Confirming password impossible with custom authentication backend

[aklajnert]

Important Details

How are you running Sentry?

• On-Premise docker [Version 9.0]
• Saas (sentry.io)
• Other [briefly describe your environment]

Description

I have a custom authentication backend which use my corporate authentication provider. The backend will create a new user on first login. The company policy doesn't allow to store user passwords in application databases, so the password will be empty in Sentry DB. In future if the user would like to log in, the password will be validated with corporate authentication again. This functionality works fine by registering custom authentication backend functionality in Django via sentry.conf.py file.
The problem is when the user wants to perform an admin action. Sentry wants the user to confirm password. To do that, it uses check_password() method from the User model. The problem is that check_password() is testing the password against the one stored in a database. If user has logged in via custom backend which doesn't store the password, it is impossible to confirm the password.

Steps to Reproduce

1. Log in with custom backend which doesn't store password in database
2. Try to perform any administrative action e.g. removing a project
3. Your password will be rejected every time.

What you expected to happen

Sentry should use the custom backend to validate the user password.

Possible Solution

This can be fixed by overriding or monkey-patching the check_password() method in the User model, but it doesn't seem to be the clean solution. Especially when you're using multiple custom backends (we do that in our company).

I think, the check_password() usage shall be replaced with authenticate() function which is defined by backend. This would be the easiest and cleanest solution.

[github-actions]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you label it Status: Accepted, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[chadwhitacre]

Is this still a valid issue, @realkosty?

[realkosty]

Hey @chadwhitacre. We had a SaaS customer using SSO report being unable to delete project because they are prompted for password which they don't have. @leedongwei said existing issue cover that.
Here are 2 other issues that are potentially related or duplicate:
#19601
#46373

[getsantry]

Routing to @getsentry/product-owners-sign-in for triage ⏲️