Update user API to allow creating users without a password.

 






 

 


  Review Request #14450
  —
  Created June 4, 2025 and submitted 

 




















 

  

   Information

  





 
 

  david
 









 
 

  Review Board
 









 
 

  release-7.x
 









 
 

  
 









 
 

  
 






 




 

  

   Reviewers

  





 
 

  reviewboard
 









 
 

  
 






 








 





  


 
 

  
It's extremely common now to have authentication driven by LDAP/AD

and/or SAML SSO. With this, admins increasingly want to provision users

separately instead of just letting a successful authentication create

the user account.


This change makes it possible to do a POST to the /api/users/ endpoint

without a password set, which will create the user with an unusable

password.

 








  


 
 

  
Ran unit tests.

 







 









 





  

 


 
 

  



 

  
   


    Summary
    ID

   

  
  

   


    

     

      Update user API to allow creating users without a password.
      
It's extremely common now to have authentication driven by LDAP/AD
and/or SAML SSO. With this, admins increasingly want to provision users
separately instead of just letting a successful authentication create
the user account.

This change makes it possible to do a POST to the /api/users/ endpoint
without a password set, which will create the user with an unusable
password.

Testing Done:
Ran unit tests.

     


    		
    ebf3e233c1f0e2b4110b70abeb7704b93bf5087f

   



  
 




 













 






 
 
 

  

   

    

     
    

    
    
     
  • 
      
     
    • 
     
  • 
      
     
    • 
     
  • 
      
     
    • 
     
  • 
      
     
    • 
     
  • 
      
     
    • 
    

   

   

    
     

      Description
      From
      Last Updated
     

    
    



     

      
       
       
This will break if an anonymous user makes the request. We're (somewhat) checking for that right below. An AnonymousUser object …

      		
      
       chipx86chipx86
      
      
       
      
     


    
   

  

 







 






  

 



















 




 




 














 





 

  

   




chipx86




   

   







  

 



 

  


   

   

    
 
chipx86



    
   


  

  

  



    




  1. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    2. 

















  2. 
 
    
  
  
    
  
 
    
  
    
   
    
    
     
    
      
       reviewboard/webapi/resources/user.py
       


        (Diff revision 1)


       
      
     
    
        
    
     
     
    

     
     
    

        
   
    
  
    
 
    

   
    
    
    




    
 
    
  
  
  

  
  
   Show all issues
  
 
    

    



    
    This will break if an anonymous user makes the request. We're (somewhat) checking for that right below. An AnonymousUser object should be valid here.
    

    Given this breakage, we should have a test for this scenario.
    
  
    
 
    

 
    
  


    
 
    
 
      

  


    1. 
 
 
      
 
      
  
 
      
 
      
  
      An anonymous user can't get to this point in the code because the entire method is wrapped in @webapi_check_login_required
      
 
      

      2. 



    2. 
 
 
      
 
      
  
 
      
 
      
  
      Right. Not sure what I was thinking.
      
 
      

      3. 


 
    


    

 
    

    3. 




  3. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    4. 




  

 
















 





 

  

   




chipx86




   

   







  

 



 

  


   

   

    
 
chipx86



    
   


  

  

  



    




  1. 
 
    
  
    
   
    Ship It!
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    2. 















  2. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    3. 




  

 
















 



 

  

   




david




   

   

  

 



 

  


   

   

    
 Review request changed

    
   


  

  

  







  

   

    Status:
   

   


    Completed

   

  




  

   

    Change Summary:
   

   

    
Pushed to release-7.x (5222bb8)