hcengineering / hcengineering/platform
🐛 Bug: Credential confirmation and password change still active with SSO enabled
- Dominant language
- TypeScript
- Stars
- 27.7k
- Forks
- 2.2k
- PR merge metrics
- No merged PRs in 30d
Description
### Description
We have deployed **Huly** in a corporate environment with **SSO authentication via EntraID (Azure AD)**.
The SSO integration works correctly for login, but we’ve found issues in the **Controlled Documents** module and the **user settings** section.
---
### 1. Controlled Documents Module
When attempting to submit a document for review, the system prompts for **email and password confirmation** before submission.
However, with SSO enabled, users **do not have a local password**, which makes it impossible to proceed with this action.
The modal should:
* Detect that the user is authenticated via SSO.
* Skip password confirmation or use an alternative verification method (e.g., re-authentication with the SSO provider or a valid token check).
**Expected behavior:**
If SSO is enabled, the system should **not request local credentials**.
Verification should be handled by the identity provider (SSO).
---
### 2. Change Password Option
Under **Settings → Change password**, the option to change a local password is still displayed, even when all users authenticate exclusively via SSO.
This option should be **hidden or disabled** when `HIDE_LOCAL_LOGIN=true`, since in a full SSO environment, local password management no longer applies or makes sense.
---
### 🔍 Steps to Reproduce
1. Deploy Huly with EntraID (SSO) integration enabled.
2. Log in using an SSO user (no local credentials).
3. Go to **Settings → Change password** and notice that the change password form is still visible.
---
### 🧩 Expected Behavior
* When local password login is disabled:
* The system should not request local credentials for any operation.
* The **Change password** option should be hidden or disabled.
* The system should rely entirely on the SSO authentication mechanism for revalidation.
---
### ⚙️ Environment Variables
**Frontend:**
```env
HIDE_LOCAL_LOGIN=true
DISABLE_SIGNUP=true
```
**Account service:**
```env
DISABLE_SIGNUP=true
```
---
### 🧠 Environment Details
* **Huly version:** v0.7.266
* **Environment:** Self-hosted / Corporate
* **Authentication:** EntraID (Azure AD) via SSO
* **Local login:** Disabled
* **Sign-up:** Disabled
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.