Hide rule-based password expiry for users missing required scopes #7224

PasinduYeshan · 2024-12-19T05:36:10Z

Purpose

The initial plan was to modify the token issuance logic to include these missing scopes in the console user token. However, this approach was revised. Instead of requiring these scopes, we decided to hide rule-based password expiry functionality for users without these permissions.

Screen.Recording.2024-12-19.at.10.13.58.mov

Related Issues

[IS-7.1 Migration] Rule-based password expiry feature product-is#21041

Related PRs

Remove roles and groups view scope check from login and registrations carbon-identity-framework#6218

Checklist

e2e cypress tests locally verified. (for internal contributers)
Manual test round performed and verified.
UX/UI review done on the final implementation.
Documentation provided. (Add links if there are any)
Relevant backend changes deployed and verified
Unit tests provided. (Add links if there are any)
Integration tests provided. (Add links if there are any)

Security checks

Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines
Ran FindSecurityBugs plugin and verified report
Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets

…sed-password-expiry

wso2-jenkins-bot · 2024-12-19T05:36:40Z

🦋 Changeset detected

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

codecov · 2024-12-19T05:46:48Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 32.32%. Comparing base (332755b) to head (36632b6).
Report is 347 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #7224   +/-   ##
=======================================
  Coverage   32.32%   32.32%           
=======================================
  Files          42       42           
  Lines         897      897           
  Branches      221      204   -17     
=======================================
  Hits          290      290           
  Misses        607      607

Flag	Coverage Δ
@wso2is/core	`32.32% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

apps/console/src/public/deployment.config.json

pavinduLakshan · 2024-12-20T07:43:23Z

features/admin.validation.v1/constants/validation-config-constants.ts

+     * These scopes are checked to determine whether to display the new rule-based password expiry configuration UI.
+     * If these scopes are not available, legacy password expiry configuration will be shown for backward compatibility.
+     */
+    public static readonly RULE_BASED_PASSWORD_EXPIRY_REQUIRED_SCOPES: string[] = [


Let's add a new feature object for this in the deployment config instead, so that deployment config would be the single source for maintaining scopes on the frontend

pavinduLakshan · 2024-12-20T07:44:17Z

features/admin.validation.v1/pages/validation-config-edit.tsx

@@ -137,6 +136,10 @@ export const ValidationConfigEditPage: FunctionComponent<MyAccountSettingsEditPa
    const [ legacyPasswordPolicies, setLegacyPasswordPolicies ] = useState<ConnectorPropertyInterface[]>([]);

    const isReadOnly: boolean = !useRequiredScopes(featureConfig?.governanceConnectors?.scopes?.update);
+    const hasScopesForRuleBasedPasswordExpiry: boolean =


Let's follow the convention.

Suggested change

const hasScopesForRuleBasedPasswordExpiry: boolean =

const hasRuleBasedPasswordExpiryReadPermissions: boolean =

pavinduLakshan · 2024-12-20T07:47:00Z

features/admin.validation.v1/pages/validation-config-edit.tsx

@@ -137,6 +136,10 @@ export const ValidationConfigEditPage: FunctionComponent<MyAccountSettingsEditPa
    const [ legacyPasswordPolicies, setLegacyPasswordPolicies ] = useState<ConnectorPropertyInterface[]>([]);

    const isReadOnly: boolean = !useRequiredScopes(featureConfig?.governanceConnectors?.scopes?.update);
+    const hasScopesForRuleBasedPasswordExpiry: boolean =
+        useRequiredScopes(ValidationConfigConstants.RULE_BASED_PASSWORD_EXPIRY_REQUIRED_SCOPES);
+    const isRuleBasedPasswordExpiryDisabled: boolean = disabledFeatures?.includes("ruleBasedPasswordExpiry")


Let's add "ruleBasedPasswordExpiry" string to the feature dictionary and use the constant here.

Ref. impl:

identity-apps/features/admin.applications.v1/constants/application-management.ts

Lines 70 to 88 in c3dc6bf

public static readonly FEATURE_DICTIONARY: Map<string, string> = new Map<string, string>()

.set("APPLICATION_ADD", "application.add")

.set("APPLICATION_EDIT", "application.edit")

.set("APPLICATION_EDIT_GENERAL_SETTINGS", "application.edit.generalSettings")

.set("APPLICATION_EDIT_ACCESS_CONFIG", "applications.edit.accessConfiguration")

.set("APPLICATION_EDIT_ATTRIBUTE_MAPPING", "applications.edit.attributeMapping")

.set("APPLICATION_EDIT_SIGN_ON_METHOD_CONFIG", "applications.edit.signOnMethodConfiguration")

.set("APPLICATION_EDIT_PROVISIONING_SETTINGS", "applications.edit.provisioningSettings")

.set("APPLICATION_EDIT_ADVANCED_SETTINGS", "applications.edit.advancedSettings")

.set("APPLICATION_SHARED_ACCESS", "applications.edit.sharedAccess")

.set("APPLICATION_EDIT_INFO", "applications.edit.info")

.set("FAPI_APP_CREATION", "applications.create.fapi")

.set("APPLICATION_NATIVE_AUTHENTICATION", "applications.native.authentication")

.set("APPLICATION_MYACCOUNT_SAAS_SETTINGS", "applications.myaccount.saasMyaccountSettings")

.set("APPLICATION_ADD_MANAGEMENT_APPLICATIONS", "applications.add.managementApplications")

.set("APPLICATIONS_SETTINGS", "applications.settings")

.set("TRUSTED_APPS", "applications.trustedApps")

.set("APPLICATION_ACCESSTOKEN_ATTRIBUTES", "applications.accessTokenAttributes")

.set("APPLICATION_OUTDATED_APP_BANNER", "applications.outdatedAppBanner");

pavinduLakshan · 2024-12-20T07:49:42Z

features/admin.validation.v1/pages/validation-config-edit.tsx

+        if (!isRuleBasedPasswordExpiryDisabled) {
+            processedFormValues = {
+                ...values,
+                passwordExpiryEnabled: passwordExpiryEnabled,


This is already added in L608, isn't it?

pavinduLakshan · 2024-12-20T07:50:33Z

features/admin.validation.v1/pages/validation-config-edit.tsx

@@ -600,14 +603,21 @@ export const ValidationConfigEditPage: FunctionComponent<MyAccountSettingsEditPa
    ): void => {
        if (hasPasswordExpiryRuleErrors) return;

-        const processedFormValues: ValidationFormInterface = {
+        let processedFormValues: ValidationFormInterface = {


We can keep this const and add new object properties.

const obj = {
a: "b",
c: "d"
}

obj.e = "f"

PasinduYeshan added 3 commits December 18, 2024 15:41

Disable rule based password expiry for users missing required scopes

2248420

Fix handle update method

1d32c9f

Merge remote-tracking branch 'upstream/master' into migration/rule-ba…

36632b6

…sed-password-expiry

pavinduLakshan reviewed Dec 20, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Hide rule-based password expiry for users missing required scopes #7224

Hide rule-based password expiry for users missing required scopes #7224

PasinduYeshan commented Dec 19, 2024

wso2-jenkins-bot commented Dec 19, 2024

codecov bot commented Dec 19, 2024

pavinduLakshan Dec 20, 2024 •

edited

Loading

pavinduLakshan Dec 20, 2024

pavinduLakshan Dec 20, 2024 •

edited

Loading

pavinduLakshan Dec 20, 2024

pavinduLakshan Dec 20, 2024

	const hasScopesForRuleBasedPasswordExpiry: boolean =
	const hasRuleBasedPasswordExpiryReadPermissions: boolean =

	public static readonly FEATURE_DICTIONARY: Map<string, string> = new Map<string, string>()
	.set("APPLICATION_ADD", "application.add")
	.set("APPLICATION_EDIT", "application.edit")
	.set("APPLICATION_EDIT_GENERAL_SETTINGS", "application.edit.generalSettings")
	.set("APPLICATION_EDIT_ACCESS_CONFIG", "applications.edit.accessConfiguration")
	.set("APPLICATION_EDIT_ATTRIBUTE_MAPPING", "applications.edit.attributeMapping")
	.set("APPLICATION_EDIT_SIGN_ON_METHOD_CONFIG", "applications.edit.signOnMethodConfiguration")
	.set("APPLICATION_EDIT_PROVISIONING_SETTINGS", "applications.edit.provisioningSettings")
	.set("APPLICATION_EDIT_ADVANCED_SETTINGS", "applications.edit.advancedSettings")
	.set("APPLICATION_SHARED_ACCESS", "applications.edit.sharedAccess")
	.set("APPLICATION_EDIT_INFO", "applications.edit.info")
	.set("FAPI_APP_CREATION", "applications.create.fapi")
	.set("APPLICATION_NATIVE_AUTHENTICATION", "applications.native.authentication")
	.set("APPLICATION_MYACCOUNT_SAAS_SETTINGS", "applications.myaccount.saasMyaccountSettings")
	.set("APPLICATION_ADD_MANAGEMENT_APPLICATIONS", "applications.add.managementApplications")
	.set("APPLICATIONS_SETTINGS", "applications.settings")
	.set("TRUSTED_APPS", "applications.trustedApps")
	.set("APPLICATION_ACCESSTOKEN_ATTRIBUTES", "applications.accessTokenAttributes")
	.set("APPLICATION_OUTDATED_APP_BANNER", "applications.outdatedAppBanner");

Hide rule-based password expiry for users missing required scopes #7224

Are you sure you want to change the base?

Hide rule-based password expiry for users missing required scopes #7224

Conversation

PasinduYeshan commented Dec 19, 2024

Purpose

Related Issues

Related PRs

Checklist

Security checks

wso2-jenkins-bot commented Dec 19, 2024

🦋 Changeset detected

codecov bot commented Dec 19, 2024

Codecov Report

pavinduLakshan Dec 20, 2024 • edited Loading

Choose a reason for hiding this comment

pavinduLakshan Dec 20, 2024

Choose a reason for hiding this comment

pavinduLakshan Dec 20, 2024 • edited Loading

Choose a reason for hiding this comment

pavinduLakshan Dec 20, 2024

Choose a reason for hiding this comment

pavinduLakshan Dec 20, 2024

Choose a reason for hiding this comment

pavinduLakshan Dec 20, 2024 •

edited

Loading

pavinduLakshan Dec 20, 2024 •

edited

Loading