apache / apache/cloudstack

password change for former SAML user not working

Open
#12,015 4 comments 0 reactions 0 assignees View on GitHub
long-term-plan
Dominant language
Java
Stars
3.1k
Forks
1.4k
Avg merge
6d 19h
Merged PRs (30d)
32

Description

### problem

As an admin I'm able to reset password for a regular user without problems.
If SAML has been enabled for that user this is no longer possible within CloudStack. Expected behavior.
Once I disable SAML for that user I would expect that I'm able to change the password again. That is not the case and the error below will appear.

Image

Image

### versions

ACS 4.20.1

### The steps to reproduce the bug

1. run all steps as admin
2. create a user
3. reset the password for that user
4. enable SAML (needs to be configured before) for this user
5. try to reset the password (will fail)
6. disable SAML for this user
7. try to reset the password (should work?) will fail
...

### What to do about it?

Enable the possibility to change the password for a former SAML user.

Contributor guide

Open the contributing guide

Research direction

Reproduce the admin password-reset flow in CloudStack 4.20.1: create a user, enable SAML, disable it, and retry the reset. Trace the password-change entry point and the user's SAML state; done means an administrator can reset the password after SAML is disabled without the reported error.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.