Method AuthenticateWithReason

auth/user.go:515–553

AuthenticateWithReason returns true if the user exists, is not disabled, and has a valid password. If authentication fails, a user readable string for logging will be returned.

(password string)

// AuthenticateWithReason returns true if the user exists, is not disabled, and has a valid password. If authentication fails, a user readable string for logging will be returned.
func (user *userImpl) AuthenticateWithReason(password string) (ok bool, reason string) {
	if user == nil {
		return false, "User not found"
	}

	// exit early for disabled user accounts
	if user.Disabled_ {
		return false, "Account disabled"
	}

	// exit early if old hash is present
	if user.OldPasswordHash_ != nil {
		// Password must be reset to use new (bcrypt) password hash
		base.WarnfCtx(user.auth.LogCtx, "User account %q still has pre-beta password hash; need to reset password", base.UD(user.Name_))
		return false, "User account still has pre-beta password hash; need to reset password"
	}

	// bcrypt hash present
	if user.PasswordHash_ != nil {
		if !compareHashAndPassword(cachedHashes, user.PasswordHash_, []byte(password)) {
			// incorrect password
			return false, "Incorrect password"
		}

		// password was correct, we'll rehash the password if required
		// e.g: in the case of bcryptCost changes
		if err := user.auth.rehashPassword(user, password); err != nil {
			// rehash is best effort, just log a warning on error.
			base.WarnfCtx(user.auth.LogCtx, "Error when rehashing password for user %s: %v", base.UD(user.Name()), err)
		}
	} else {
		// no hash, but (incorrect) password provided
		if password != "" {
			return false, "Incorrect password"
		}
	}

	return true, ""
}

// GetSessionUUID returns the UUID that a session to match to be a valid session.
func (user *userImpl) GetSessionUUID() string {