Validate that a user is still enabled upon token renewal (#3406)

Simon Plourde · amdprophet · commit ad35ea6d164a · 2019-11-19T11:53:49.000-08:00
Signed-off-by: Simon Plourde &lt;simon@sensu.io&gt;
diff --git a/backend/authentication/providers/basic/basic.go b/backend/authentication/providers/basic/basic.go
@@ -52,6 +52,9 @@ func (p *Provider) Refresh(ctx context.Context, claims *corev2.Claims) (*corev2.
 	if user == nil {
 		return nil, fmt.Errorf("user %q does not exist", claims.Provider.UserID)
 	}
+	if user.Disabled {
+		return nil, fmt.Errorf("user %q is disabled", claims.Provider.UserID)
+	}
 
 	newClaims, err := jwt.NewClaims(user)
 	if err != nil {

Original file line number	Diff line number	Diff line change
`@@ -52,6 +52,9 @@ func (p Provider) Refresh(ctx context.Context, claims corev2.Claims) (*corev2.`
`52`	`52`	`if user == nil {`
`53`	`53`	`return nil, fmt.Errorf("user %q does not exist", claims.Provider.UserID)`
`54`	`54`	`}`
	`55`	`+ if user.Disabled {`
	`56`	`+ return nil, fmt.Errorf("user %q is disabled", claims.Provider.UserID)`
	`57`	`+ }`
`55`	`58`
`56`	`59`	`newClaims, err := jwt.NewClaims(user)`
`57`	`60`	`if err != nil {`