Forgot Password Feature

Introduction

Purpose

Forgot password on the login page in the UI is a pretty standard feature on most modern apps. The purpose of the feature is to allow a user-account using native CloudStack login functionality to be able to reset their user-account password using a token or secret (or link) which is sent to their registered email address in their user-account.

Document History

Glossary

Feature Specifications

• Feature experience, use-case and workflow:
  • In the login form under the "Login" button in case of the native login (not SAML/SSO etc) display a "Forgot password?" link. 
  • User needs to correctly enter their username and domain (suggested: maybe also fill a captcha, solve puzzle or some basic validation to defend against bots)
  • If a valid "native" CloudStack user exists, then an email is sent to the user with a URL that has a one-time password reset token. User opens the URL and they're asked to enter their new password (twice). If they don't exist, we don't send email. Either way, we don't tell the user if the account exists or not but use some standard note in the UI.
  • Don't resend email unless the previous token was used or expired for a user-account.
  • All strings etc must be localised (in UI and in email)
• Limitations:
  • This is not supported for SAML and LDAP users, since the auth sources management is outside the scope of CloudStack. In the next iteration, we can allow admin to configure a custom URL setting for such users, so that is sent to their email address. With this feature, a non-native user would be advised in the email to contact their administrator.
  • There's no feature to implement forgot username
  • For 2FA, we ask use if they want to keep their 2FA setting or disable that (which they can re-configure after log in using the new password)
• Admin configuration:
  • Admin needs to enable this feature, disabled by default upon upgrade; enable by default for fresh installations
  • Admin needs to configure endpointe URL, along with token expiry (in hrs), smtp settings to be able to send an email
  • Admin should be allowed to configure a (html) email template string for the main message/body.
• Audit and logging:
  • All events related to forget password and reset password must be logged, and events must be published
•  Tests:
  • Marvin test to automate testing of this feature using a fake smtp server (or web/service)

Architecture and Design description

• The forgot password and reset password can be implemented as auth APIs, for example implement "APIAuthenticator" class and of type "APIAuthenticationType.READONLY_API" (or introduce a new enum type).
• The secret tokens can be stored in a temporary database which has an expiry. When a token is either used, or has crossed its TTL, the token gets expired.