malware scan is enabled. All non-empty values of all upload properties count, also values that are not valid Base64.

Parameters:

• property_descriptions (dict) – The UDM property descriptions of the users/user module.

• attributes (dict) – The attribute values that the user sent.

• settings (ScanSettings) – The settings of the malware scan, max_files is the limit, 0 allows no file.

Raises:

UMC_Error – If the request contains more files than allowed.

univention.management.console.modules.passwordreset.uploaded_files(property_descriptions: dict[str, Any], attributes: dict[str, Any]) → list[tuple[str, bytes]]

Decode the uploaded files in the attributes, see upload_values().

Values that are not Base64 are skipped, UDM rejects them later. Call check_upload_limit() first.

Parameters:

• property_descriptions (dict) – The UDM property descriptions of the users/user module.

• attributes (dict) – The attribute values that the user sent.

Returns:

Pairs of property name and decoded file content.

univention.management.console.modules.passwordreset.prevent_denial_of_service(func)

exception univention.management.console.modules.passwordreset.ConnectionLimitReached(seconds)

Bases: UMC_Error

status = 503

exception univention.management.console.modules.passwordreset.ServiceForbidden

Bases: UMC_Error

status = 403

exception univention.management.console.modules.passwordreset.TokenNotFound

Bases: UMC_Error

status = 400

exception univention.management.console.modules.passwordreset.NoMethodsAvailable

Bases: UMC_Error

status = 403

exception univention.management.console.modules.passwordreset.TokenSendMessage

Bases: UMC_Error

status = 200

class univention.management.console.modules.passwordreset.Instance(*args, **kwargs)

Bases: Base

init()

this function is invoked after the module process started.

property usersmod

get_service_specific_passwords(request)

Get users (possible) service specific passwords.

Returns:

list of dicts with users ssp

set_service_specific_passwords(request)

Set a new service specific password.

Returns:

The password in cleartext

get_contact(request)

Get users contact data.

Returns:

list of dicts with users contact data

get_user_attributes(request)

get_user_attributes_values(request)

get_user_attributes_descriptions(request, *args, **kwargs)

get_registration_attributes(request, *args, **kwargs)

validate_user_attributes(request)

set_user_attributes(request)

create_self_registered_account(request)

send_verification_token(request)

set_contact(request)

send_token(request)

verify_contact(request)

deregister_account(request)

set_password(request)

get_reset_methods(request, *args, **kwargs)

static create_token(length)

send_message(username, method, address, user_properties)

static auth(username, password, ldap_connection=None, ldap_position=None)

authenticate_user(username=None, password=None)

Check if the user is already authenticated (via UMC/SAML login) or use the credentials provided via the form.

set_contact_data(dn, email, mobile)

admember_set_password(username, password)

udm_set_password(username, password, email_verified)

is_blacklisted(username, feature, ldap_connection=None, ldap_position=None)

get_groups(userdn)

get_nested_groups(groupdn)

dns_to_groupname(dns)

get_udm_user_by_dn(userdn, admin=False)

get_udm_user(username, admin=False)

get_udm_group(groupdn, ldap_connection=None, ldap_position=None)

email2username(email, ldap_connection=None, ldap_position=None)

Subpackages

• univention.management.console.modules.passwordreset.sending package
  • get_plugins()
  • Submodules
  • univention.management.console.modules.passwordreset.sending.send_email module
    • SendEmail
      • SendEmail.send_method()
      • SendEmail.send_method_label()
      • SendEmail.is_enabled()
      • SendEmail.udm_property
      • SendEmail.token_length
      • SendEmail.send()
  • univention.management.console.modules.passwordreset.sending.send_sms module
    • SendSMS
      • SendSMS.read_sms_secret()
      • SendSMS.send_method()
      • SendSMS.send_method_label()
      • SendSMS.is_enabled()
      • SendSMS.udm_property
      • SendSMS.token_length
      • SendSMS.send()
  • univention.management.console.modules.passwordreset.sending.send_with_external module
    • SendWithExternal
      • SendWithExternal.send_method()
      • SendWithExternal.send_method_label()
      • SendWithExternal.is_enabled()
      • SendWithExternal.udm_property
      • SendWithExternal.token_length
      • SendWithExternal.send()
  • univention.management.console.modules.passwordreset.sending.verify_email module
    • VerifyEmail
      • VerifyEmail.send_method()
      • VerifyEmail.message_application()
      • VerifyEmail.is_enabled()
      • VerifyEmail.udm_property
      • VerifyEmail.token_length
      • VerifyEmail.send()

Submodules

univention.management.console.modules.passwordreset.send_plugin module

class univention.management.console.modules.passwordreset.send_plugin.UniventionSelfServiceTokenEmitter(log)

Bases: object

base class

static send_method()

static send_method_label()

static message_application()

static is_enabled()

property udm_property

password_reset_verified_recovery_email()

property token_length

set_data(data)

send()

univention.management.console.modules.passwordreset.tokendb module

exception univention.management.console.modules.passwordreset.tokendb.MultipleTokensInDB

Bases: Exception

class univention.management.console.modules.passwordreset.tokendb.TokenDB(logger)

Bases: object

cursor(*args, **kwargs)

insert_token(username, method, token)

update_token(username, method, token)

delete_tokens(**kwargs)

get_all(**kwargs)

get_one(**kwargs)

create_table()

open_db()

close_db()

table_exists()