Skip to content

Commit d93eb8b

Browse files
authored
Merge pull request #5008 from malithie/pre-password-update-action
Add docs for pre update password extension
2 parents 2ec723c + eb911d7 commit d93eb8b

File tree

10 files changed

+963
-0
lines changed

10 files changed

+963
-0
lines changed
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{% include "../../../../../includes/guides/customize/actions/pre-update-password-action.md" %}
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
template: templates/redoc.html
3+
---
4+
5+
<redoc spec-url="{{base_path}}/references/actions/pre-update-password-action/api/pre_update_password_action-v1.yaml" theme='{{redoc_theme}}'></redoc>
Lines changed: 267 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,267 @@
1+
openapi: 3.0.1
2+
info:
3+
title: API contract for pre update password action
4+
description: This API defines the REST API contract for a service that implements logic to extend password update flow of Asgardeo.
5+
version: v1
6+
security:
7+
- BasicAuth: []
8+
- BearerAuth: []
9+
- ApiKeyAuth: []
10+
- OAuth2: []
11+
paths:
12+
/:
13+
post:
14+
summary: handle pre-update password events
15+
requestBody:
16+
content:
17+
application/json:
18+
schema:
19+
$ref: '#/components/schemas/RequestBody'
20+
required: true
21+
responses:
22+
"200":
23+
description: Ok
24+
content:
25+
application/json:
26+
schema:
27+
oneOf:
28+
- $ref: '#/components/schemas/SuccessResponse'
29+
- $ref: '#/components/schemas/FailedResponse'
30+
examples:
31+
successExample:
32+
summary: Success response
33+
value:
34+
actionStatus: SUCCESS
35+
failedExample:
36+
summary: Failed response
37+
value:
38+
actionStatus: FAILED
39+
failureReason: password_compromised
40+
failureDescription: "The provided password is compromised."
41+
"400":
42+
description: Bad Request
43+
content:
44+
application/json:
45+
schema:
46+
$ref: '#/components/schemas/ErrorResponse'
47+
example:
48+
actionStatus: ERROR
49+
error: invalid_credential
50+
errorDescription: Expects the encrypted credential.
51+
"500":
52+
description: Server Error
53+
content:
54+
application/json:
55+
schema:
56+
$ref: '#/components/schemas/ErrorResponse'
57+
example:
58+
actionStatus: ERROR
59+
error: server_error
60+
errorDescription: Failed to process the response
61+
components:
62+
schemas:
63+
Event:
64+
type: object
65+
properties:
66+
initiatorType:
67+
type: string
68+
example: USER
69+
enum:
70+
- USER
71+
- ADMIN
72+
- APPLICATION
73+
description: This indicates whether the password update was initiated by an admin, a user, or an application.
74+
action:
75+
type: string
76+
example: RESET
77+
enum:
78+
- RESET
79+
- UPDATE
80+
- INVITE
81+
description: This indicates whether the password update was initiated over a password reset flow, update flow, or an invite flow.
82+
tenant:
83+
$ref: '#/components/schemas/Tenant'
84+
user:
85+
$ref: '#/components/schemas/User'
86+
organization:
87+
$ref: '#/components/schemas/Organization'
88+
userStore:
89+
$ref: '#/components/schemas/UserStore'
90+
description: Defines the context data related to the pre issue access token event that needs to be shared with the custom service to process and execute.
91+
Tenant:
92+
type: object
93+
properties:
94+
id:
95+
type: string
96+
description: The unique numeric identifier of the tenant.
97+
example: "2"
98+
name:
99+
type: string
100+
description: The domain name of the tenant.
101+
example: bar.com
102+
description: This property represents the tenant under which the token request is being processed.
103+
User:
104+
type: object
105+
properties:
106+
id:
107+
type: string
108+
description: Defines the unique identifier of the user.
109+
example: e204849c-4ec2-41f1-8ff7-ec1ebff02821
110+
updatingCredential:
111+
oneOf:
112+
- $ref: '#/components/schemas/UnencryptedCredential'
113+
- $ref: '#/components/schemas/EncryptedCredential'
114+
description: Contains information about the user associated with the password update request.
115+
UnencryptedCredential:
116+
type: object
117+
properties:
118+
type:
119+
type: string
120+
enum:
121+
- PASSWORD
122+
description: Defines the credential type.
123+
format:
124+
type: string
125+
example: HASH
126+
enum:
127+
- PLAINTEXT
128+
- HASH
129+
description: Defines the format the credential is shared.
130+
value:
131+
type: string
132+
example: cHRSHCjvmT
133+
description: Defines the value.
134+
additionalData:
135+
$ref: '#/components/schemas/AdditionalData'
136+
EncryptedCredential:
137+
type: string
138+
description: |
139+
Represents an encrypted credential using JSON Web Encryption (JWE).
140+
141+
When a public key is configured for the pre-password update action,
142+
the `updatingCredential` object is encrypted into a JWE string.
143+
The payload of this JWE follows the structure of the `UnencryptedCredential` object.
144+
145+
Example JWE representation:
146+
```
147+
eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ.OKOawDo13gRp2ojaHV7LFsQ.48V1_ALb6US04U3b.5eym8X3LNvUubV4Y0kH.XFBoMYUZodetZdvTiFvSkQ
148+
```
149+
150+
Decrypted Payload Example (UnencryptedCredential structure):
151+
```
152+
{
153+
"type": "PASSWORD",
154+
"format": "HASH",
155+
"value": "cHRSHCjvmT",
156+
"additionalData": {
157+
"algorithm": "SHA256"
158+
}
159+
}
160+
```
161+
162+
This ensures secure transmission of the credential while allowing validation upon decryption.
163+
example: eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ.OKOawDo13gRp2ojaHV7LFsQ.48V1_ALb6US04U3b.5eym8X3LNvUubV4Y0kH.XFBoMYUZodetZdvTiFvSkQ
164+
Organization:
165+
type: object
166+
properties:
167+
id:
168+
type: string
169+
description: The unique identifier of the organization.
170+
example: 5c7930f2-c97d-4b38-89a6-7be5fb138a35
171+
name:
172+
type: string
173+
description: "Name of the organization used to identify the organization in configurations, user interfaces, etc."
174+
example: foo.com
175+
description: Refers to the organization to which the user belongs. Organizations represent partners/enterprise customers in Business-to-Business (B2B) use cases.
176+
UserStore:
177+
type: object
178+
properties:
179+
id:
180+
type: string
181+
description: The unique identifier for the user store.
182+
example: UFJJTUFSWQ==
183+
name:
184+
type: string
185+
description: "User store name used to identify the user store in configuration settings, user interfaces, and administrative tasks."
186+
example: PRIMARY
187+
description: Indicates the user store in which the user's data is being managed.
188+
AdditionalData:
189+
type: object
190+
description: Defines the additional data related to the updating credential.
191+
anyOf:
192+
- $ref: '#/components/schemas/AdditionalDataForHashedPassword'
193+
AdditionalDataForHashedPassword:
194+
type: object
195+
properties:
196+
algorithm:
197+
type: string
198+
enum:
199+
- SHA256
200+
description: Defines additional data related to hashed passwords.
201+
SuccessResponse:
202+
type: object
203+
properties:
204+
actionStatus:
205+
type: string
206+
enum:
207+
- SUCCESS
208+
description: Defines the success response.
209+
FailedResponse:
210+
type: object
211+
properties:
212+
actionStatus:
213+
type: string
214+
enum:
215+
- FAILED
216+
description: Indicates the outcome of the request. For a failed operation, this should be set to FAILED.
217+
failureReason:
218+
type: string
219+
description: Provides the reason for failing password update.
220+
failureDescription:
221+
type: string
222+
description: Offers a detailed explanation of the failure
223+
ErrorResponse:
224+
type: object
225+
properties:
226+
actionStatus:
227+
type: string
228+
enum:
229+
- ERROR
230+
description: Indicates the outcome of the request. For an error operation, this should be set to ERROR.
231+
errorMessage:
232+
type: string
233+
description: The cause of the error.
234+
errorDescription:
235+
type: string
236+
description: A detailed description of the error.
237+
description: |
238+
When the external service responds with an ERROR state, it can return an HTTP status code of 400, 401, or 500, indicating either a validation failure or an issue processing the request.
239+
RequestBody:
240+
type: object
241+
properties:
242+
actionType:
243+
type: string
244+
description: "Specifies the action being triggered, which in this case is PRE_UPDATE_PASSWORD."
245+
enum:
246+
- PRE_UPDATE_PASSWORD
247+
event:
248+
$ref: '#/components/schemas/Event'
249+
securitySchemes:
250+
BasicAuth:
251+
type: http
252+
scheme: basic
253+
BearerAuth:
254+
type: http
255+
scheme: bearer
256+
ApiKeyAuth:
257+
type: apiKey
258+
name: X-API-Key
259+
in: header
260+
OAuth2:
261+
type: oauth2
262+
flows:
263+
clientCredentials:
264+
tokenUrl: https://example.com/oauth/token
265+
scopes:
266+
process: process request generate response
267+

en/asgardeo/features.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,5 +45,13 @@
4545
"page": [
4646
"guides/users/attributes/configure-unique-attributes.md"
4747
]
48+
},
49+
50+
"pre-update-password-action": {
51+
"enabled": false,
52+
"page": [
53+
"references/actions/pre-update-password-action/api-contract.md",
54+
"guides/customize/actions/pre-update-password-action.md"
55+
]
4856
}
4957
}

en/asgardeo/mkdocs.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -373,6 +373,7 @@ nav:
373373
- Setting up actions: guides/customize/actions/setting-up-actions.md
374374
- Action types:
375375
- Pre issue access token action: guides/customize/actions/pre-issue-access-token-action.md
376+
- Pre update password action: guides/customize/actions/pre-update-password-action.md
376377
- Your Asgardeo:
377378
- Your Asgardeo: guides/your-asgardeo/index.md
378379
- Manage root organizations: guides/your-asgardeo/manage-root-organizations.md
@@ -495,6 +496,8 @@ nav:
495496
- Pre issue access token action:
496497
- API contract to implement: references/actions/pre-issue-access-token-action/api-contract.md
497498
- Sample success reponses: references/actions/pre-issue-access-token-action/sample-success-responses.md
499+
- Pre update password action:
500+
- API contract to implement: references/actions/pre-update-password-action/api-contract.md
498501
- Accessibility compliance: references/accessibility.md
499502
- Data residency in Asgardeo: references/data-residency-in-asgardeo.md
500503
- Production checklist:
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{% include "../../../../../../includes/guides/customize/actions/pre-update-password-action.md" %}
Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
template: templates/redoc.html
3+
---
4+
5+
<redoc spec-url="{{base_path}}/references/actions/pre-update-password-action/api/pre_update_password_action-v1.yaml" theme='{{redoc_theme}}'></redoc>

0 commit comments

Comments
 (0)