While updating password how to check current password?

[shreeharsha-factly]

While updating passwords how to validate identity's current password. If someone who has access to the logged-in account can directly change the password. Is there a way so that I can check the current password then allow identity to change the password?

[aeneasr]

We have implemented this - check https://www.ory.sh/kratos/docs/concepts/session/#privileged-sessions :)

[jonnyijapan]

May I ask, what is the flow to update a user's password? I have been looking at the guides and API docs for awhile but can only find this method (I am using the Go SDK mainly):

resp, r, err := apiClient.V0alpha2Api.AdminUpdateIdentity(context.Background(), id).AdminUpdateIdentityBody(adminUpdateIdentityBody).Execute()

I think this method can only update traits, and not credentials, am I right?

I'm preferably interested in doing this with admin APIs. If there is no such way, it might be OK to use the selfservice SDK/API as well - I'll need to do this from the backend however. And BTW I expect that this should be different from the recovery flows. I am expecting a logged in user to be able to send a change password request to our web server which in turns in the backend sends a request to Kratos to update the password. Is this not possible?

[jonnyijapan]

Nevermind, I found out how to do it from this page https://www.ory.sh/docs/kratos/self-service/flows/user-settings#code-examples-for-nodejs-reactjs-go- and I could also use the selfservice API flow from the backend - it seems to work well - minding the privileged_session_max_age limit.

[PrimeDominus]

@aeneasr But is there any way to confirm the user's current password before we initialise the settings flow? Consider the scenario where a user is logged into their authenticated web dashboard and the session is active, and that user walks away from their desk, meanwhile someone else goes to their desk and changes the password. From what I understand from the docs, there is nothing stopping this other malicious user from changing the password, as only an active valid session is required.

By having pre-requisite checks such as checking the current valid password or an OTP verification flow prior to initialising the settings flow we can prevent the above scenario. I don't see anything in the Ory docs or API explaining how to do this.

Am I misunderstanding something? Is there a way to do this? Or, can you recommend a better way?

[PrimeDominus]

Just adding that I got a reply on Slack, and now I understand that when initialising settings flow, it checks if the current session is older than privileged_session_max_age and if it is, then it redirects the user to login again. Cool... it's built-in. Thanks.