Merge lp:~matiasb/canonical-identity-provider/more-on-password-validation into lp:canonical-identity-provider/release

[Matias Bordese]

Forced password and email address (ie, looks like an email address) validation on account creation through AccountManager.

Forced password and email address validation on account creation through AccountManager.
Refactored tests accordingly; added a DEFAULT_USER_PASSWORD constant, policy compliant, to reuse in tests.
Functional tests temporarily disabled (nessita is working on those and will update them during the process).

[Ricardo Kirkner (ricardokirkner)]

LGTM

review: Approve

=== modified file 'api/tests/test_handlers.py'
--- api/tests/test_handlers.py	2012-12-13 20:19:19 +0000
+++ api/tests/test_handlers.py	2012-12-17 20:24:41 +0000
@@ -27,6 +27,10 @@
     EmailStatus,
     LoginTokenType,
 )
+from identityprovider.tests import (
+    DEFAULT_API_PASSWORD,
+    DEFAULT_USER_PASSWORD,
+)
 from identityprovider.validators import PASSWORD_POLICY_ERROR
 
 from api.tests.utils import (
@@ -35,8 +39,8 @@
 )
 
 
-def http_authorization_extra(email_address):
-    email_address = base64.b64encode(email_address + ':test')
+def http_authorization_extra(email_address, password):
+    email_address = base64.b64encode('%s:%s' % (email_address, password))
     return {'HTTP_AUTHORIZATION': 'basic ' + email_address}
 
 AUTHTOKEN = 'identityprovider.models.authtoken.%s'
@@ -262,7 +266,8 @@
         if token is not None:
             data['token'] = token
 
-        extra = http_authorization_extra(self.email_address)
+        extra = http_authorization_extra(self.email_address,
+                                         password=DEFAULT_USER_PASSWORD)
         dispatcher = getattr(self.client, method.lower())
         response = dispatcher("/api/%s/authentications" % api_version, data,
                               **extra)
@@ -277,7 +282,8 @@
         }
         if max_age is not None:
             data['max_age'] = max_age
-        extra = http_authorization_extra(self.apiuser.username)
+        extra = http_authorization_extra(self.apiuser.username,
+                                         password=DEFAULT_API_PASSWORD)
         response = self.client.get('/api/1.0/authentications', data, **extra)
         content = simplejson.loads(response.content)
         return content
@@ -355,7 +361,8 @@
                 self.assertEqual(token1[key], token2[key])
 
     def test_authenticate_refresh_account_has_no_tokens(self):
-        extra = http_authorization_extra(self.email_address)
+        extra = http_authorization_extra(self.email_address,
+                                         password=DEFAULT_USER_PASSWORD)
         data = {
             'ws.op': 'authenticate',
             'token_name': 'some-token',
@@ -369,7 +376,8 @@
         self.assertEqual(response.status_code, 404)
 
     def test_authenticate_refresh_token_is_not_owned(self):
-        extra = http_authorization_extra(self.email_address)
+        extra = http_authorization_extra(self.email_address,
+                                         password=DEFAULT_USER_PASSWORD)
         data = {
             'ws.op': 'authenticate',
             'token_name': 'some-token',
@@ -405,7 +413,8 @@
         self.factory.add_account_to_team(account, team)
 
         # Request membership via API
-        extra = http_authorization_extra('foobar')
+        extra = http_authorization_extra('foobar',
+                                         password=DEFAULT_API_PASSWORD)
         data = {
             'ws.op': 'team_memberships',
             'team_names': '["%s", "%s"]' % (team.name, otherteam.name),
@@ -422,7 +431,8 @@
         self.factory.add_account_to_team(account, team)
 
         # Request membership via API
-        extra = http_authorization_extra('foobar')
+        extra = http_authorization_extra('foobar',
+                                         password=DEFAULT_API_PASSWORD)
         data = {
             'ws.op': 'team_memberships',
             'team_names': '["%s"]' % team.name,
@@ -443,7 +453,8 @@
     def test_team_membership_fails_for_regular_user(self):
         email_address = self.factory.make_email_address()
         self.factory.make_account(email=email_address)
-        extra = http_authorization_extra(email_address)
+        extra = http_authorization_extra(email_address,
+                                         password=DEFAULT_USER_PASSWORD)
         data = {
             'ws.op': 'team_memberships',
             'team_names': '["something"]',
@@ -499,7 +510,8 @@
 
     def test_me_is_oauth_protected(self):
         email_address = self.factory.make_email_address()
-        extra = http_authorization_extra(email_address)
+        extra = http_authorization_extra(email_address,
+                                         password=DEFAULT_USER_PASSWORD)
         data = {'ws.op': 'me'}
         response = self.client.get('/api/1.0/accounts', data, **extra)
         self.assertEqual(401, response.status_code)

=== modified file 'identityprovider/fixtures/test.json'
--- identityprovider/fixtures/test.json	2012-01-20 17:50:59 +0000
+++ identityprovider/fixtures/test.json	2012-12-17 20:24:41 +0000
@@ -91,7 +91,7 @@
         "model": "identityprovider.accountpassword",
         "fields": {
             "account": 1,
-            "password": "K7Qmeansl6RbuPfulfcmyDQOzp70OxVh5Fcf"
+            "password": "7whYlTsp37YAwPVAzJmQ5T6+3jKRglh4Vv1Empr/ek2S87QzkJDHQQ=="
         }
     },
     {
@@ -99,7 +99,7 @@
         "model": "identityprovider.accountpassword",
         "fields": {
             "account": 12,
-            "password": "K7Qmeansl6RbuPfulfcmyDQOzp70OxVh5Fcf"
+            "password": "7whYlTsp37YAwPVAzJmQ5T6+3jKRglh4Vv1Empr/ek2S87QzkJDHQQ=="
         }
     },
     {
@@ -107,7 +107,7 @@
         "model": "identityprovider.accountpassword",
         "fields": {
             "account": 243610,
-            "password": "9I7bMpJUcBH+edfXjswjdo7nC6iuoTU6YAqolznT59Q1h9v+z9pdVQ=="
+            "password": "7whYlTsp37YAwPVAzJmQ5T6+3jKRglh4Vv1Empr/ek2S87QzkJDHQQ=="
         }
     },
 

=== modified file 'identityprovider/models/account.py'
--- identityprovider/models/account.py	2012-12-12 19:49:16 +0000
+++ identityprovider/models/account.py	2012-12-17 20:24:41 +0000
@@ -21,6 +21,7 @@
     generate_openid_identifier,
     get_object_or_none,
 )
+from identityprovider.validators import validate_password_policy
 
 __all__ = [
     'Account',
@@ -44,24 +45,35 @@
                        password_encrypted=False, email_validated=True,
                        openid_identifier=None):
         from identityprovider.models import EmailAddress
+
+        # do validation before account (and related) creation/save
+        if not password_encrypted:
+            # an encrypted password is assumed to be valid
+            # this will raise a ValidationError if password does not
+            # complies with policy
+            validate_password_policy(password)
+            password = encrypt_launchpad_password(password, salt=salt)
+
+        email_status = (
+            EmailStatus.PREFERRED if email_validated else EmailStatus.NEW)
+        email = EmailAddress(email=email_address, status=email_status)
+        email.full_clean()
+
         if creation_rationale is None:
             creation_rationale = (
                 AccountCreationRationale.OWNER_CREATED_LAUNCHPAD)
+
         kwargs = {
             'displayname': displayname,
             'creation_rationale': creation_rationale,
             'status': AccountStatus.ACTIVE}
+
         if openid_identifier is not None:
             kwargs['openid_identifier'] = openid_identifier
+
         account = Account.objects.create(**kwargs)
-        email_status = (
-            EmailStatus.PREFERRED if email_validated else EmailStatus.NEW)
-        EmailAddress.objects.create(
-            email=email_address,
-            account=account,
-            status=email_status)
-        if not password_encrypted:
-            password = encrypt_launchpad_password(password, salt=salt)
+        email.account = account
+        email.save()
         password = AccountPassword.objects.create(
             account=account,
             password=password)

=== modified file 'identityprovider/tests/__init__.py'
--- identityprovider/tests/__init__.py	2012-12-03 17:50:53 +0000
+++ identityprovider/tests/__init__.py	2012-12-17 20:24:41 +0000
@@ -8,3 +8,8 @@
 
 # Disable writing OpenID messaged to stderr
 oidutil.log = logging.debug
+
+# default api/account passwords, policy compliant
+DEFAULT_API_PASSWORD = 'test'
+# when changing, make sure to update test fixture with the encrypted password
+DEFAULT_USER_PASSWORD = 'test1Test'

=== modified file 'identityprovider/tests/factory.py'
--- identityprovider/tests/factory.py	2012-10-29 17:55:56 +0000
+++ identityprovider/tests/factory.py	2012-12-17 20:24:41 +0000
@@ -19,6 +19,10 @@
     TeamParticipation,
 )
 from identityprovider.models.const import EmailStatus, LoginTokenType
+from identityprovider.tests import (
+    DEFAULT_API_PASSWORD,
+    DEFAULT_USER_PASSWORD,
+)
 
 
 class SSOObjectFactory(object):
@@ -37,7 +41,7 @@
         """Return a unique integer for the test run."""
         return self.counter.next()
 
-    def make_apiuser(self, username=None, password='test'):
+    def make_apiuser(self, username=None, password=DEFAULT_API_PASSWORD):
         if username is None:
             username = self.get_unique_string(prefix='apiuser-')
         user, created = APIUser.objects.get_or_create(username=username)
@@ -45,7 +49,8 @@
         user.save()
         return user
 
-    def make_account(self, displayname=None, email=None, password='test',
+    def make_account(self, displayname=None, email=None,
+                     password=DEFAULT_USER_PASSWORD,
                      creation_rationale=None, salt=None,
                      password_encrypted=False, email_validated=True,
                      openid_identifier=None):

=== removed file 'identityprovider/tests/functional/__init__.py'
--- identityprovider/tests/functional/__init__.py	2012-01-06 20:28:28 +0000
+++ identityprovider/tests/functional/__init__.py	1970-01-01 00:00:00 +0000
@@ -1,11 +0,0 @@
-from wsgi_intercept import add_wsgi_intercept
-from wsgi_intercept.urllib2_intercept import install_opener
-
-from identityprovider.wsgi import make_app
-
-
-install_opener()
-
-add_wsgi_intercept('openid.launchpad.dev', 80, make_app)
-add_wsgi_intercept('launchpad.dev', 80, make_app)
-add_wsgi_intercept('localhost', 80, make_app)

=== modified file 'identityprovider/tests/unit/test_auth.py'
--- identityprovider/tests/unit/test_auth.py	2012-10-29 16:06:36 +0000
+++ identityprovider/tests/unit/test_auth.py	2012-12-17 20:24:41 +0000
@@ -20,6 +20,7 @@
     SSOOAuthAuthentication,
     oauth_authenticate,
 )
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.utils import SSOBaseTestCase
 
 
@@ -36,7 +37,8 @@
         email_address.status = EmailStatus.OLD
         email_address.save()
 
-        result = self.backend.authenticate('[e-mail]', 'test')
+        result = self.backend.authenticate('[e-mail]',
+                                           DEFAULT_USER_PASSWORD)
 
         self.assertTrue(result is None)
 
@@ -46,11 +48,13 @@
 
     def test_authenticate_with_email_case_insensitive(self):
         # Make sure authentication works as expected
-        account1 = self.backend.authenticate('[e-mail]', 'test')
+        account1 = self.backend.authenticate('[e-mail]',
+                                             DEFAULT_USER_PASSWORD)
         self.assertTrue(account1 is not None)
 
         # Try using different case for email
-        account2 = self.backend.authenticate('[e-mail]', 'test')
+        account2 = self.backend.authenticate('[e-mail]',
+                                             DEFAULT_USER_PASSWORD)
         self.assertTrue(account2 is not None)
 
         # Make sure both accounts are the same
@@ -61,11 +65,13 @@
         # make sure account is active
         self.assertEqual(account.status, AccountStatus.ACTIVE)
         # make sure authentication succeeds
-        response = self.backend.authenticate('[e-mail]', 'test')
+        response = self.backend.authenticate('[e-mail]',
+                                             DEFAULT_USER_PASSWORD)
         self.assertEqual(response, account)
 
     def test_authenticate_by_token_missing_account(self):
-        user = User.objects.create_user('test', 'test', password='test')
+        user = User.objects.create_user('test', 'test',
+                                        password=DEFAULT_USER_PASSWORD)
         consumer = Consumer.objects.create(user=user)
         token = Token.objects.create(consumer=consumer, name='test')
 
@@ -84,7 +90,8 @@
             account.save()
 
             # make sure authentication fails
-            response = self.backend.authenticate('[e-mail]', 'test')
+            response = self.backend.authenticate('[e-mail]',
+                                                 DEFAULT_USER_PASSWORD)
             self.assertEqual(response, None)
 
         # leave everything as it was
@@ -95,7 +102,8 @@
         account = Account.objects.get_by_email('[e-mail]')
         account.accountpassword.delete()
 
-        response = self.backend.authenticate('[e-mail]', 'test')
+        response = self.backend.authenticate('[e-mail]',
+                                             DEFAULT_USER_PASSWORD)
 
         self.assertTrue(response is None)
         account = Account.objects.get_by_email('[e-mail]')

=== modified file 'identityprovider/tests/unit/test_command_add_to_team.py'
--- identityprovider/tests/unit/test_command_add_to_team.py	2012-10-29 16:06:36 +0000
+++ identityprovider/tests/unit/test_command_add_to_team.py	2012-12-17 20:24:41 +0000
@@ -6,6 +6,7 @@
 from mock import patch
 
 from identityprovider.models import Account, Person
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.utils import get_object_or_none
 
 
@@ -13,7 +14,7 @@
 
     def setUp(self):
         self.account = Account.objects.create_account(
-            'test', '[e-mail]', 'Test123',
+            'test', '[e-mail]', DEFAULT_USER_PASSWORD,
             openid_identifier='openid')
         self.team = Person.objects.create(name='TeamA')
 

=== modified file 'identityprovider/tests/unit/test_command_upload_fobs.py'
--- identityprovider/tests/unit/test_command_upload_fobs.py	2012-10-29 16:06:36 +0000
+++ identityprovider/tests/unit/test_command_upload_fobs.py	2012-12-17 20:24:41 +0000
@@ -11,6 +11,7 @@
     LPOpenIdIdentifier,
     Person,
 )
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 
 
 def mock_open(data):
@@ -28,7 +29,7 @@
 
     def setUp(self):
         account = Account.objects.create_account(
-            test_username, test_username, 'Abcdef0')
+            test_username, '[e-mail]', DEFAULT_USER_PASSWORD)
         p = Person.objects.create(name=test_username)
         p.lp_account = account.id
         p.save()

=== modified file 'identityprovider/tests/unit/test_forms.py'
--- identityprovider/tests/unit/test_forms.py	2012-12-03 16:51:35 +0000
+++ identityprovider/tests/unit/test_forms.py	2012-12-17 20:24:41 +0000
@@ -19,6 +19,7 @@
     TokenForm,
 )
 from identityprovider.models.openidmodels import OpenIDRPConfig
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.utils import SSOBaseTestCase
 
 
@@ -157,7 +158,7 @@
 
     def setUp(self):
         self.test_user = Account.objects.create_account(
-            'My name', '[e-mail]', 'password')
+            'My name', '[e-mail]', DEFAULT_USER_PASSWORD)
         self.rpconfig = OpenIDRPConfig.objects.create(
             trust_root='http://localhost/', description="Some description")
 
@@ -407,11 +408,13 @@
 class LoginFormTestCase(SSOBaseTestCase):
     def test_clean_email_mixed_case(self):
         self.factory.make_account(email='[e-mail]')
-        data = {'email': '[e-mail]', 'password': 'test'}
+        data = {'email': '[e-mail]',
+                'password': DEFAULT_USER_PASSWORD}
         form = LoginForm(data=data)
         self.assertTrue(form.is_valid())
 
-        data = {'email': '[e-mail]', 'password': 'test'}
+        data = {'email': '[e-mail]',
+                'password': DEFAULT_USER_PASSWORD}
         form = LoginForm(data=data)
         self.assertTrue(form.is_valid())
 

=== modified file 'identityprovider/tests/unit/test_middleware.py'
--- identityprovider/tests/unit/test_middleware.py	2012-12-04 18:51:42 +0000
+++ identityprovider/tests/unit/test_middleware.py	2012-12-17 20:24:41 +0000
@@ -19,6 +19,7 @@
 from identityprovider.middleware.useraccount import (
     UserAccountConversionMiddleware)
 from identityprovider.models import Account, EmailAddress, OpenIDRPConfig
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.utils import MockRequest, SSOBaseTestCase
 from identityprovider.views import testing as test_views
 
@@ -197,7 +198,7 @@
     def _login(self, client=None, csrf_token=None):
         client = client or self.client
         client.handler.enforce_csrf_checks = True
-        form = {'email': '[e-mail]', 'password': 'test'}
+        form = {'email': '[e-mail]', 'password': DEFAULT_USER_PASSWORD}
         if not csrf_token:
             # get the token from the login page
             r, csrf_token = self._land()
@@ -340,7 +341,7 @@
         # continue back to RP.
         data = {
             'email': '[e-mail]',
-            'password': 'test'
+            'password': DEFAULT_USER_PASSWORD
         }
         r = self.client.post('/%s/+login' % oid_token, data, follow=True)
         self.assertTemplateUsed(r, 'server/decide.html')

=== modified file 'identityprovider/tests/unit/test_models_account.py'
--- identityprovider/tests/unit/test_models_account.py	2012-10-29 16:06:36 +0000
+++ identityprovider/tests/unit/test_models_account.py	2012-12-17 20:24:41 +0000
@@ -5,6 +5,7 @@
 
 from django.conf import settings
 from django.contrib.auth.models import User
+from django.core.exceptions import ValidationError
 from django.test import TestCase
 
 from mock import patch
@@ -20,6 +21,7 @@
 from identityprovider.models.const import AccountCreationRationale, EmailStatus
 from identityprovider.readonly import ReadOnlyManager
 from identityprovider.utils import encrypt_launchpad_password, generate_salt
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.utils import SSOBaseTestCase
 
 
@@ -202,7 +204,7 @@
         self.assertEqual(emails[1].status, EmailStatus.VALIDATED)
 
     def test_account_suspend_reset_password(self):
-        account = self.factory.make_account(password='valid')
+        account = self.factory.make_account(password=DEFAULT_USER_PASSWORD)
         account.status = AccountStatus.SUSPENDED
         account.save()
 
@@ -241,11 +243,29 @@
         self.assertEqual(
             AccountPassword.objects.filter(account=account).count(), 0)
 
+    def test_create_account_with_invalid_password(self):
+        salt = generate_salt()
+        kwargs = dict(
+            displayname='displayname', email='[e-mail]',
+            password='test', salt=salt,
+            creation_rationale=AccountCreationRationale.USER_CREATED,
+        )
+        self.assertRaises(ValidationError, self.factory.make_account, **kwargs)
+
+    def test_create_account_with_invalid_email_address(self):
+        salt = generate_salt()
+        kwargs = dict(
+            displayname='displayname', email='not_an_email',
+            password=DEFAULT_USER_PASSWORD, salt=salt,
+            creation_rationale=AccountCreationRationale.USER_CREATED,
+        )
+        self.assertRaises(ValidationError, self.factory.make_account, **kwargs)
+
     def test_create_account_with_rationale(self):
         salt = generate_salt()
         account = self.factory.make_account(
             displayname='displayname', email='[e-mail]',
-            password='password',
+            password=DEFAULT_USER_PASSWORD,
             creation_rationale=AccountCreationRationale.USER_CREATED,
             salt=salt,
         )
@@ -265,13 +285,14 @@
         self.assertEqual(passwords.count(), 1)
         password = passwords[0]
         self.assertEqual(password.password,
-                         encrypt_launchpad_password('password', salt=salt))
+                         encrypt_launchpad_password(DEFAULT_USER_PASSWORD,
+                                                    salt=salt))
 
     def test_create_account_with_no_rationale(self):
         salt = generate_salt()
         account = self.factory.make_account(
             displayname='displayname', email='[e-mail]',
-            password='password', salt=salt)
+            password=DEFAULT_USER_PASSWORD, salt=salt)
 
         self.assertEqual(account.displayname, 'displayname')
         self.assertEqual(account.creation_rationale,
@@ -288,13 +309,14 @@
         self.assertEqual(passwords.count(), 1)
         password = passwords[0]
         self.assertEqual(password.password,
-                         encrypt_launchpad_password('password', salt=salt))
+                         encrypt_launchpad_password(DEFAULT_USER_PASSWORD,
+                                                    salt=salt))
 
     def test_create_account_with_email_validated(self):
         salt = generate_salt()
         account = self.factory.make_account(
             displayname='displayname', email='[e-mail]',
-            password='password', salt=salt, email_validated=False)
+            password=DEFAULT_USER_PASSWORD, salt=salt, email_validated=False)
 
         self.assertEqual(account.displayname, 'displayname')
         self.assertEqual(account.creation_rationale,
@@ -311,7 +333,8 @@
         self.assertEqual(passwords.count(), 1)
         password = passwords[0]
         self.assertEqual(password.password,
-                         encrypt_launchpad_password('password', salt=salt))
+                         encrypt_launchpad_password(DEFAULT_USER_PASSWORD,
+                                                    salt=salt))
 
     def test_sites_with_active_sessions_when_returns_empty_result(self):
         account = self.factory.make_account()
@@ -396,7 +419,7 @@
     def setUp(self):
         self.account = self.factory.make_account(
             displayname='test', email='[e-mail]',
-            password='password')
+            password=DEFAULT_USER_PASSWORD)
         self.user = User.objects.create_user(
             self.account.openid_identifier,
             '[e-mail]', 'password')

=== modified file 'identityprovider/tests/unit/test_models_team.py'
--- identityprovider/tests/unit/test_models_team.py	2012-10-19 21:30:41 +0000
+++ identityprovider/tests/unit/test_models_team.py	2012-12-17 20:24:41 +0000
@@ -11,7 +11,7 @@
     TeamParticipation,
     get_team_memberships_for_user,
 )
-
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.utils import SSOBaseTestCase
 
 
@@ -44,7 +44,7 @@
 
     def test_get_team_memberships_on_personless_account(self):
         account = Account.objects.create_account('test', '[e-mail]',
-                                                 'password')
+                                                 DEFAULT_USER_PASSWORD)
         memberships = get_team_memberships_for_user(
             ['ubuntu-team'], account, False)
         self.assertEqual(memberships, [])

=== modified file 'identityprovider/tests/unit/test_validators.py'
--- identityprovider/tests/unit/test_validators.py	2012-12-13 20:19:19 +0000
+++ identityprovider/tests/unit/test_validators.py	2012-12-17 20:24:41 +0000
@@ -1,5 +1,6 @@
 from django.core.exceptions import ValidationError
 
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.utils import SSOBaseTestCase
 from identityprovider.validators import validate_password_policy
 
@@ -24,3 +25,6 @@
 
     def test_valid_password(self):
         self.assertEqual(validate_password_policy('abcD3fgh'), None)
+
+    def test_default_password_is_validated(self):
+        self.assertEqual(validate_password_policy(DEFAULT_USER_PASSWORD), None)

=== modified file 'identityprovider/tests/unit/test_views_preflight.py'
--- identityprovider/tests/unit/test_views_preflight.py	2012-12-05 18:25:00 +0000
+++ identityprovider/tests/unit/test_views_preflight.py	2012-12-17 20:24:41 +0000
@@ -2,6 +2,7 @@
 
 from identityprovider.gargoyle import LPTeamConditionSet
 from identityprovider.models.account import Account
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.utils import SSOBaseTestCase
 from identityprovider.utils import add_user_to_team
 
@@ -23,15 +24,17 @@
 
     def test_account_without_person_receives_404(self):
         account = Account.objects.create_account(
-            "test", "[e-mail]", "test")
-        self.client.login(username="[e-mail]", password="test")
+            "test", "[e-mail]", DEFAULT_USER_PASSWORD)
+        self.client.login(username="[e-mail]",
+                          password=DEFAULT_USER_PASSWORD)
         r = self.client.get(self.URL)
         self.assertEqual(r.status_code, 404)
         account.emailaddress_set.all().delete()
         account.delete()
 
     def test_person_not_in_the_required_team_will_get_404(self):
-        self.client.login(username="[e-mail]", password="test")
+        self.client.login(username="[e-mail]",
+                          password=DEFAULT_USER_PASSWORD)
         r = self.client.get(self.URL)
         self.assertEqual(r.status_code, 404)
 
@@ -51,7 +54,8 @@
         )
 
         # test flag
-        self.client.login(username="[e-mail]", password="test")
+        self.client.login(username="[e-mail]",
+                          password=DEFAULT_USER_PASSWORD)
         r = self.client.get(self.URL)
 
         self.assertTemplateUsed(r, "preflight/overview.html")

=== modified file 'identityprovider/tests/unit/test_views_server.py'
--- identityprovider/tests/unit/test_views_server.py	2012-12-04 18:51:42 +0000
+++ identityprovider/tests/unit/test_views_server.py	2012-12-17 20:24:41 +0000
@@ -47,6 +47,7 @@
 from identityprovider.models.person import PersonLocation
 from identityprovider.models.authtoken import create_token
 from identityprovider.views import server
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.utils import (
     AuthenticatedTestCase,
     SSOBaseTestCase,
@@ -158,7 +159,8 @@
         self.rpconfig.save()
 
         account = Account.objects.get_by_email('[e-mail]')
-        self.client.login(username='[e-mail]', password='test')
+        self.client.login(username='[e-mail]',
+                          password=DEFAULT_USER_PASSWORD)
         r = self.client.get('/+openid', self.params)
         query = self.get_query(r)
         self.assertEqual(r.status_code, 302)
@@ -172,7 +174,8 @@
 
         self.params['openid.identity'] = \
             settings.SSO_ROOT_URL + '+id/mark_oid'
-        self.client.login(username='[e-mail]', password='test')
+        self.client.login(username='[e-mail]',
+                          password=DEFAULT_USER_PASSWORD)
         r = self.client.get('/+openid', self.params)
         query = self.get_query(r)
         self.assertEqual(r.status_code, 302)
@@ -183,7 +186,8 @@
     def test_handle_user_response_user_is_authenticated(self):
         self.params['openid.identity'] = \
             settings.SSO_ROOT_URL + '+id/other_oid'
-        self.client.login(username='[e-mail]', password='test')
+        self.client.login(username='[e-mail]',
+                          password=DEFAULT_USER_PASSWORD)
         r = self.client.get('/+openid', self.params)
         query = self.get_query(r)
         self.assertEqual(r.status_code, 302)
@@ -463,7 +467,7 @@
     def test_decide_team_membership_with_auto_authorize(self):
         # make sure rpconfig is set to auto authorize
         self.client.login(username='[e-mail]',
-                          password='test')
+                          password=DEFAULT_USER_PASSWORD)
 
         rpconfig = OpenIDRPConfig(trust_root='http://localhost/',
                                   auto_authorize=True)
@@ -504,7 +508,7 @@
 
     def test_list_of_details_is_complete(self):
         self.client.login(username='[e-mail]',
-                          password='test')
+                          password=DEFAULT_USER_PASSWORD)
 
         # create a trusted rpconfig
         rpconfig = OpenIDRPConfig(
@@ -527,7 +531,7 @@
 
     def test_state_of_checkboxes_and_data_formats_trusted(self):
         self.client.login(username='[e-mail]',
-                          password='test')
+                          password=DEFAULT_USER_PASSWORD)
 
         # create a trusted rpconfig
         rpconfig = OpenIDRPConfig(
@@ -577,7 +581,7 @@
 
     def test_state_of_checkboxes_and_data_formats_untrusted(self):
         self.client.login(username='[e-mail]',
-                          password='test')
+                          password=DEFAULT_USER_PASSWORD)
 
         # create a trusted rpconfig
         trust_root = 'http://untrusted/'
@@ -949,7 +953,8 @@
                         'http://localhost/')
 
         # login and redirect to pre-authorize again
-        data.update({'email': '[e-mail]', 'password': 'test',
+        data.update({'email': '[e-mail]',
+                     'password': DEFAULT_USER_PASSWORD,
                      'next': '/+pre-authorize-rp'})
         r = self.client.post('/+login', data, **extra)
         r = self.client.post('/+pre-authorize-rp', data, **extra)
@@ -1304,7 +1309,8 @@
         token = create_token(16)
 
         # call up a session-modifying view to get a real session object
-        r = self.client.login(username='[e-mail]', password='test')
+        r = self.client.login(username='[e-mail]',
+                              password=DEFAULT_USER_PASSWORD)
         self.assertTrue(r)
 
         session = self.client.session
@@ -1353,7 +1359,8 @@
     fixtures = ["test"]
 
     def test_untrusted_rp_properly_shows_markup(self):
-        self.client.login(username='[e-mail]', password='test')
+        self.client.login(username='[e-mail]',
+                          password=DEFAULT_USER_PASSWORD)
         self.rpconfig = OpenIDRPConfig(
             trust_root='http://localhost/',
             displayname="MYSITE"

=== modified file 'identityprovider/tests/utils.py'
--- identityprovider/tests/utils.py	2012-12-13 11:37:21 +0000
+++ identityprovider/tests/utils.py	2012-12-17 20:24:41 +0000
@@ -27,6 +27,7 @@
 
 from identityprovider import signed
 from identityprovider.models.authtoken import create_token
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.factory import SSOObjectFactory
 from identityprovider.views import server
 
@@ -223,7 +224,7 @@
                             old_middlewares)
 
         self.login_email = "[e-mail]"
-        self.login_password = "test"
+        self.login_password = DEFAULT_USER_PASSWORD
 
         self.client.login(username=self.login_email,
                           password=self.login_password)

=== modified file 'webui/tests/test_static.py'
--- webui/tests/test_static.py	2012-12-07 13:08:43 +0000
+++ webui/tests/test_static.py	2012-12-17 20:24:41 +0000
@@ -3,6 +3,7 @@
 
 from django.conf import settings
 
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.utils import SSOBaseTestCase, patch_settings
 
 
@@ -33,7 +34,8 @@
         self.assertAvailable('/+description', "What's this?")
 
     def test_applications_page(self):
-        self.client.login(username='[e-mail]', password='test')
+        self.client.login(username='[e-mail]',
+                          password=DEFAULT_USER_PASSWORD)
         self.assertAvailable('/+applications', 'Applications you use')
 
 
@@ -72,5 +74,6 @@
         self.assertNotAvailable('/+description')
 
     def test_applications_page(self):
-        self.client.login(username='[e-mail]', password='test')
+        self.client.login(username='[e-mail]',
+                          password=DEFAULT_USER_PASSWORD)
         self.assertNotAvailable('/+applications')

=== modified file 'webui/tests/test_views_account.py'
--- webui/tests/test_views_account.py	2012-12-03 17:50:53 +0000
+++ webui/tests/test_views_account.py	2012-12-17 20:24:41 +0000
@@ -21,6 +21,7 @@
     AccountStatus,
     EmailStatus,
 )
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.utils import (
     MISSING_BACKUP_DEVICE,
     AuthenticatedTestCase,
@@ -461,7 +462,8 @@
     fixtures = ["test"]
 
     def setUp(self):
-        self.client.login(username="[e-mail]", password="test")
+        self.client.login(username="[e-mail]",
+                          password=DEFAULT_USER_PASSWORD)
         self.disable_csrf()
         self.addCleanup(self.reset_csrf)
 

=== modified file 'webui/tests/test_views_devices.py'
--- webui/tests/test_views_devices.py	2012-12-05 16:35:55 +0000
+++ webui/tests/test_views_devices.py	2012-12-17 20:24:41 +0000
@@ -15,6 +15,7 @@
 
 from identityprovider.models import Account, AuthenticationDevice
 from identityprovider.models.const import AccountStatus
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.factory import SSOObjectFactory
 from identityprovider.tests.utils import (
     MISSING_BACKUP_DEVICE,
@@ -32,11 +33,11 @@
 
     def setUp(self):
         super(DeviceViewsTestCaseBase, self).setUp()
-        self.account = account = self.factory.make_account(password='test')
+        self.account = account = self.factory.make_account()
         self.device = self.factory.make_device(account, name='foo')
 
         self.client.login(username=account.preferredemail.email,
-                          password='test')
+                          password=DEFAULT_USER_PASSWORD)
 
         self.patch_is_upgraded = mock.patch(
             'identityprovider.models.twofactor.is_upgraded')
@@ -161,19 +162,19 @@
         self.assertEqual(device.name, 'bar')
 
     def test_device_rename_get_when_invalid_user(self):
-        new_account = self.factory.make_account(password='test2')
+        new_account = self.factory.make_account()
         self.client.logout()
         self.client.login(username=new_account.preferredemail.email,
-                          password='test2')
+                          password=DEFAULT_USER_PASSWORD)
         # post as new user
         response = self.client.get(self.rename_view)
         self.assertEqual(response.status_code, 404)
 
     def test_device_rename_post_when_invalid_user(self):
-        new_account = self.factory.make_account(password='test2')
+        new_account = self.factory.make_account()
         self.client.logout()
         self.client.login(username=new_account.preferredemail.email,
-                          password='test2')
+                          password=DEFAULT_USER_PASSWORD)
         # post as new user
         response = self.client.post(self.rename_view, {'name': 'bar'})
         self.assertEqual(response.status_code, 404)
@@ -270,7 +271,7 @@
         url = reverse('twofactor')
 
         factory = SSOObjectFactory()
-        account = factory.make_account(email='[e-mail]', password='test')
+        account = factory.make_account(email='[e-mail]')
         device = factory.make_device(account, name='foo')
 
         @test_concurrently(2)

=== modified file 'webui/tests/test_views_i18n.py'
--- webui/tests/test_views_i18n.py	2012-12-03 17:50:53 +0000
+++ webui/tests/test_views_i18n.py	2012-12-17 20:24:41 +0000
@@ -1,5 +1,6 @@
+from identityprovider.models.account import Account
 from identityprovider.tests.utils import SSOBaseTestCase
-from identityprovider.models.account import Account
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 
 
 class SetLanguageTestCase(SSOBaseTestCase):
@@ -41,7 +42,8 @@
         self.assertTemplateUsed(r, 'select_language.html')
 
     def test_setting_language_for_authenticated_users_updates_db(self):
-        self.client.login(username='[e-mail]', password='test')
+        self.client.login(username='[e-mail]',
+                          password=DEFAULT_USER_PASSWORD)
         self.client.post('/set_language', {'language': 'es', 'next': '/'})
 
         account = Account.objects.get_by_email('[e-mail]')

=== modified file 'webui/tests/test_views_ui.py'
--- webui/tests/test_views_ui.py	2012-12-03 20:19:22 +0000
+++ webui/tests/test_views_ui.py	2012-12-17 20:24:41 +0000
@@ -42,6 +42,7 @@
 )
 from identityprovider.models.captcha import Captcha
 from identityprovider.models.const import AccountStatus, LoginTokenType
+from identityprovider.tests import DEFAULT_USER_PASSWORD
 from identityprovider.tests.utils import (
     MockHandler,
     SSOBaseTestCase,
@@ -151,13 +152,14 @@
         return '/token/%s/%s/%s' % (token_string, view, quoted_email)
 
     def authenticate(self):
-        self.client.login(username='[e-mail]', password='test')
+        self.client.login(username='[e-mail]',
+                          password=DEFAULT_USER_PASSWORD)
 
 
 class UIViewsTestCase(UIViewsBaseTestCase):
     def test_login_with_unicode_email(self):
         email = u'mark@客example.com'
-        password = 'test'
+        password = DEFAULT_USER_PASSWORD
         Account.objects.create_account('Mark Shuttleworth', email, password)
         r = self.client.post(
             '/+login',
@@ -178,7 +180,7 @@
 
     def test_login_with_next(self):
         r = self.client.post('/+login', {'email': '[e-mail]',
-                                         'password': 'test',
+                                         'password': DEFAULT_USER_PASSWORD,
                                          'next': '/+edit'})
         self.assertRedirects(r, '/+edit')
 
@@ -199,7 +201,7 @@
             account.accountpassword.save()
 
             r = self.client.post('/+login', {'email': '[e-mail]',
-                                             'password': 'test',
+                                             'password': DEFAULT_USER_PASSWORD,
                                              'next': '/+edit'})
 
             if status == AccountStatus.SUSPENDED:
@@ -214,13 +216,14 @@
     def test_login_without_next_with_token(self):
         token = 'a' * 16
         r = self.client.post("/%s/+login" % token,
-                             {'email': '[e-mail]', 'password': 'test'})
+                             {'email': '[e-mail]',
+                              'password': DEFAULT_USER_PASSWORD})
         self.assertEqual(r.status_code, 302)
         self.assertEqual(r['Location'], "http://testserver/%s/" % token)
 
     def test_login_without_next_nor_token(self):
         r = self.client.post('/+login', {'email': '[e-mail]',
-                                         'password': 'test'})
+                                         'password': DEFAULT_USER_PASSWORD})
         self.assertRedirects(r, '/')
 
     def test_login_with_not_validated_email(self):
@@ -229,7 +232,7 @@
         account.emailaddress_set.create(
             email="[e-mail]", status=EmailStatus.NEW)
         r = self.client.post('/+login', {'email': '[e-mail]',
-                                         'password': 'test'})
+                                         'password': DEFAULT_USER_PASSWORD})
         self.assertFormError(r, 'form', None, "Password didn't match.")
 
     def test_logout(self):
@@ -762,7 +765,7 @@
 
     def test_edit_account_template(self):
         r = self.client.post('/+login', {'email': '[e-mail]',
-                                         'password': 'test',
+                                         'password': DEFAULT_USER_PASSWORD,
                                          'next': '/+edit'})
         r = self.client.get('/+edit')
         self.assertTemplateUsed(r, 'account/edit.html')
@@ -953,7 +956,8 @@
         account.preferredlanguage = 'es'
         account.save()
 
-        self.client.login(username='[e-mail]', password='test')
+        self.client.login(username='[e-mail]',
+                          password=DEFAULT_USER_PASSWORD)
         r = self.client.get('/')
         self.assertContains(r, 'es.png')
 
@@ -967,7 +971,8 @@
         self.assertNotContains(self.client.get('/'), 'es.png')
         self.client.post('/set_language', {'language': 'es'})
         self.assertContains(self.client.get('/'), 'es.png')
-        self.client.login(username='[e-mail]', password='test')
+        self.client.login(username='[e-mail]',
+                          password=DEFAULT_USER_PASSWORD)
         self.assertContains(self.client.get('/'), 'es.png')
 
         self.reset_csrf()
@@ -1030,7 +1035,8 @@
     def test_login_stats(self, mock_increment):
         self.client.get('/+login')
         self.client.post('/+login',
-                         {'email': '[e-mail]', 'password': 'test'})
+                         {'email': '[e-mail]',
+                          'password': DEFAULT_USER_PASSWORD})
         self.assertEqual(mock_increment.call_args_list, self.args_list())
 
     @patch('webui.views.ui.stats.increment')
@@ -1164,7 +1170,7 @@
 
 class TwoFactorLoginTestCase(SSOBaseTestCase):
     email = '[e-mail]'
-    password = 'test'
+    password = DEFAULT_USER_PASSWORD
     logout_link = 'a[href="/+logout"]'
 
     def setUp(self):

=== modified file 'webui/views/ui.py'
--- webui/views/ui.py	2012-12-12 19:00:43 +0000
+++ webui/views/ui.py	2012-12-17 20:24:41 +0000
@@ -645,6 +645,9 @@
             email = form.cleaned_data['email']
             password = form.cleaned_data.get('password', None)
             if password is not None:
+                # password validation enforced by the form
+                # at this point, password complies with policy since
+                # form.is_valid() is True
                 encrypted_password = encrypt_launchpad_password(password)
             else:
                 encrypted_password = password