CGI Script for a Change Password feature

Hi,

I am attempting to write a cgi script which will allow the TeamSite user to change their passwords from a custom menu item on the TeamSite GUI. I have found some threads on the forum which deal with changing passwords using the Expect perl module.

http://devnet.interwoven.com/forums_vb/showthread.php?t=10398&page=1&pp=10

However I am getting somewhat confused about how the code in the link is executed. Should I collect the password information first in the cgi and then do validation for the old password and new password, or do I do the validation as I collect the password credentials?

Can someone tell me what the correct steps should be, to do the password change?

Currently I am doing the following:
1) collecting password information
2) Validating new password and retyped new password. I cannot actually verify the old password.
3) Doing the password change using Expect, although not working at the moment.

Interwoven 6.7.0
Solaris

Thanks in advance
Mashuk

Find more posts tagged with

Comments

kaalraa

Hi,

I am attempting to write a cgi script which will allow the TeamSite user to change their passwords from a custom menu item on the TeamSite GUI. I have found some threads on the forum which deal with changing passwords using the Expect perl module.

http://devnet.interwoven.com/forums_vb/showthread.php?t=10398&page=1&pp=10

However I am getting somewhat confused about how the code in the link is executed. Should I collect the password information first in the cgi and then do validation for the old password and new password, or do I do the validation as I collect the password credentials?

Can someone tell me what the correct steps should be, to do the password change?

Currently I am doing the following:
1) collecting password information
2) Validating new password and retyped new password. I cannot actually verify the old password.
3) Doing the password change using Expect, although not working at the moment.

Interwoven 6.7.0
Solaris

Thanks in advance
Mashuk

On initiation of the menu item by a user, it s obvious that user has logged in ... so i dont think of any reason as why you need to validate the password again?

Also, how you are storing the user credentials: as a OS user or LDAP??

Mashuk

The user is stored as an OS user. By using Expect, arent we mimicking what happens when you run the passwd on the command line, which does prompt the user for their existing password.

Thanks
Mashuk

Adam Stoller

The user is stored as an OS user. By using Expect, arent we mimicking what happens when you run the passwd on the command line, which does prompt the user for their existing password.

Thanks
Mashuk

That is correct - basically expect runs the process and provides input to the prompts it expects to see - however, depending on what version of Solaris and/or passwd program you have - the prompts may be different than what you've seen posted (they also may change based on whether the user's account has expired, been locked, changed their password within N days, etc.)

Currently I am doing the following:
1) collecting password information
2) Validating new password and retyped new password. I cannot actually verify the old password.
3) Doing the password change using Expect, although not working at the moment.

You verify the old password by using it to get through the first challenge/response of passwd - if you get back a prompt indicating that you've used an incorrect password - then you know it's not valid.
You verify that the new password, typed twice, matches and does not match the old password, and potentially conforms to one or more other policy decisions (length, first character, types of characters [alpha, digit, punctuation, etc.]) - you may or may not need to do all of that checking in your own code - it depends on how much of that checking is actually performed by the passwd program - at it's simplest, you take the information given to you (your script) and plug it into the appropriate place during the prompts while running passwd through expect and just examine the prompts you get back to make sure it proceeds correctly.
If passwd doesn't perform the policy checks you want - then you need to take care of that in your code before calling passwd

Now - the fun part ... you need to determine what user owns the CGI process (effective and real user) because that will determine if you are running passwd or something like su -l userid -c passwd. If you're writing your CGI in Perl you can look at the values of

(real) and

(effective) for the uids.

Good luck,

Mashuk

As the cgi script runs using the iw_cgi_wrapper, then the owner of the cgi is the user logged into TeamSite who wants to change their password.

To prove that the concept works, I tried running the code below, but this still does not work. Is someone able to give me a few pointers on what I should be doing?

my $expect=Expect->spawn("/usr/bin/passwd $user");
if (not $expect){
die ("Cannot set password for user $user\n");
} else {
$expect->expect(
10,
[
"Enter existing login password:"=>sub{
print $expect '$oldpassword\n';
return exp_continue;
}
],
);

$expect->expect(
10,
[
"New password:"=>sub{
print $expect '$newpassword\n';
return exp_continue;
}
],
);

$expect->expect(
10,
[
"Re-enter new password:"=>sub{
print $expect '$retrypassword\n';
return exp_continue;
}
],
);

Thanks
Mashuk

Mashuk

To prove that Expect is working as it should do, I wrote the following script:
Use Expect;

&changePassword('oldpassword','newpassword','retypepassword');

sub changePassword
{
my ($oldpassword, $newpassword, $retypepassword)=@_;
my $command = "/usr/bin/passwd $user";
my $expect=Expect->spawn($command);

if (not $expect){
die "Cannot set password for user $user";
} else {
$expect->expect(
10,
[
"Enter existing login password:"=>sub{
$expect->send("$oldpassword\n");
exp_continue;
}
],
[
"New Password: "=>sub{
$expect->send("$newpassword\n");
exp_continue;
}
],
[
"Re-enter new Password: "=>sub{
$expect->send("$retypepassword\n");
exp_continue;
}
],
);
}

This seems to have done the trick. I know theres more I need to cover, but I wanted to get it working in the first place.

Mashuk