Merge pull request #4695 from wansir/fix-4442

Fix cannot change user status to disabled

pkg/models/auth/password.go

@@ -112,8 +112,8 @@ func (p *passwordAuthenticator) Authenticate(_ context.Context, username, passwo
 	}
 
 	// check user status
-	if user != nil && (user.Status.State == nil || *user.Status.State != iamv1alpha2.UserActive) {
-		if user.Status.State != nil && *user.Status.State == iamv1alpha2.UserAuthLimitExceeded {
+	if user != nil && user.Status.State != iamv1alpha2.UserActive {
+		if user.Status.State == iamv1alpha2.UserAuthLimitExceeded {
 			klog.Errorf("%s, username: %s", RateLimitExceededError, username)
 			return nil, "", RateLimitExceededError
 		} else {

pkg/models/auth/password_test.go

@@ -242,7 +242,6 @@ func newActiveUser(username string, password string) *iamv1alpha2.User {
 	u := newUser(username, "", "")
 	password, _ = encrypt(password)
 	u.Spec.EncryptedPassword = password
-	s := iamv1alpha2.UserActive
-	u.Status.State = &s
+	u.Status.State = iamv1alpha2.UserActive
 	return u
 }

pkg/models/iam/im/im.go

@@ -18,6 +18,7 @@ package im
 import (
 	"context"
 	"fmt"
+	"time"
 
 	"kubesphere.io/kubesphere/pkg/apiserver/authentication"
 
@@ -70,7 +71,13 @@ func (im *imOperator) UpdateUser(new *iamv1alpha2.User) (*iamv1alpha2.User, erro
 	}
 	// keep encrypted password and user status
 	new.Spec.EncryptedPassword = old.Spec.EncryptedPassword
-	new.Status = old.Status
+	status := old.Status
+	// only support enable or disable
+	if new.Status.State == iamv1alpha2.UserDisabled || new.Status.State == iamv1alpha2.UserActive {
+		status.State = new.Status.State
+		status.LastTransitionTime = &metav1.Time{Time: time.Now()}
+	}
+	new.Status = status
 	updated, err := im.ksClient.IamV1alpha2().Users().Update(context.Background(), new, metav1.UpdateOptions{})
 	if err != nil {
 		klog.Error(err)