bede/tfm_ainventory
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

debug: add detailed logging to login authentication flow

Browse Source 
- Log when local auth succeeds/fails
- Log when password mismatch occurs
- Log LDAP auth attempts and failures
- Helps diagnose why login is returning 401
This commit is contained in:
Daniel Bedeleanu
2026-04-11 14:55:31 +03:00
parent 483a747600
commit 3c8d50162b
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
backend/routers/users.py
View File

@@ -159,16 +159,24 @@ def login(form_data: schemas.UserLogin, db: Session = Depends(get_db)):
authenticated = False authenticated = False
if user and user.hashed_password: if user and user.hashed_password:
if verify_password(form_data.password, user.hashed_password): if verify_password(form_data.password, user.hashed_password):
log.debug(f"Local auth successful for {form_data.username}")
authenticated = True authenticated = True
else:
log.debug(f"Local auth failed: password mismatch for {form_data.username}")
elif user and not user.hashed_password: elif user and not user.hashed_password:
log.debug(f"User {form_data.username} exists but has no hashed password (LDAP user), skipping local auth")
# [SECURITY FIX C-02] Bypass for passwordless users has been removed. # [SECURITY FIX C-02] Bypass for passwordless users has been removed.
# LDAP users must authenticate via the LDAP flow below. # LDAP users must authenticate via the LDAP flow below.
pass pass
elif not user:
log.debug(f"User {form_data.username} not found in database, will try LDAP")
# If local failed, try LDAP # If local failed, try LDAP
if not authenticated: if not authenticated:
log.debug(f"Local auth failed for {form_data.username}, attempting LDAP")
ldap_role = authenticate_ldap(form_data.username, form_data.password) ldap_role = authenticate_ldap(form_data.username, form_data.password)
if ldap_role: if ldap_role:
log.debug(f"LDAP auth successful for {form_data.username}, role={ldap_role}")
authenticated = True authenticated = True
# Cache hash for offline support # Cache hash for offline support
new_hash = get_password_hash(form_data.password) new_hash = get_password_hash(form_data.password)
@@ -191,6 +199,7 @@ def login(form_data: schemas.UserLogin, db: Session = Depends(get_db)):
db.commit() db.commit()
db.refresh(user) db.refresh(user)
else: else:
log.warning(f"Login failed: LDAP auth also failed for {form_data.username}")
raise HTTPException(status_code=401, detail="Invalid username or password, or insufficient permissions") raise HTTPException(status_code=401, detail="Invalid username or password, or insufficient permissions")
if not authenticated or not user: if not authenticated or not user: