Allow enforcing password change for a user after reset by admin (root/domain) #12294

sudo87 · 2025-12-18T11:04:55Z

Description

This PR introduces enforcement of password changes for users upon login after an admin-initiated reset.

API changes:

A boolean param "passwordChangeRequired" is introduced in UpdateUserCmd
It is applicable only for normal user role, admin or domain admin are excluded
Row with name="PasswordChangeRequired" gets added into user_details table
passwordchangerequired: true in loginresponse for when login is invoked
UserAccount gets a new field passwordchangerequired
ListApis response contains limited APIs for user, who are required to change password
[ "login", "logout", "updateUser", "listUsers", "listApis" ]

UI

New route /user/forceChangePassword
Guard check for passwordchangerequired and no apis request other than listUser
ForceChangePassword component

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

Screen.Recording.2025-12-18.at.4.11.45.PM.mov

How Has This Been Tested?

How did you try to break this feature and the system with this change?

… in UI to render reset password form

codecov · 2025-12-18T11:13:10Z

Codecov Report

❌ Patch coverage is 23.07692% with 40 lines in your changes missing coverage. Please review.
✅ Project coverage is 17.49%. Comparing base (f417c6b) to head (71b7b81).
⚠️ Report is 27 commits behind head on main.

Files with missing lines	Patch %	Lines
server/src/main/java/com/cloud/api/ApiServer.java	0.00%	7 Missing ⚠️
...c/main/java/com/cloud/user/AccountManagerImpl.java	41.66%	3 Missing and 4 partials ⚠️
...oudstack/api/command/admin/user/UpdateUserCmd.java	0.00%	6 Missing ⚠️
...ache/cloudstack/api/response/LoginCmdResponse.java	0.00%	6 Missing ⚠️
...g/apache/cloudstack/api/response/UserResponse.java	0.00%	6 Missing ⚠️
.../cloudstack/discovery/ApiDiscoveryServiceImpl.java	70.00%	1 Missing and 2 partials ⚠️
...java/com/cloud/api/query/vo/UserAccountJoinVO.java	0.00%	3 Missing ⚠️
...om/cloud/api/query/dao/UserAccountJoinDaoImpl.java	0.00%	1 Missing ⚠️
.../cloudstack/user/UserPasswordResetManagerImpl.java	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #12294      +/-   ##
============================================
+ Coverage     17.46%   17.49%   +0.03%     
- Complexity    15516    15569      +53     
============================================
  Files          5913     5915       +2     
  Lines        529385   529767     +382     
  Branches      64679    64701      +22     
============================================
+ Hits          92448    92708     +260     
- Misses       426518   426603      +85     
- Partials      10419    10456      +37

Flag	Coverage Δ
uitests	`3.57% <ø> (-0.01%)`	⬇️
unittests	`18.56% <23.07%> (+0.04%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

sudo87 · 2025-12-18T11:33:30Z

@blueorangutan package

blueorangutan · 2025-12-18T11:34:04Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-12-18T11:35:16Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 16086

Copilot

Pull request overview

This PR implements a feature to enforce password changes for normal users after an admin-initiated password reset. When an admin resets a user's password, they can require the user to change it upon next login. The user is then redirected to a forced password change page and has limited API access until the password is updated.

Key Changes:

Added passwordChangeRequired boolean parameter to the updateUser API command, allowing admins to flag users for mandatory password change
Introduced a new UI route /user/forceChangePassword with a dedicated component that restricts users to password change until completed
Implemented navigation guards and API restrictions to limit users to essential APIs (login, logout, updateUser, listUsers, listApis) when password change is required

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
`ui/src/views/iam/ForceChangePassword.vue`	New component for forced password change page with form validation and success state
`ui/src/views/iam/ChangeUserPassword.vue`	Added checkbox for admins to require password change on next login
`ui/src/store/mutation-types.js`	Added PASSWORD_CHANGE_REQUIRED constant for state management
`ui/src/store/modules/user.js`	Added state and mutations for password change requirement flag, loads user info with limited APIs when flag is set
`ui/src/store/getters.js`	Added getter for passwordChangeRequired state
`ui/src/permission.js`	Added navigation guards to redirect users to force change password page when required
`ui/src/config/router.js`	Registered new forceChangePassword route under user path
`ui/public/locales/en.json`	Added localization strings for password change UI
`server/src/main/java/com/cloud/user/AccountManagerImpl.java`	Added logic to set/remove passwordChangeRequired user detail, loads user details during authentication
`server/src/main/java/com/cloud/api/query/vo/UserAccountJoinVO.java`	Added passwordChangeRequired field to join view object
`server/src/main/java/com/cloud/api/query/dao/UserAccountJoinDaoImpl.java`	Maps passwordChangeRequired to user response
`server/src/main/java/com/cloud/api/ApiServer.java`	Sets passwordChangeRequired in login session when user detail is present
`plugins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java`	Restricts API list to essential APIs when user requires password change
`plugins/api/discovery/src/test/java/org/apache/cloudstack/discovery/ApiDiscoveryTest.java`	Updated test setup to mock getUserAccountById method
`engine/schema/src/main/resources/META-INF/db/views/cloud.user_view.sql`	Added LEFT JOIN to user_details table for PasswordChangeRequired value
`engine/schema/src/main/java/org/apache/cloudstack/resourcedetail/UserDetailVO.java`	Added PasswordChangeRequired constant
`api/src/main/java/org/apache/cloudstack/api/response/UserResponse.java`	Added passwordChangeRequired field to user API response
`api/src/main/java/org/apache/cloudstack/api/response/LoginCmdResponse.java`	Added passwordChangeRequired field to login API response
`api/src/main/java/org/apache/cloudstack/api/command/admin/user/UpdateUserCmd.java`	Added passwordChangeRequired parameter to update user command
`api/src/main/java/org/apache/cloudstack/api/ApiConstants.java`	Added PASSWORD_CHANGE_REQUIRED API constant

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

ui/src/views/iam/ForceChangePassword.vue

server/src/main/java/com/cloud/user/AccountManagerImpl.java

ui/src/views/iam/ForceChangePassword.vue

api/src/main/java/org/apache/cloudstack/api/response/UserResponse.java

...ins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java

api/src/main/java/org/apache/cloudstack/api/response/UserResponse.java

api/src/main/java/org/apache/cloudstack/api/response/LoginCmdResponse.java

server/src/main/java/com/cloud/api/ApiServer.java

ui/src/views/iam/ChangeUserPassword.vue

...ins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java

sudo87 · 2025-12-19T04:32:45Z

@blueorangutan package

blueorangutan · 2025-12-19T04:34:04Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-12-19T05:21:39Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 16095

sudo87 · 2025-12-19T06:45:41Z

@blueorangutan package

blueorangutan · 2025-12-19T06:48:03Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-12-19T06:48:59Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 16097

…wd flow for passwordchangerequired

api/src/main/java/org/apache/cloudstack/api/response/UserResponse.java

...ins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java

Copilot

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 17 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

ui/src/views/iam/ChangeUserPassword.vue

Copilot · 2025-12-19T08:53:57Z

plugins/api/discovery/src/test/java/org/apache/cloudstack/discovery/ApiDiscoveryTest.java

    @Before
    public void setup() {
        discoveryServiceSpy.s_apiNameDiscoveryResponseMap = apiNameDiscoveryResponseMapMock;
        discoveryServiceSpy._apiAccessCheckers = apiAccessCheckersMock;

        Mockito.when(discoveryServiceSpy._apiAccessCheckers.iterator()).thenReturn(Arrays.asList(apiCheckerMock).iterator());
+        Mockito.when(mockUserAccount.getDetails()).thenReturn(null);
+        Mockito.when(accountServiceMock.getUserAccountById(anyLong())).thenReturn(mockUserAccount);
    }


The test setup mocks getUserAccountById to return null for user details, but there's no test case that verifies the new password change required functionality. The new logic in ApiDiscoveryServiceImpl that restricts APIs when passwordchangerequired is true is not covered by any test. Consider adding test cases for: 1) user with passwordchangerequired=true should only get limited APIs, and 2) user with passwordchangerequired=false should follow normal flow.

Copilot · 2025-12-19T08:53:57Z

server/src/main/java/com/cloud/user/AccountManagerImpl.java

+    private void updatePasswordChangeRequired(User caller, UpdateUserCmd updateUserCmd, UserVO user) {
+        if (StringUtils.isNotBlank(updateUserCmd.getPassword())) {
+            boolean isCallerSameAsUser = user.getId() == caller.getId();
+            boolean isPasswordResetRequired = updateUserCmd.isPasswordChangeRequired() && !isCallerSameAsUser;
+            // Admins only can enforce passwordChangeRequired for user
+            if ((isRootAdmin(caller.getAccountId()) || isDomainAdmin(caller.getAccountId()))) {
+                if (isPasswordResetRequired) {
+                    _userDetailsDao.addDetail(user.getId(), PasswordChangeRequired, "true", false);
+                }
+            }
+
+            // Remove passwordChangeRequired if user updating own pwd or admin has not enforced it
+            if (isCallerSameAsUser || !isPasswordResetRequired) {
+                _userDetailsDao.removeDetail(user.getId(), PasswordChangeRequired);
+            }
+        }
+    }


The new updatePasswordChangeRequired method and its logic for handling passwordchangerequired parameter are not covered by any test cases. Consider adding tests to verify: 1) password change required is set when admin changes user password with the flag, 2) flag is removed when user changes own password, 3) flag is removed when admin changes password without the flag, and 4) admins cannot set the flag for themselves or other admins.

ui/src/views/iam/ForceChangePassword.vue

ui/src/store/modules/user.js

ui/src/views/iam/ForceChangePassword.vue

...ins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java

server/src/main/java/com/cloud/user/AccountManagerImpl.java

sudo87 · 2025-12-19T12:49:53Z

@blueorangutan package

blueorangutan · 2025-12-19T12:52:04Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-12-19T14:06:38Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16106

sudo87 added 4 commits December 15, 2025 18:04

API modifications for passwordchangerequired

a00dd71

ui login flow for passwordchangerequired

ea92759

add passwordchangerequired in listUsers API response, it will be used…

555b69b

… in UI to render reset password form

cleanup redundant LOGIN_SOURCE and limiting apis for first time login

10225ed

boring-cyborg bot added component:api component:UI labels Dec 18, 2025

sudo87 requested a review from vishesh92 December 18, 2025 11:05

vishesh92 requested a review from Copilot December 18, 2025 11:35

Copilot started reviewing on behalf of vishesh92 December 18, 2025 11:35 View session

Copilot AI reviewed Dec 18, 2025

View reviewed changes

address copilot comments

c7e48b7

allow enforcing password change for all role types and update reset p…

95cba29

…wd flow for passwordchangerequired

sudo87 changed the title ~~Force password change for normal user once admin reset it~~ Allow enforcing password change for a user after reset by admin (root/domain) Dec 19, 2025

vishesh92 requested a review from Copilot December 19, 2025 08:36

Copilot started reviewing on behalf of vishesh92 December 19, 2025 08:37 View session

vishesh92 reviewed Dec 19, 2025

View reviewed changes

Copilot AI reviewed Dec 19, 2025

View reviewed changes

address review comments

71b7b81

Allow enforcing password change for a user after reset by admin (root/domain) #12294

Are you sure you want to change the base?

Allow enforcing password change for a user after reset by admin (root/domain) #12294

Uh oh!

Conversation

sudo87 commented Dec 18, 2025

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

codecov bot commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

sudo87 commented Dec 18, 2025

Uh oh!

blueorangutan commented Dec 18, 2025

Uh oh!

blueorangutan commented Dec 18, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sudo87 commented Dec 19, 2025

Uh oh!

blueorangutan commented Dec 19, 2025

Uh oh!

blueorangutan commented Dec 19, 2025

Uh oh!

sudo87 commented Dec 19, 2025

Uh oh!

blueorangutan commented Dec 19, 2025

Uh oh!

blueorangutan commented Dec 19, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sudo87 commented Dec 19, 2025

Uh oh!

blueorangutan commented Dec 19, 2025

Uh oh!

blueorangutan commented Dec 19, 2025

Uh oh!

Reviewers

codecov bot commented Dec 18, 2025 •

edited

Loading