Add password expiry validation in Password Grant

[boromi]

Proposed changes in this pull request

• Add productize support for password expiry in password grant type. There is already a custom authenticator for password expiration validation in redirection based flow[1]. The same feature should be implemented in the password grant implementation as well to support password expiration feature on the API level and not only in the browser level.
• If this feature is enabled, we check the ‘Last Password Update’ claim to verify whether the password is expired or not. If expired, we'll throw an error message and interrupt the authentication flow[2]. This feature is disabled by default.
  Property to enable the feature in deployment.toml:

[oauth]
enable_password_reset_enforcement = true

[1] https://github.com/wso2-extensions/identity-outbound-auth-passwordPolicy/blob/master/docs/config.md

[2]

Related Issues

• Add password expiry validation in Password Grant wso2/product-is#13876

Related PRs

• Adding POST_ADD_USER event type to handleCredentialUpdate case identity-governance#603

Checklist (for reviewing)

General

• Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
• Is the PR labeled correctly?

Functionality

• Are all requirements met? Compare implemented functionality with the requirements specification.
• Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

• Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
• Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
• Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

• Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
• If this is a bug fix, are tests for the issue in place? There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.
• If this is a new feature or a significant change to an existing feature? has the manual testing spreadsheet been updated with instructions for manual testing?

Security

• Confirm this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.
• Are all UI and API inputs run through forms or serializers?
• Are all external inputs validated and sanitized appropriately?
• Does all branching logic have a default case?
• Does this solution handle outliers and edge cases gracefully?
• Are all external communications secured and restricted to SSL?

Documentation

• Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes should be documented.
• Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented.
• Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.

[CLAassistant]

All committers have signed the CLA.

[jenkins-is-staging]

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/3520289187

[Thumimku]

Merge the PR after running integrations tests.

[jenkins-is-staging]

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/3520289187
Status: success

[jenkins-is-staging]

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/3520289187

[Thumimku]

Hi @boromi,

⚠️ Notice: This PR has been open for a while. To keep the repository clean and up-to-date, this PR will be closed within the next two weeks if there is no further activity.

Please take one of the following actions:

• Merge the PR if it is ready.
• Close the PR if it is no longer relevant.
• Leave a comment explaining why it should remain open and provide an update on its progress.

Your prompt attention to this matter is greatly appreciated. Thank you for your understanding and collaboration! 🙏