Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

If ASK_PASSWORD Recovery Scenario, Update Thread Local Properties Specifying the Flow is Password Set #823

Closed
wants to merge 5 commits into from
Closed

If ASK_PASSWORD Recovery Scenario, Update Thread Local Properties Specifying the Flow is Password Set #823

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
21dc981
If recovery scenario is ASK_PASSWORD, update thread local properties …
dhaura May 31, 2024
0757aa6
Remove PasswordSetFlow from local thread properties.
dhaura Jun 3, 2024
de1c7a9
Improve code formatting.
dhaura Jun 3, 2024
66219ce
Make clearance of PASSWORD_SET_FLOW thread local property more fine-g…
dhaura Jun 3, 2024
4d87d00
Clear ADMIN_INITIATED thread local property.
dhaura Jun 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion .../java/org/wso2/carbon/identity/recovery/password/NotificationPasswordRecoveryManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -589,7 +589,6 @@ public void updatePassword(String code, String confirmationCode, String password
public User updateUserPassword(String code, String password, Property[] properties)
throws IdentityRecoveryException, IdentityEventException {


UserRecoveryDataStore userRecoveryDataStore = JDBCRecoveryDataStore.getInstance();
UserRecoveryData userRecoveryData;
try {
Expand Down Expand Up @@ -884,6 +883,9 @@ private void updateNewPassword(User user, String password, String domainQualifie
+ "for the user: " + domainQualifiedName, e);
}
throw Utils.handleServerException(IdentityRecoveryConstants.ErrorMessages.ERROR_CODE_UNEXPECTED, null, e);
} finally {
IdentityUtil.threadLocalProperties.get().remove(AccountConstants.ADMIN_INITIATED);
IdentityUtil.threadLocalProperties.get().remove(AccountConstants.PASSWORD_SET_FLOW);
}
}

Expand Down Expand Up @@ -935,6 +937,14 @@ private HashMap<String, String> getAccountStateClaims(UserRecoveryData userRecov
userClaims.put(IdentityRecoveryConstants.ACCOUNT_LOCKED_CLAIM, Boolean.FALSE.toString());
}

// If the recovery scenario is ASK_PASSWORD, it indicates a password set flow.
// Hence, update the thread-local properties to specify that this is a password set flow.
if (RecoveryScenarios.ASK_PASSWORD.equals(recoveryScenario)) {
IdentityUtil.threadLocalProperties.get().put(AccountConstants.PASSWORD_SET_FLOW, true);
} else {
IdentityUtil.threadLocalProperties.get().put(AccountConstants.PASSWORD_SET_FLOW, false);
Comment on lines +942 to +945
Copy link
Contributor

@AnuradhaSK AnuradhaSK Jun 2, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can't see any place where clearing the threadlocal properties. (If using thread local need to clear them at a proper place)
Since threadlocal usage is bit unsafe can we go with adding a runtime claim to userClaims list and get it should in the account lock handler?
I hope we can go with a runtime claim which is not actually registered into the claims of the tenant.

Copy link
Contributor Author

@dhaura dhaura Jun 3, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since user claims are not passed from governance to account lock handler event, it is not possible to add a temporary runtime claim from here. Therefore, the runtime claim should have to be updated and read through the userstore manager. Since this PASSWORD_SET_FLOW relates to a specific user flow (and not the user), if such a user claim is used, another flow (ex: password reset flow) might incorrectly read the said user claim. Therefore, it seems like thread local property solution is the on way to achieve this objective.

Furthermore, the clearance of the introduced thread local property is addressed by 0757aa6, de1c7a9 and 66219ce.

}

// If the scenario is initiated by the admin, set the account locked claim to FALSE.
if (RecoveryScenarios.ADMIN_FORCED_PASSWORD_RESET_VIA_EMAIL_LINK.equals(recoveryScenario)
|| RecoveryScenarios.ADMIN_FORCED_PASSWORD_RESET_VIA_OTP.equals(recoveryScenario)
Expand Down
2 changes: 1 addition & 1 deletion pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -700,7 +700,7 @@
</carbon.identity.framework.imp.pkg.version.range>

<!--Carbon Identity Extension Versions-->
<carbon.identity.account.lock.handler.version>1.9.4</carbon.identity.account.lock.handler.version>
<carbon.identity.account.lock.handler.version>1.9.5</carbon.identity.account.lock.handler.version>
<carbon.identity.account.lock.handler.imp.pkg.version.range>[1.1.12, 2.0.0)
</carbon.identity.account.lock.handler.imp.pkg.version.range>

Expand Down
Loading