• 
  
    
 
    
 
    

    



    
    
    
    
     
    




    
 
    

  
    



    
 

 

  

  

 

    


  
    





    
 
    



  

    
 
 
    
  
    Update user API to allow creating users without a password.
    
 
    

    



 
    
 
    

  Review Request #14450
  —
  Created June 4, 2025 and submitted 

 
    


    




    




    






 
    
  
    
   Information

  
    



    
 
 
    
  david
 
    

    





    
 
 
    
  Review Board
 
    

    





    
 
 
    
  release-7.x
 
    

    





    
 
 
    
  
 
    

    





    
 
 
    
  
 
    

    



 
    



 
    
  
    
   Reviewers

  
    



    
 
 
    
  reviewboard
 
    

    





    
 
 
    
  
 
    

    



 
    



    


    
 
    




  

    
 
 
    
  
    It's extremely common now to have authentication driven by LDAP/AD
    
and/or SAML SSO. With this, admins increasingly want to provision users
    
separately instead of just letting a successful authentication create
    
the user account.
    

    This change makes it possible to do a POST to the /api/users/ endpoint
    
without a password set, which will create the user with an unusable
    
password.
    
 
    

    





  

    
 
 
    
  
    Ran unit tests.
    
 
    

    




 
    

    





    
 
    




  
    
 
 
    
  


    
 
    
  
   
    

    Summary
    ID

   
    
      
  

   
    

    

     
    
      Update user API to allow creating users without a password.
      
    It's extremely common now to have authentication driven by LDAP/AD
and/or SAML SSO. With this, admins increasingly want to provision users
separately instead of just letting a successful authentication create
the user account.

This change makes it possible to do a POST to the /api/users/ endpoint
without a password set, which will create the user with an unusable
password.

Testing Done:
Ran unit tests.
    
     
    

        		
    ebf3e233c1f0e2b4110b70abeb7704b93bf5087f

   
    


      
 
    

    
    
 
    

    






 





    
 
 
 
    
  
    
   
    
    
    
     
    
    
    
      
     
    • 
      
     
      • 
     
    • 
      
     
      • 
     
    • 
      
     
      • 
     
    • 
      
     
      • 
     
    • 
      
     
      • 
    
    
   
    
   
    
    
     
    
      Description
      From
      Last Updated
     
    
        
    



     
    
      
       
       
    This will break if an anonymous user makes the request. We're (somewhat) checking for that right below. An AnonymousUser object …
    
          		
      
       chipx86chipx86
      
      
       
      
     
    

        
   
    
  
    
 
    

    




 
    

    



  
    
 
    

    


    












    
 




 

    


 













    
 





 
    
  
    
   
    



chipx86




   
    
   
    





    
  
    
 
    


 
    
  
    

   
    
   
    
    
     
chipx86


    
    
   
    

  
    
  
    
  
    


      




    1. 
 
      
  
      
   
      
  
      
 
      

 
      
  


      
 
      
 
        

  

 
      


      

 
      

      2. 

















    2. 
 
      
  
  
      
  
 
      
  
      
   
      
    
     
      
      
       reviewboard/webapi/resources/user.py
       


        (Diff revision 1)


       
      
     
      
          
    
     
       
      

     
       
      

          
   
      
  
      
 
      

   
      
    
    




      
 
      
  
  
  

  
  
   Show all issues
  
 
      

      



    
      This will break if an anonymous user makes the request. We're (somewhat) checking for that right below. An AnonymousUser object should be valid here.
      

      Given this breakage, we should have a test for this scenario.
      
  
      
 
      

 
      
  


      
 
      
 
        

  


      1. 
 
 
        
 
        
  
 
        
 
        
  
        An anonymous user can't get to this point in the code because the entire method is wrapped in @webapi_check_login_required
        
 
        

        2. 



      2. 
 
 
        
 
        
  
 
        
 
        
  
        Right. Not sure what I was thinking.
        
 
        

        3. 


 
      


      

 
      

      3. 




    3. 
 
      
  
      
   
      
  
      
 
      

 
      
  


      
 
      
 
        

  

 
      


      

 
      

      4. 


    

  
    
 
    

    












    
 





 
    
  
    
   
    



chipx86




   
    
   
    





    
  
    
 
    


 
    
  
    

   
    
   
    
    
     
chipx86


    
    
   
    

  
    
  
    
  
    


      




    1. 
 
      
  
      
   
      Ship It!
      
  
      
 
      

 
      
  


      
 
      
 
        

  

 
      


      

 
      

      2. 















    2. 
 
      
  
      
   
      
  
      
 
      

 
      
  


      
 
      
 
        

  

 
      


      

 
      

      3. 


    

  
    
 
    

    












    
 



 
    
  
    
   
    



david




   
    
   
    
  
    
 
    


 
    
  
    

   
    
   
    
    
     Review request changed
    
    
   
    

  
    
  
    
  
    




    

  
    
   
    
    Status:
   
    
   
    

    Completed

   
    
  
    



  
    
   
    
    Change Summary:
   
    
   
    
    
    Pushed to release-7.x (5222bb8)