Skip to content

Conversation

@pmatseykanets
Copy link
Contributor

@pmatseykanets pmatseykanets commented Oct 10, 2025

Issue:

Problem

When creating/setting the user's password via the User Public API it's possible to set the password that matches the username, which should not be allowed.
The secret mutator was checking for the userInfo.Username as opposed to the user.Username.

Solution

Check the password against the user.Username.

CheckList

  • Test
  • Docs

@pmatseykanets pmatseykanets requested a review from a team as a code owner October 10, 2025 19:00
@pmatseykanets pmatseykanets self-assigned this Oct 10, 2025
@pmatseykanets pmatseykanets force-pushed the secret-username-password branch from 96b9bb7 to 649f0ae Compare October 10, 2025 19:10
@pmatseykanets
Copy link
Contributor Author

# New user
kubectl create -f - <<EOF
apiVersion: management.cattle.io/v3
kind: User
metadata:
  generateName: u-
enabled: true
username: testuser123456
EOF
user.management.cattle.io/u-kp9n2 created

# The password matches the username
kubectl -n cattle-local-user-passwords create secret generic u-kp9n2 --from-literal=password=testuser123456
error: failed to create secret admission webhook "rancher.cattle.io.secrets" denied the request: password cannot be the same as username

# The password doesn't match the username
kubectl -n cattle-local-user-passwords create secret generic u-kp9n2 --from-literal=password=secretsecret
secret/u-kp9n2 created

@pmatseykanets pmatseykanets force-pushed the secret-username-password branch from 649f0ae to 64f8e6e Compare October 13, 2025 20:09
@pmatseykanets pmatseykanets merged commit 92a5c06 into rancher:main Oct 14, 2025
2 checks passed
@pmatseykanets pmatseykanets deleted the secret-username-password branch October 14, 2025 11:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants