Allow enforcing password change for a user after reset by admin (root/domain) #12294

sudo87 · 2025-12-18T11:04:55Z

Description

This PR introduces enforcement of password changes for users upon login after an admin-initiated reset.

API changes:

A boolean param "passwordChangeRequired" is introduced in UpdateUserCmd
It is applicable only for normal user role, admin or domain admin are excluded
Row with name="PasswordChangeRequired" gets added into user_details table
passwordchangerequired: true in loginresponse for when login is invoked
UserAccount gets a new field passwordchangerequired
ListApis response contains limited APIs for user, who are required to change password
[ "login", "logout", "updateUser", "listUsers", "listApis" ]

UI

New route /user/forceChangePassword
Guard check for passwordchangerequired and no apis request other than listUser
ForceChangePassword component

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

Screen.Recording.2025-12-18.at.4.11.45.PM.mov

How Has This Been Tested?

How did you try to break this feature and the system with this change?

… in UI to render reset password form

codecov · 2025-12-18T11:13:10Z

Codecov Report

❌ Patch coverage is 40.00000% with 24 lines in your changes missing coverage. Please review.
✅ Project coverage is 17.51%. Comparing base (f417c6b) to head (1fb241b).
⚠️ Report is 44 commits behind head on main.

Files with missing lines	Patch %	Lines
server/src/main/java/com/cloud/api/ApiServer.java	0.00%	7 Missing ⚠️
...ache/cloudstack/api/response/LoginCmdResponse.java	0.00%	6 Missing ⚠️
...c/main/java/com/cloud/user/AccountManagerImpl.java	50.00%	1 Missing and 5 partials ⚠️
...oudstack/api/command/admin/user/UpdateUserCmd.java	0.00%	3 Missing ⚠️
.../cloudstack/discovery/ApiDiscoveryServiceImpl.java	90.90%	0 Missing and 1 partial ⚠️
.../cloudstack/user/UserPasswordResetManagerImpl.java	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #12294      +/-   ##
============================================
+ Coverage     17.46%   17.51%   +0.05%     
- Complexity    15516    15595      +79     
============================================
  Files          5913     5915       +2     
  Lines        529385   529981     +596     
  Branches      64679    64737      +58     
============================================
+ Hits          92448    92821     +373     
- Misses       426518   426700     +182     
- Partials      10419    10460      +41

Flag	Coverage Δ
uitests	`3.57% <ø> (-0.02%)`	⬇️
unittests	`18.58% <40.00%> (+0.05%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

sudo87 · 2025-12-18T11:33:30Z

@blueorangutan package

blueorangutan · 2025-12-18T11:34:04Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-12-18T11:35:16Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 16086

Copilot

Pull request overview

This PR implements a feature to enforce password changes for normal users after an admin-initiated password reset. When an admin resets a user's password, they can require the user to change it upon next login. The user is then redirected to a forced password change page and has limited API access until the password is updated.

Key Changes:

Added passwordChangeRequired boolean parameter to the updateUser API command, allowing admins to flag users for mandatory password change
Introduced a new UI route /user/forceChangePassword with a dedicated component that restricts users to password change until completed
Implemented navigation guards and API restrictions to limit users to essential APIs (login, logout, updateUser, listUsers, listApis) when password change is required

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
`ui/src/views/iam/ForceChangePassword.vue`	New component for forced password change page with form validation and success state
`ui/src/views/iam/ChangeUserPassword.vue`	Added checkbox for admins to require password change on next login
`ui/src/store/mutation-types.js`	Added PASSWORD_CHANGE_REQUIRED constant for state management
`ui/src/store/modules/user.js`	Added state and mutations for password change requirement flag, loads user info with limited APIs when flag is set
`ui/src/store/getters.js`	Added getter for passwordChangeRequired state
`ui/src/permission.js`	Added navigation guards to redirect users to force change password page when required
`ui/src/config/router.js`	Registered new forceChangePassword route under user path
`ui/public/locales/en.json`	Added localization strings for password change UI
`server/src/main/java/com/cloud/user/AccountManagerImpl.java`	Added logic to set/remove passwordChangeRequired user detail, loads user details during authentication
`server/src/main/java/com/cloud/api/query/vo/UserAccountJoinVO.java`	Added passwordChangeRequired field to join view object
`server/src/main/java/com/cloud/api/query/dao/UserAccountJoinDaoImpl.java`	Maps passwordChangeRequired to user response
`server/src/main/java/com/cloud/api/ApiServer.java`	Sets passwordChangeRequired in login session when user detail is present
`plugins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java`	Restricts API list to essential APIs when user requires password change
`plugins/api/discovery/src/test/java/org/apache/cloudstack/discovery/ApiDiscoveryTest.java`	Updated test setup to mock getUserAccountById method
`engine/schema/src/main/resources/META-INF/db/views/cloud.user_view.sql`	Added LEFT JOIN to user_details table for PasswordChangeRequired value
`engine/schema/src/main/java/org/apache/cloudstack/resourcedetail/UserDetailVO.java`	Added PasswordChangeRequired constant
`api/src/main/java/org/apache/cloudstack/api/response/UserResponse.java`	Added passwordChangeRequired field to user API response
`api/src/main/java/org/apache/cloudstack/api/response/LoginCmdResponse.java`	Added passwordChangeRequired field to login API response
`api/src/main/java/org/apache/cloudstack/api/command/admin/user/UpdateUserCmd.java`	Added passwordChangeRequired parameter to update user command
`api/src/main/java/org/apache/cloudstack/api/ApiConstants.java`	Added PASSWORD_CHANGE_REQUIRED API constant

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

ui/src/views/iam/ForceChangePassword.vue

server/src/main/java/com/cloud/user/AccountManagerImpl.java

ui/src/views/iam/ForceChangePassword.vue

api/src/main/java/org/apache/cloudstack/api/response/UserResponse.java

...ins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java

api/src/main/java/org/apache/cloudstack/api/response/UserResponse.java

api/src/main/java/org/apache/cloudstack/api/response/LoginCmdResponse.java

server/src/main/java/com/cloud/api/ApiServer.java

ui/src/views/iam/ChangeUserPassword.vue

...ins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java

sudo87 · 2025-12-19T04:32:45Z

@blueorangutan package

blueorangutan · 2025-12-19T04:34:04Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-12-19T05:21:39Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 16095

sudo87 · 2025-12-19T06:45:41Z

@blueorangutan package

blueorangutan · 2025-12-19T06:48:03Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-12-19T06:48:59Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 16097

…wd flow for passwordchangerequired

api/src/main/java/org/apache/cloudstack/api/response/UserResponse.java

...ins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java

Copilot

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 17 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

ui/src/views/iam/ChangeUserPassword.vue

plugins/api/discovery/src/test/java/org/apache/cloudstack/discovery/ApiDiscoveryTest.java

server/src/main/java/com/cloud/user/AccountManagerImpl.java

ui/src/views/iam/ForceChangePassword.vue

ui/src/store/modules/user.js

ui/src/views/iam/ForceChangePassword.vue

...ins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java

server/src/main/java/com/cloud/user/AccountManagerImpl.java

sudo87 · 2025-12-19T12:49:53Z

@blueorangutan package

blueorangutan · 2025-12-19T12:52:04Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-12-19T14:06:38Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16106

sudo87 · 2025-12-22T05:08:24Z

@blueorangutan test

blueorangutan · 2025-12-22T05:10:03Z

@sudo87 a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-12-22T20:11:34Z

[SF] Trillian test result (tid-15039)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 51453 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr12294-t15039-kvm-ol8.zip
Smoke tests completed. 149 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_03_deploy_and_scale_kubernetes_cluster	`Failure`	37.17	test_kubernetes_clusters.py

api/src/main/java/org/apache/cloudstack/api/command/admin/user/UpdateUserCmd.java

ui/src/views/iam/ForceChangePassword.vue

ui/src/store/modules/user.js

api/src/main/java/org/apache/cloudstack/api/response/LoginCmdResponse.java

server/src/main/java/com/cloud/user/AccountManagerImpl.java

ui/src/store/modules/user.js

sudo87 · 2025-12-24T08:10:21Z

@blueorangutan package

blueorangutan · 2025-12-24T08:12:05Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

vishesh92

clgtm

blueorangutan · 2025-12-24T09:53:05Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16154

sudo87 added 4 commits December 15, 2025 18:04

API modifications for passwordchangerequired

a00dd71

ui login flow for passwordchangerequired

ea92759

add passwordchangerequired in listUsers API response, it will be used…

555b69b

… in UI to render reset password form

cleanup redundant LOGIN_SOURCE and limiting apis for first time login

10225ed

boring-cyborg bot added component:api component:UI labels Dec 18, 2025

sudo87 requested a review from vishesh92 December 18, 2025 11:05

vishesh92 requested a review from Copilot December 18, 2025 11:35

Copilot started reviewing on behalf of vishesh92 December 18, 2025 11:35 View session

Copilot AI reviewed Dec 18, 2025

View reviewed changes

address copilot comments

c7e48b7

allow enforcing password change for all role types and update reset p…

95cba29

…wd flow for passwordchangerequired

sudo87 changed the title ~~Force password change for normal user once admin reset it~~ Allow enforcing password change for a user after reset by admin (root/domain) Dec 19, 2025

vishesh92 requested a review from Copilot December 19, 2025 08:36

Copilot started reviewing on behalf of vishesh92 December 19, 2025 08:37 View session

vishesh92 reviewed Dec 19, 2025

View reviewed changes

Copilot AI reviewed Dec 19, 2025

View reviewed changes

address review comments

71b7b81

add unit tests

316c454

vishesh92 reviewed Dec 23, 2025

View reviewed changes

api/src/main/java/org/apache/cloudstack/api/command/admin/user/UpdateUserCmd.java Outdated Show resolved Hide resolved

vishesh92 reviewed Dec 23, 2025

View reviewed changes

ui/src/views/iam/ForceChangePassword.vue Show resolved Hide resolved

ui/src/store/modules/user.js Outdated Show resolved Hide resolved

cleanup ispasswordchangerequired from user_view

3364f20

vishesh92 reviewed Dec 24, 2025

View reviewed changes

api/src/main/java/org/apache/cloudstack/api/response/LoginCmdResponse.java Outdated Show resolved Hide resolved

server/src/main/java/com/cloud/user/AccountManagerImpl.java Show resolved Hide resolved

ui/src/store/modules/user.js Outdated Show resolved Hide resolved

address review comments

1fb241b

vishesh92 approved these changes Dec 24, 2025

View reviewed changes

Allow enforcing password change for a user after reset by admin (root/domain) #12294

Are you sure you want to change the base?

Allow enforcing password change for a user after reset by admin (root/domain) #12294

Uh oh!

Conversation

sudo87 commented Dec 18, 2025

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

codecov bot commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

sudo87 commented Dec 18, 2025

Uh oh!

blueorangutan commented Dec 18, 2025

Uh oh!

blueorangutan commented Dec 18, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sudo87 commented Dec 19, 2025

Uh oh!

blueorangutan commented Dec 19, 2025

Uh oh!

blueorangutan commented Dec 19, 2025

Uh oh!

sudo87 commented Dec 19, 2025

Uh oh!

blueorangutan commented Dec 19, 2025

Uh oh!

blueorangutan commented Dec 19, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sudo87 commented Dec 19, 2025

Uh oh!

blueorangutan commented Dec 19, 2025

Uh oh!

blueorangutan commented Dec 19, 2025

Uh oh!

sudo87 commented Dec 22, 2025

Uh oh!

blueorangutan commented Dec 22, 2025

Uh oh!

blueorangutan commented Dec 22, 2025

codecov bot commented Dec 18, 2025 •

edited

Loading