search

FusionAuth / fusionauth-issues

FusionAuth issue submission project
https://fusionauth.io
91 stars 12 forks source link

FusionAuth Admin UI password change does not respect `rehashPasswordOnUserUpdate` tenant level password policy #2932

Open jobannon opened 1 day ago

jobannon commented 1 day ago

Description

In specific cases, Admin UI does not allow for an "encryptionScheme" change on password update when setting rehashPasswordOnUserUpdate on the tenant.

Observed versions

1.53.3

Affects versions

The version, or versions where this bug exists. If you do not know, please leave blank for now.

Steps to reproduce

Steps to reproduce the behavior:

  1. Update the encryption scheme on the tenant and set rehashPasswordOnUserUpdate to true

    image

  2. Find a user with a different encryption scheme (this could be a custom encryptor or just another encryption scheme that the user was created with)

  3. Update the user in the Admin UI (Users > User > Edit > Update password in Admin UI)

    image

  4. Check the user and see that their encryption scheme does not update per the policy on the tenant from step one

Expected behavior

If a user updates their password via an administrative action in the Admin UI then the encryption scheme should update if configured on the tenant to do so.

Screenshots

If applicable, add screenshots to help explain your problem. Delete this section if it is not applicable.

Platform

(Please complete the following information)

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

Additional context

Workarounds - Administratively Updating a user's password

1️⃣ If you need to update the user's encryption scheme based on a password update, you can do this via the user API: 

curl --request PATCH \
  --url https://local.fusionauth.io/api/user/00000000-0000-0000-0000-000000000001 \
  --header 'Content-Type: application/json' \
  --header 'X-FusionAuth-TenantId: 30663132-6464-6665-3032-326466613934' \
  --header 'authorization: asdfasdfasdfasdf' \
  --data '{
    "user": {
    "password": "password2"

}}'

2️⃣ Additionally, you can set Require user to change password on next login which will also respect the rehashPasswordOnUserUpdate value when updating the password in the Admin UI

image

Workarounds - User Facing Password Update workflows

User facing workflows (forgot password workflow from our hosted pages, self service account management) will also respect the rehashPasswordOnUserUpdate value when updating the password. No action needed.

robotdan commented 1 day ago

Internal: