feat(message-otp): opt-in auto-create of message-otp credential at login (v10) - #2918
Open
edulix wants to merge 2 commits into
Open
feat(message-otp): opt-in auto-create of message-otp credential at login (v10)#2918edulix wants to merge 2 commits into
edulix wants to merge 2 commits into
Conversation
Add a new boolean authenticator config property "Auto-create OTP credential" (autoCreateCredentialAttribute, disabled by default). When enabled, configuredFor() auto-creates the message-otp credential for non-deferred users that have a mobile number or email configured, so imported/edited voters can use the OTP alternative without an enrollment required action and without changing voter import/edit. Deferred-user mode keeps relying on auth notes and never requires nor creates a stored credential, fixing the silent filtering of the OTP alternative that ended in a generic invalid_user_credentials error. Includes unit tests (MessageOTPAuthenticatorTest, 10 tests) and junit jupiter + mockito test dependencies for the module. Related: sequentech/meta#12616 (cherry picked from commit 1b43757)
Document the opt-in Auto-create OTP credential option: why imported voters were silently skipping the OTP sub-flow, how to wire the conditional OTP sub-flow into the browser flow, how to enable the option, what the voter sees, and how to confirm the message-otp credential was created. Screenshots were captured against a dev election event configured end to end with an email-only voter. Related: sequentech/meta#12616 (cherry picked from commit 735e275)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Parent issue: https://github.com/sequentech/meta/issues/12616
Summary
Backports the opt-in Auto-create OTP credential option from main PR #2896 to
release/10.0, together with its documentation.Voters imported or edited through the admin portal get their email and mobile attributes set but never a stored
message-otpcredential, soconfiguredFor()returnedfalseand the conditional OTP sub-flow was silently skipped. Where the OTP was the only remaining alternative, the flow instead failed with a genericinvalid_user_credentials.autoCreateCredentialAttributeconfig key inUtils.ProviderConfigProperty"Auto-create OTP credential" (defaultfalse) inMessageOTPAuthenticatorFactory.MessageOTPAuthenticator.configuredFor(): for a non-deferred user without the stored credential, when the option is enabled and the user has a mobile number or an email address, themessage-otpcredential is created on the fly and the user reports as configured.Behaviour is unchanged while the property stays disabled, which is the default.
Stable Backport
Cherry-picks the two commits from #2896 onto
release/10.0. Both applied without conflicts.Validation on this branch
clean verifypassed, including the 10MessageOTPAuthenticatorTestcases; Spotless clean.system_introductionlink to the 9.4 release-notes page, which does not exist on this branch.Verification on a dev election event
Exercised against an election event realm configured with a conditional
message-otp-subflow(Condition - user configured+OTP - Message via Email/SMS, both Required) and an email-only voter,messageCourierAttribute=EMAIL:isConfiguredFor()returns false, the OTP sub-flow is skipped and the voter signs in with the password alone. Credentials remain[password].Auto-creating MessageOTPCredential for user with configured mobile/email, the OTP email is delivered, the code completes the login, and the stored credentials become[password, message-otp].Further Comments
Main PR: #2896
Neither the conditional OTP sub-flow nor this option is part of the default election-event realm template, so both remain a per-realm opt-in. Whether they should be defaults is tracked as an open item on the parent issue.