[UI] Allow change password for native users only. by sureshanaparti · Pull Request #12584 · apache/cloudstack

sureshanaparti · 2026-02-04T13:12:41Z

Description

This PR allows change password for native users only from UI.

Fixes #12581

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Tested with the users form with native, ldap, saml users.

How did you try to break this feature and the system with this change?

sureshanaparti · 2026-02-04T13:13:43Z

@blueorangutan ui

blueorangutan · 2026-02-04T13:15:06Z

@sureshanaparti a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress.

sureshanaparti · 2026-02-04T13:15:45Z

@DaanHoogland moving to draft based on your comment here - #12581 (comment)

codecov · 2026-02-04T13:23:29Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 16.25%. Comparing base (9ae696d) to head (57f8373).
⚠️ Report is 19 commits behind head on 4.20.

Additional details and impacted files

@@             Coverage Diff              @@
##               4.20   #12584      +/-   ##
============================================
- Coverage     16.26%   16.25%   -0.02%     
+ Complexity    13428    13425       -3     
============================================
  Files          5660     5662       +2     
  Lines        499963   500192     +229     
  Branches      60708    60739      +31     
============================================
- Hits          81330    81310      -20     
- Misses       409559   409796     +237     
- Partials       9074     9086      +12

Flag	Coverage Δ
uitests	`4.15% <ø> (-0.01%)`	⬇️
unittests	`17.10% <ø> (-0.02%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

blueorangutan · 2026-02-04T13:35:15Z

UI build: ✔️
Live QA URL: https://qa.cloudstack.cloud/simulator/pr/12584 (QA-JID-871)

DaanHoogland

clgtm, but I have questions about the functionality. As this fixes a bug atm (NPE when tried) I think we can go ahead. Users/operators will have to define how a broken or removed link of an authenticator should be handled. E.G. invalidate/regenerate PW or disable account. I could imagine this should be configurable in which case we can revert this condition.

We can also remove the need to be a native account now, and fix the NPE.

< @sureshanaparti >

sureshanaparti · 2026-02-04T15:00:56Z

clgtm, but I have questions about the functionality. As this fixes a bug atm (NPE when tried) I think we can go ahead. Users/operators will have to define how a broken or removed link of an authenticator should be handled. E.G. invalidate/regenerate PW or disable account. I could imagine this should be configurable in which case we can revert this condition.

We can also remove the need to be a native account now, and fix the NPE.

< @sureshanaparti >

updated @DaanHoogland it also checks for admin, domain admin account or the same user to change the password.

sureshanaparti · 2026-02-04T15:01:18Z

@blueorangutan ui

blueorangutan · 2026-02-04T15:27:11Z

@sureshanaparti a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress.

blueorangutan · 2026-02-04T15:46:42Z

UI build: ✔️
Live QA URL: https://qa.cloudstack.cloud/simulator/pr/12584 (QA-JID-872)

sudo87 · 2026-02-05T07:36:22Z

We should have kept password change only for "native" users. As of now we throw exception whenever password change is done from UI. In my opinion it should be hidden if capability is not supported for SAML/LDAP users.

cc: @DaanHoogland @sureshanaparti @kiranchavala

sureshanaparti · 2026-02-05T10:58:25Z

We should have kept password change only for "native" users. As of now we throw exception whenever password change is done from UI. In my opinion it should be hidden if capability is not supported for SAML/LDAP users.

cc: @DaanHoogland @sureshanaparti @kiranchavala

Shall I keep it for native users only? @DaanHoogland @kiranchavala

sureshanaparti · 2026-02-19T09:21:43Z

@blueorangutan ui

blueorangutan · 2026-02-19T09:23:04Z

@sureshanaparti a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress.

kiranchavala · 2026-02-19T09:31:55Z

@blueorangutan package

blueorangutan · 2026-02-19T09:34:05Z

@kiranchavala a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-19T09:44:13Z

UI build: ✔️
Live QA URL: https://qa.cloudstack.cloud/simulator/pr/12584 (QA-JID-877)

blueorangutan · 2026-02-19T10:47:27Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16881

sudo87

lgtm

RosiKyu

LGTM

#	Test Case	Method	Status
TC1	Native enabled user: change password button visible	UI	PASS
TC2	LDAP user: change password button hidden	UI	PASS
TC3	SAML user: change password button hidden	UI	PASS
TC4	Disabled native user: change password button hidden	UI	PASS
TC5	Native user: password change via API succeeds	CLI (cmk)	PASS
TC6	LDAP user: password change via API blocked	CLI (cmk)	PASS
TC7	SAML user: password change via API blocked	CLI (cmk)	PASS
TC8	Native user: password change via UI succeeds	UI	PASS

Result: 8/8 PASS

Note: LDAP/SAML users were simulated by updating cloud.user.source in the database, which is functionally equivalent for UI testing since the UI checks the usersource field returned by the API (sourced directly from this DB column). TC6/TC7 confirm pre-existing backend protection that independently blocks password changes for non-native users - this is not part of the PR but provides defense in depth.

The UI correctly restricts the "Change password" button to enabled native users only, and the backend independently enforces the same restriction at the API level for defense in depth. Password change for native users works successfully via both UI and API.

Detailed Test Execution Report

TC1: Native user - change password button visible

Objective Verify that the "Change password" button is visible for an enabled native user.

Test Steps

As RootAdmin, create a native user account nativeuser
In UI, navigate to Users → nativeuser detail page
Check for "Change password" button in the action icons

Expected Result: The "Change password" button should be visible.

Actual Result: The "Change password" button is visible in the top-right action icons. User type shows native.

Test Evidence:

(localcloud) 🐱 > list users account=nativeuser
{
  "count": 1,
  "user": [
    {
      "account": "nativeuser",
      "accountid": "0be5ba9c-5555-42a4-aa3b-d3928f349929",
      "accounttype": 0,
      "apikeyaccess": "INHERIT",
      "created": "2026-02-23T11:05:24+0000",
      "domain": "ROOT",
      "domainid": "cf984af2-108a-11f1-88d8-1e0066000102",
      "email": "native@test.com",
      "firstname": "Native",
      "id": "afb2c4e7-6cab-4ef5-a501-60c8392e3117",
      "is2faenabled": false,
      "is2famandated": false,
      "iscallerchilddomain": false,
      "isdefault": false,
      "lastname": "User",
      "roleid": "f17c8f63-108a-11f1-88d8-1e0066000102",
      "rolename": "User",
      "roletype": "User",
      "state": "enabled",
      "username": "nativeuser",
      "usersource": "native"
    }
  ]
}

UI screenshot: nativeuser detail page shows 6 action icons including "Change password"

TC2: LDAP user - change password button hidden

Objective Verify that the "Change password" button is hidden for an LDAP user.

Test Steps

As RootAdmin, create user ldapuser and set source to LDAP in DB: UPDATE cloud.user SET source='LDAP' WHERE username='ldapuser';
In UI, navigate to Users → ldapuser detail page
Check for "Change password" button in the action icons

Expected Result: The "Change password" button should NOT be visible.

Actual Result: The "Change password" button is not present. Only 5 action icons shown (vs 6 for native user). User type shows ldap.

Test Evidence:

mysql> UPDATE cloud.user SET source='LDAP' WHERE username='ldapuser';
Query OK, 1 row affected (0.00 sec)
Rows matched: 1  Changed: 1  Warnings: 0

(localcloud) 🐱 > list users account=ldapuser
{
  "count": 1,
  "user": [
    {
      "account": "ldapuser",
      "accountid": "7fb240b6-0736-4c03-a57e-3abefc40fcd6",
      "accounttype": 0,
      "apikeyaccess": "INHERIT",
      "created": "2026-02-23T11:05:32+0000",
      "domain": "ROOT",
      "domainid": "cf984af2-108a-11f1-88d8-1e0066000102",
      "email": "ldap@test.com",
      "firstname": "LDAP",
      "id": "ef1ab44a-ae7e-48e6-a2dc-21c0eb3e0bce",
      "is2faenabled": false,
      "is2famandated": false,
      "iscallerchilddomain": false,
      "isdefault": false,
      "lastname": "User",
      "roleid": "f17c8f63-108a-11f1-88d8-1e0066000102",
      "rolename": "User",
      "roletype": "User",
      "state": "enabled",
      "username": "ldapuser",
      "usersource": "ldap"
    }
  ]
}

UI screenshot: ldapuser detail page shows 5 action icons, no "Change password"

TC3: SAML user - change password button hidden

Objective Verify that the "Change password" button is hidden for a SAML user.

Test Steps

As RootAdmin, create user samluser and set source to SAML2 in DB: UPDATE cloud.user SET source='SAML2' WHERE username='samluser';
In UI, navigate to Users → samluser detail page
Check for "Change password" button in the action icons

Expected Result: The "Change password" button should NOT be visible.

Actual Result: The "Change password" button is not present. Only 5 action icons shown. User type shows saml2.

Test Evidence:

mysql> UPDATE cloud.user SET source='SAML2' WHERE username='samluser';
Query OK, 1 row affected (0.00 sec)
Rows matched: 1  Changed: 1  Warnings: 0

(localcloud) 🐱 > list users account=samluser
{
  "count": 1,
  "user": [
    {
      "account": "samluser",
      "accountid": "03fa8afe-dcd9-49cd-9e43-5e33facd3b99",
      "accounttype": 0,
      "apikeyaccess": "INHERIT",
      "created": "2026-02-23T11:05:37+0000",
      "domain": "ROOT",
      "domainid": "cf984af2-108a-11f1-88d8-1e0066000102",
      "email": "saml@test.com",
      "firstname": "SAML",
      "id": "bed05e50-f72d-4b07-ac50-02ae8053b7a5",
      "is2faenabled": false,
      "is2famandated": false,
      "iscallerchilddomain": false,
      "isdefault": false,
      "lastname": "User",
      "roleid": "f17c8f63-108a-11f1-88d8-1e0066000102",
      "rolename": "User",
      "roletype": "User",
      "state": "enabled",
      "username": "samluser",
      "usersource": "saml2"
    }
  ]
}

UI screenshot: samluser detail page shows 5 action icons, no "Change password"

TC4: Disabled native user - change password button hidden

Objective Verify that the "Change password" button is hidden for a disabled native user.

Test Steps

Disable the native user: disable user id=afb2c4e7-6cab-4ef5-a501-60c8392e3117
In UI, navigate to Users → nativeuser detail page
Check for "Change password" button in the action icons

Expected Result: The "Change password" button should NOT be visible for a disabled user, even if the user type is native.

Actual Result: The "Change password" button is not present. Only 4 action icons shown. Status shows Disabled, User type shows native.

Test Evidence:

(localcloud) 🐱 > disable user id=afb2c4e7-6cab-4ef5-a501-60c8392e3117
⣯ 😹 polling for async API result
{
  "user": {
    "account": "nativeuser",
    "accountid": "0be5ba9c-5555-42a4-aa3b-d3928f349929",
    "accounttype": 0,
    "created": "2026-02-23T11:05:24+0000",
    "domain": "ROOT",
    "domainid": "cf984af2-108a-11f1-88d8-1e0066000102",
    "email": "native@test.com",
    "firstname": "Native",
    "id": "afb2c4e7-6cab-4ef5-a501-60c8392e3117",
    "is2faenabled": false,
    "is2famandated": false,
    "iscallerchilddomain": false,
    "isdefault": false,
    "lastname": "User",
    "roleid": "f17c8f63-108a-11f1-88d8-1e0066000102",
    "rolename": "User",
    "roletype": "User",
    "state": "disabled",
    "username": "nativeuser",
    "usersource": "native"
  }
}

UI screenshot: nativeuser detail page shows Status: Disabled, 4 action icons, no "Change password"

TC5: Native user - password change via API succeeds

Objective Verify that changing password for a native user works at the API level.

Test Steps

As RootAdmin, update password for native user via cmk: update user id=afb2c4e7-6cab-4ef5-a501-60c8392e3117 password=newpassword123

Expected Result: Password update should succeed.

Actual Result: Password update succeeded, user details returned without error.

Test Evidence:

(localcloud) 🐱 > update user id=afb2c4e7-6cab-4ef5-a501-60c8392e3117 password=newpassword123
{
  "user": {
    "account": "nativeuser",
    "accountid": "0be5ba9c-5555-42a4-aa3b-d3928f349929",
    "accounttype": 0,
    "created": "2026-02-23T11:05:24+0000",
    "domain": "ROOT",
    "domainid": "cf984af2-108a-11f1-88d8-1e0066000102",
    "email": "native@test.com",
    "firstname": "Native",
    "id": "afb2c4e7-6cab-4ef5-a501-60c8392e3117",
    "state": "enabled",
    "username": "nativeuser",
    "usersource": "native"
  }
}

TC6: LDAP user - password change via API blocked

Objective Verify that the backend rejects password changes for LDAP users even when bypassing the UI.

Test Steps

As RootAdmin, attempt to update password for LDAP user via cmk: update user id=ef1ab44a-ae7e-48e6-a2dc-21c0eb3e0bce password=newpassword123

Expected Result: Password update should fail with an error indicating LDAP/SAML users cannot change passwords.

Actual Result: Password update was rejected with error code 4350.

Test Evidence:

(localcloud) 🐱 > update user id=ef1ab44a-ae7e-48e6-a2dc-21c0eb3e0bce password=newpassword123
🙈 Error: (HTTP 431, error code 4350) CloudStack does not support updating passwords for SAML or LDAP users. Please contact your cloud administrator for assistance.

TC7: SAML user - password change via API blocked

Objective Verify that the backend rejects password changes for SAML users even when bypassing the UI.

Test Steps

As RootAdmin, attempt to update password for SAML user via cmk: update user id=bed05e50-f72d-4b07-ac50-02ae8053b7a5 password=newpassword123

Expected Result: Password update should fail with an error indicating LDAP/SAML users cannot change passwords.

Actual Result: Password update was rejected with error code 4350.

Test Evidence:

(localcloud) 🐱 > update user id=bed05e50-f72d-4b07-ac50-02ae8053b7a5 password=newpassword123
🙈 Error: (HTTP 431, error code 4350) CloudStack does not support updating passwords for SAML or LDAP users. Please contact your cloud administrator for assistance.

TC8: Native user - password change via UI succeeds

Objective Verify that changing password for a native user works through the UI "Change password" dialog.

Test Steps

As RootAdmin, navigate to Users → nativeuser detail page
Click the "Change password" icon in the action bar
Enter new password and confirm
Click OK

Expected Result: Password change should succeed with a success notification.

Actual Result: Password was changed successfully via the UI.

Test Evidence:

"Change password" completed successfully for nativeuser (User type: native, Status: Enabled)

Screencast.from.2026-02-23.13-27-43.webm

[UI] Allow change password for native users

f05be25

boring-cyborg Bot added the component:UI label Feb 4, 2026

sureshanaparti linked an issue Feb 4, 2026 that may be closed by this pull request

Change password should be not allowed for LDAP and SAML based account #12581

Closed

sureshanaparti added this to the 4.20.3 milestone Feb 4, 2026

sureshanaparti requested a review from kiranchavala February 4, 2026 13:12

sureshanaparti assigned DaanHoogland and unassigned DaanHoogland Feb 4, 2026

sureshanaparti requested review from DaanHoogland and abh1sar February 4, 2026 13:13

sureshanaparti marked this pull request as draft February 4, 2026 13:15

DaanHoogland approved these changes Feb 4, 2026

View reviewed changes

Remove native usersource check

76d1cb5

sureshanaparti marked this pull request as ready for review February 4, 2026 15:01

sudo87 reviewed Feb 5, 2026

View reviewed changes

Comment thread ui/src/config/section/user.js Outdated

check enabled user or not

fe2a22e

abh1sar modified the milestones: 4.20.3, 4.20.4 Feb 16, 2026

Keep native usersource check (error thrown from the api call anyways)

57f8373

sureshanaparti added status:needs-testing ready-for-testing labels Feb 19, 2026

sudo87 approved these changes Feb 19, 2026

View reviewed changes

RosiKyu self-assigned this Feb 23, 2026

RosiKyu added status:testing and removed ready-for-testing labels Feb 23, 2026

RosiKyu approved these changes Feb 23, 2026

View reviewed changes

RosiKyu added status:tested and removed status:testing labels Feb 23, 2026

DaanHoogland removed the status:needs-testing label Feb 23, 2026

DaanHoogland modified the milestones: 4.20.4, 4.20.3 Feb 23, 2026

DaanHoogland merged commit cf71938 into apache:4.20 Feb 23, 2026
24 of 26 checks passed

DaanHoogland deleted the ui-user-change-password branch February 23, 2026 11:40

DaanHoogland mentioned this pull request Feb 23, 2026

Change password should be not allowed for LDAP and SAML based account #12581

Closed

dhslove pushed a commit to ablecloud-team/ablestack-cloud that referenced this pull request Mar 3, 2026

[UI] Allow change password for native users only. (apache#12584)

1183658

sandeeplocharla pushed a commit to NetApp/cloudstack that referenced this pull request Apr 9, 2026

[UI] Allow change password for native users only. (apache#12584)

d8348d8

Conversation

sureshanaparti commented Feb 4, 2026

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

sureshanaparti commented Feb 4, 2026

Uh oh!

blueorangutan commented Feb 4, 2026

Uh oh!

sureshanaparti commented Feb 4, 2026

Uh oh!

codecov Bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

blueorangutan commented Feb 4, 2026

Uh oh!

DaanHoogland left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sureshanaparti commented Feb 4, 2026

Uh oh!

sureshanaparti commented Feb 4, 2026

Uh oh!

blueorangutan commented Feb 4, 2026

Uh oh!

blueorangutan commented Feb 4, 2026

Uh oh!

sudo87 commented Feb 5, 2026

Uh oh!

Uh oh!

sureshanaparti commented Feb 5, 2026

Uh oh!

sureshanaparti commented Feb 19, 2026

Uh oh!

blueorangutan commented Feb 19, 2026

Uh oh!

kiranchavala commented Feb 19, 2026

Uh oh!

blueorangutan commented Feb 19, 2026

Uh oh!

blueorangutan commented Feb 19, 2026

Uh oh!

blueorangutan commented Feb 19, 2026

Uh oh!

sudo87 left a comment

Choose a reason for hiding this comment

Uh oh!

RosiKyu left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

LGTM

Detailed Test Execution Report

TC1: Native user - change password button visible

TC2: LDAP user - change password button hidden

TC3: SAML user - change password button hidden

TC4: Disabled native user - change password button hidden

TC5: Native user - password change via API succeeds

TC6: LDAP user - password change via API blocked

TC7: SAML user - password change via API blocked

TC8: Native user - password change via UI succeeds

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

codecov Bot commented Feb 4, 2026 •

edited

Loading

DaanHoogland left a comment •

edited

Loading

RosiKyu left a comment •

edited

Loading