NetHSM: Broken list-users command for "invalid" usernames

[CMon]

bug description

using NetHsm as backend.

I created a user called n-admin on the nethsm and try to print it with the list-users command.

I am able to create the user without problems. a curl to /api/v1/users results in the user being listed.

BUT if i use nitropy nethsm --host localhost:8443 --username admin --password <password> --no-verify-tls list-users i get the following error:

An unhandled exception occurred
        Exception encountered: ApiValueError("Invalid value `Development~n-admin`, must match regular expression `^([a-zA-Z0-9]+~)?[a-zA-Z0-9]+$` at ('args[0]', 1, 'user')")

Why are you checking for valid usernames on print? and not on creation? nevertheless the user is totally capable of being used (at least for adding operators, keys and tags to them)

For my point of view there is no need to not allow - inside a username, or at least reject the creation of users with invalid characters (better than preventing them from being listed)

local reproduction

1. run local container: docker run --rm -it -p 8443:8443 --name local-hsm -d docker.io/nitrokey/nethsm:testing
2. provision container:

nitropy nethsm --host localhost:8443 --username admin --password adminadmin --no-verify-tls \
  provision \
    --unlock-passphrase unlockunlock \
    --admin-passphrase adminadmin \
    <<-EOF
unlockunlock2
adminadmin
EOF

3. create n-admin: nitropy nethsm --host localhost:8443 --username admin --password adminadmin --no-verify-tls add-user --user-id "n-admin" --passphrase adminadmin --namespace Development --create-namespace --role Administrator --real-name "N Admin"
4. try to list users: nitropy nethsm --host localhost:8443 --username admin --password adminadmin --no-verify-tls list-users

[robin-nitrokey]

Thanks for the report. I agree that the check is not really necessary, but it is part of the auto-generated OpenAPI client so we can’t just remove it. I’m not sure why it uses a different validation than the user creation though. I’ll take a look.

[robin-nitrokey]

@CMon What is your pynitrokey version? I cannot reproduce the issue with v0.11.1 (v0.11.0 should work too):

$ nitropy nethsm --host nethsmdemo.nitrokey.com --username admin --password adminadmin list-users
Command line tool to interact with Nitrokey devices 0.11.1
Users on NetHSM nethsmdemo.nitrokey.com:

User ID            	Real name	Role
-------------------	---------	-------------
Development~n-admin	name     	Operator
admin              	admin    	Administrator

Support for dashes in IDs was added in NetHSM v3, and support for NetHSM v3 was added in pynitrokey v0.11, so older versions will not work.

[SebastianHuettersen]

Hey @robin-nitrokey,

I had the same error with pynitrokey 0.10.0. After updating to 0.11.2, it was possible to display users with -.