Admin users cannot change other user's passwords via UI

[Teluka]

Administrator is unable to change users passwords via UI.

MAAS version: 2.7.3 (8291-g.384e521e6-0ubuntu1~18.04.2)

Steps to reproduce:

1. Login to UI
2. Create user
3. Change user's password
4. Try to login with new password

Workaround:

1. Login to CLI
2. Change password with "maas changepassword <username>" command

[Kit Randel (blr)]

I'm a little sceptical that this has ever worked. Django contrib seems to suggest that correct form for an admin changing a user's password is AdminPasswordChangeForm (https://docs.djangoproject.com/en/1.8/topics/auth/default/#django.contrib.auth.forms.AdminPasswordChangeForm). This doesn't exist in MAAS and user.change_password uses PasswordChangeForm which requires an old password, as is intended for a user to change their own password.

We currently dispatch a websocket request in the following form when editing a user:

{
  method: "user.update"
  params: {
    email: "<email address hidden>"
    id: 30
    is_superuser: false
    last_name: "test user"
    password1: "test"
    password2: "test"
    username: "test"
    request_id: 46
    type: 0
  }
}

"password1" and "password2" are sent, and the response does not error, but presumably these params are discarded.

[Bill Wear (billwear)]

i have confirmed that this behavior not only occurs with new users, but also when admin changes password for an existing (other) user. triaging this one.

[Bill Wear (billwear)]

oops, sorry, noticed UI status -- did not triage, but i can confirm that the behavior is as described, both for new users created by admin, and for existing users.

[Victor Tapia (vtapia)]

I'm attaching a patch that implements the password change (calling AdminPasswordChangeForm) in the websocket handler

[Adam Collard (adam-collard)]

bumped to b8 since the UI fix only just landed in the commit referenced by the UI submodule.

[Victor Tapia (vtapia)]

Opened MR to backport patch to 2.7 and 2.8 (commit 839b79338 in master)