feat: Lockout policy (#2121)

* feat: lock users if lockout policy is set * feat: setup * feat: lock user on password failes * feat: render error * feat: lock user on command side * feat: auth_req tests * feat: lockout policy docs * feat: remove show lockout failures from proto * fix: console lockout * feat: tests * fix: tests * unlock function * add unlock button * fix migration version * lockout policy * lint * Update internal/auth/repository/eventsourcing/eventstore/auth_request.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * fix: err message * Update internal/command/setup_step4.go Co-authored-by: Silvan <silvan.reusser@gmail.com> Co-authored-by: Max Peintner <max@caos.ch> Co-authored-by: Livio Amstutz <livio.a@gmail.com> Co-authored-by: Silvan <silvan.reusser@gmail.com>
2025-12-13 16:42:34 +00:00 · 2021-08-11 08:36:32 +02:00
parent 272e411e27
commit bc951985ed
101 changed files with 2170 additions and 1574 deletions
--- a/console/src/app/pages/users/user-detail/user-detail.module.ts
+++ b/console/src/app/pages/users/user-detail/user-detail.module.ts
@@ -17,6 +17,7 @@ import { MemberCreateDialogModule } from 'src/app/modules/add-member-dialog/memb
 import { CardModule } from 'src/app/modules/card/card.module';
 import { ChangesModule } from 'src/app/modules/changes/changes.module';
 import { DetailLayoutModule } from 'src/app/modules/detail-layout/detail-layout.module';
+import { InfoSectionModule } from 'src/app/modules/info-section/info-section.module';
 import { InputModule } from 'src/app/modules/input/input.module';
 import { MachineKeysModule } from 'src/app/modules/machine-keys/machine-keys.module';
 import { MetaLayoutModule } from 'src/app/modules/meta-layout/meta-layout.module';
@@ -104,6 +105,7 @@ import { UserMfaComponent } from './user-detail/user-mfa/user-mfa.component';
    LocalizedDatePipeModule,
    InputModule,
    MachineKeysModule,
+    InfoSectionModule,
  ],
 })
 export class UserDetailModule { }
--- a/console/src/app/pages/users/user-detail/user-detail/user-detail.component.html
+++ b/console/src/app/pages/users/user-detail/user-detail/user-detail.component.html
@@ -14,6 +14,11 @@
            <span class="fill-space"></span>

            <ng-template appHasRole [appHasRole]="['user.write$', 'user.write:'+user?.id]">
+              <button class="unlock-button" mat-stroked-button color="warn"
+                  *ngIf="user?.state === UserState.USER_STATE_LOCKED"
+                  (click)="unlockUser()">{{'USER.PAGES.UNLOCK' |
+                  translate}}</button>
+         
                <button class="state-button" mat-stroked-button color="warn"
                    *ngIf="user?.state !== UserState.USER_STATE_INACTIVE"
                    (click)="changeState(UserState.USER_STATE_INACTIVE)">{{'USER.PAGES.DEACTIVATE' |
@@ -26,6 +31,7 @@

        <mat-progress-bar *ngIf="loading" color="primary" mode="indeterminate"></mat-progress-bar>

+        <cnsl-info-section class="locked" *ngIf="user?.state === UserState.USER_STATE_LOCKED" type="WARN">{{'USER.PAGES.LOCKEDDESCRIPTION' | translate}}</cnsl-info-section>
        <span *ngIf="!loading && !user">{{ 'USER.PAGES.NOUSER' | translate }}</span>

        <app-card title="{{ 'USER.PAGES.LOGINNAMES' | translate }}"
--- a/console/src/app/pages/users/user-detail/user-detail/user-detail.component.scss
+++ b/console/src/app/pages/users/user-detail/user-detail/user-detail.component.scss
@@ -18,11 +18,20 @@
    flex: 1;
  }

+  .unlock-button {
+    margin-left: .5rem;
+  }
+
  .state-button {
    margin-left: .5rem;
  }
 }

+.locked {
+  display: block;
+  margin: 1rem 0;
+}
+
 .img-phone-email {
  width: 300px;
 }
--- a/console/src/app/pages/users/user-detail/user-detail/user-detail.component.ts
+++ b/console/src/app/pages/users/user-detail/user-detail/user-detail.component.ts
@@ -7,7 +7,7 @@ import { take } from 'rxjs/operators';
 import { ChangeType } from 'src/app/modules/changes/changes.component';
 import { UserGrantContext } from 'src/app/modules/user-grants/user-grants-datasource';
 import { WarnDialogComponent } from 'src/app/modules/warn-dialog/warn-dialog.component';
-import { SendHumanResetPasswordNotificationRequest } from 'src/app/proto/generated/zitadel/management_pb';
+import { SendHumanResetPasswordNotificationRequest, UnlockUserRequest } from 'src/app/proto/generated/zitadel/management_pb';
 import { Email, Gender, Machine, Phone, Profile, User, UserState } from 'src/app/proto/generated/zitadel/user_pb';
 import { ManagementService } from 'src/app/services/mgmt.service';
 import { ToastService } from 'src/app/services/toast.service';
@@ -16,281 +16,292 @@ import { EditDialogComponent, EditDialogType } from '../auth-user-detail/edit-di
 import { ResendEmailDialogComponent } from '../auth-user-detail/resend-email-dialog/resend-email-dialog.component';

@Component({
-    selector: 'app-user-detail',
-    templateUrl: './user-detail.component.html',
-    styleUrls: ['./user-detail.component.scss'],
+  selector: 'app-user-detail',
+  templateUrl: './user-detail.component.html',
+  styleUrls: ['./user-detail.component.scss'],
 })
 export class UserDetailComponent implements OnInit {
-    public user!: User.AsObject;
-    public genders: Gender[] = [Gender.GENDER_MALE, Gender.GENDER_FEMALE, Gender.GENDER_DIVERSE];
-    public languages: string[] = ['de', 'en'];
+  public user!: User.AsObject;
+  public genders: Gender[] = [Gender.GENDER_MALE, Gender.GENDER_FEMALE, Gender.GENDER_DIVERSE];
+  public languages: string[] = ['de', 'en'];

-    public ChangeType: any = ChangeType;
-    public loading: boolean = false;
+  public ChangeType: any = ChangeType;
+  public loading: boolean = false;

-    public UserState: any = UserState;
-    public copied: string = '';
-    public USERGRANTCONTEXT: UserGrantContext = UserGrantContext.USER;
+  public UserState: any = UserState;
+  public copied: string = '';
+  public USERGRANTCONTEXT: UserGrantContext = UserGrantContext.USER;

-    public EditDialogType: any = EditDialogType;
-    public refreshChanges$: EventEmitter<void> = new EventEmitter();
+  public EditDialogType: any = EditDialogType;
+  public refreshChanges$: EventEmitter<void> = new EventEmitter();

-    constructor(
-        public translate: TranslateService,
-        private route: ActivatedRoute,
-        private toast: ToastService,
-        public mgmtUserService: ManagementService,
-        private _location: Location,
-        private dialog: MatDialog,
-        private router: Router,
-    ) { }
+  constructor(
+    public translate: TranslateService,
+    private route: ActivatedRoute,
+    private toast: ToastService,
+    public mgmtUserService: ManagementService,
+    private _location: Location,
+    private dialog: MatDialog,
+    private router: Router,
+  ) { }

-    refreshUser(): void {
-        this.refreshChanges$.emit();
-        this.route.params.pipe(take(1)).subscribe(params => {
-            const { id } = params;
-            this.mgmtUserService.getUserByID(id).then(resp => {
-                if (resp.user) {
-                    this.user = resp.user;
-                }
-            }).catch(err => {
-                console.error(err);
-            });
+  refreshUser(): void {
+    this.refreshChanges$.emit();
+    this.route.params.pipe(take(1)).subscribe(params => {
+      const { id } = params;
+      this.mgmtUserService.getUserByID(id).then(resp => {
+        if (resp.user) {
+          this.user = resp.user;
+        }
+      }).catch(err => {
+        console.error(err);
+      });
+    });
+  }
+
+  public ngOnInit(): void {
+    this.refreshUser();
+  }
+
+  public unlockUser(): void {
+    const req = new UnlockUserRequest();
+    req.setId(this.user.id);
+    this.mgmtUserService.unlockUser(req).then(() => {
+      this.toast.showInfo('USER.TOAST.UNLOCKED', true);
+      this.refreshUser();
+    }).catch(error => {
+      this.toast.showError(error);
+    });
+  }
+
+  public changeState(newState: UserState): void {
+    if (newState === UserState.USER_STATE_ACTIVE) {
+      this.mgmtUserService.reactivateUser(this.user.id).then(() => {
+        this.toast.showInfo('USER.TOAST.REACTIVATED', true);
+        this.user.state = newState;
+      }).catch(error => {
+        this.toast.showError(error);
+      });
+    } else if (newState === UserState.USER_STATE_INACTIVE) {
+      this.mgmtUserService.deactivateUser(this.user.id).then(() => {
+        this.toast.showInfo('USER.TOAST.DEACTIVATED', true);
+        this.user.state = newState;
+      }).catch(error => {
+        this.toast.showError(error);
+      });
+    }
+  }
+
+  public saveProfile(profileData: Profile.AsObject): void {
+    if (this.user.human) {
+      this.user.human.profile = profileData;
+      this.mgmtUserService
+        .updateHumanProfile(
+          this.user.id,
+          this.user.human.profile.firstName,
+          this.user.human.profile.lastName,
+          this.user.human.profile.nickName,
+          this.user.human.profile.displayName,
+          this.user.human.profile.preferredLanguage,
+          this.user.human.profile.gender)
+        .then(() => {
+          this.toast.showInfo('USER.TOAST.SAVED', true);
+          this.refreshChanges$.emit();
+        })
+        .catch(error => {
+          this.toast.showError(error);
        });
    }
+  }

-    public ngOnInit(): void {
+  public saveMachine(machineData: Machine.AsObject): void {
+    if (this.user.machine) {
+      this.user.machine.name = machineData.name;
+      this.user.machine.description = machineData.description;
+
+      this.mgmtUserService
+        .updateMachine(
+          this.user.id,
+          this.user.machine.name,
+          this.user.machine.description)
+        .then(() => {
+          this.toast.showInfo('USER.TOAST.SAVED', true);
+          this.refreshChanges$.emit();
+        })
+        .catch(error => {
+          this.toast.showError(error);
+        });
+    }
+  }
+
+  public resendEmailVerification(): void {
+    this.mgmtUserService.resendHumanEmailVerification(this.user.id).then(() => {
+      this.toast.showInfo('USER.TOAST.EMAILVERIFICATIONSENT', true);
+      this.refreshChanges$.emit();
+    }).catch(error => {
+      this.toast.showError(error);
+    });
+  }
+
+  public resendPhoneVerification(): void {
+    this.mgmtUserService.resendHumanPhoneVerification(this.user.id).then(() => {
+      this.toast.showInfo('USER.TOAST.PHONEVERIFICATIONSENT', true);
+      this.refreshChanges$.emit();
+    }).catch(error => {
+      this.toast.showError(error);
+    });
+  }
+
+  public deletePhone(): void {
+    this.mgmtUserService.removeHumanPhone(this.user.id).then(() => {
+      this.toast.showInfo('USER.TOAST.PHONEREMOVED', true);
+      if (this.user.human) {
+        this.user.human.phone = new Phone().setPhone('').toObject();
        this.refreshUser();
-    }
+      }
+    }).catch(error => {
+      this.toast.showError(error);
+    });
+  }

-    public changeState(newState: UserState): void {
-        if (newState === UserState.USER_STATE_ACTIVE) {
-            this.mgmtUserService.reactivateUser(this.user.id).then(() => {
-                this.toast.showInfo('USER.TOAST.REACTIVATED', true);
-                this.user.state = newState;
-            }).catch(error => {
-                this.toast.showError(error);
-            });
-        } else if (newState === UserState.USER_STATE_INACTIVE) {
-            this.mgmtUserService.deactivateUser(this.user.id).then(() => {
-                this.toast.showInfo('USER.TOAST.DEACTIVATED', true);
-                this.user.state = newState;
-            }).catch(error => {
-                this.toast.showError(error);
-            });
+  public saveEmail(email: string): void {
+    if (this.user.id && email) {
+      this.mgmtUserService.updateHumanEmail(this.user.id, email).then(() => {
+        this.toast.showInfo('USER.TOAST.EMAILSAVED', true);
+        if (this.user.state === UserState.USER_STATE_INITIAL) {
+          this.mgmtUserService.resendHumanInitialization(this.user.id, email ?? '').then(() => {
+            this.toast.showInfo('USER.TOAST.INITEMAILSENT', true);
+            this.refreshChanges$.emit();
+          }).catch(error => {
+            this.toast.showError(error);
+          });
        }
-    }
-
-    public saveProfile(profileData: Profile.AsObject): void {
        if (this.user.human) {
-            this.user.human.profile = profileData;
-            this.mgmtUserService
-                .updateHumanProfile(
-                    this.user.id,
-                    this.user.human.profile.firstName,
-                    this.user.human.profile.lastName,
-                    this.user.human.profile.nickName,
-                    this.user.human.profile.displayName,
-                    this.user.human.profile.preferredLanguage,
-                    this.user.human.profile.gender)
-                .then(() => {
-                    this.toast.showInfo('USER.TOAST.SAVED', true);
-                    this.refreshChanges$.emit();
-                })
-                .catch(error => {
-                    this.toast.showError(error);
-                });
+          this.user.human.email = new Email().setEmail(email).toObject();
+          this.refreshUser();
        }
+      }).catch(error => {
+        this.toast.showError(error);
+      });
    }
+  }

-    public saveMachine(machineData: Machine.AsObject): void {
-        if (this.user.machine) {
-            this.user.machine.name = machineData.name;
-            this.user.machine.description = machineData.description;
-
-            this.mgmtUserService
-                .updateMachine(
-                    this.user.id,
-                    this.user.machine.name,
-                    this.user.machine.description)
-                .then(() => {
-                    this.toast.showInfo('USER.TOAST.SAVED', true);
-                    this.refreshChanges$.emit();
-                })
-                .catch(error => {
-                    this.toast.showError(error);
-                });
-        }
-    }
-
-    public resendEmailVerification(): void {
-        this.mgmtUserService.resendHumanEmailVerification(this.user.id).then(() => {
-            this.toast.showInfo('USER.TOAST.EMAILVERIFICATIONSENT', true);
-            this.refreshChanges$.emit();
+  public savePhone(phone: string): void {
+    if (this.user.id && phone) {
+      this.mgmtUserService
+        .updateHumanPhone(this.user.id, phone).then(() => {
+          this.toast.showInfo('USER.TOAST.PHONESAVED', true);
+          if (this.user.human) {
+            this.user.human.phone = new Phone().setPhone(phone).toObject();
+            this.refreshUser();
+          }
        }).catch(error => {
-            this.toast.showError(error);
+          this.toast.showError(error);
        });
    }
+  }

-    public resendPhoneVerification(): void {
-        this.mgmtUserService.resendHumanPhoneVerification(this.user.id).then(() => {
-            this.toast.showInfo('USER.TOAST.PHONEVERIFICATIONSENT', true);
-            this.refreshChanges$.emit();
+  public navigateBack(): void {
+    this._location.back();
+  }
+
+  public sendSetPasswordNotification(): void {
+    this.mgmtUserService.sendHumanResetPasswordNotification(
+      this.user.id,
+      SendHumanResetPasswordNotificationRequest.Type.TYPE_EMAIL,
+    ).then(() => {
+      this.toast.showInfo('USER.TOAST.PASSWORDNOTIFICATIONSENT', true);
+      this.refreshChanges$.emit();
+    }).catch(error => {
+      this.toast.showError(error);
+    });
+  }
+
+  public deleteUser(): void {
+    const dialogRef = this.dialog.open(WarnDialogComponent, {
+      data: {
+        confirmKey: 'ACTIONS.DELETE',
+        cancelKey: 'ACTIONS.CANCEL',
+        titleKey: 'USER.DIALOG.DELETE_TITLE',
+        descriptionKey: 'USER.DIALOG.DELETE_DESCRIPTION',
+      },
+      width: '400px',
+    });
+
+    dialogRef.afterClosed().subscribe(resp => {
+      if (resp) {
+        this.mgmtUserService.removeUser(this.user.id).then(() => {
+          const params: Params = {
+            'deferredReload': true,
+          };
+          this.router.navigate(['/users/list', this.user.human ? 'humans' : 'machines'], { queryParams: params });
+          this.toast.showInfo('USER.TOAST.DELETED', true);
        }).catch(error => {
-            this.toast.showError(error);
+          this.toast.showError(error);
        });
-    }
+      }
+    });
+  }

-    public deletePhone(): void {
-        this.mgmtUserService.removeHumanPhone(this.user.id).then(() => {
-            this.toast.showInfo('USER.TOAST.PHONEREMOVED', true);
-            if (this.user.human) {
-                this.user.human.phone = new Phone().setPhone('').toObject();
-                this.refreshUser();
-            }
+  public resendInitEmail(): void {
+    const dialogRef = this.dialog.open(ResendEmailDialogComponent, {
+      width: '400px',
+    });
+
+    dialogRef.afterClosed().subscribe(resp => {
+      if (resp.send && this.user.id) {
+        this.mgmtUserService.resendHumanInitialization(this.user.id, resp.email ?? '').then(() => {
+          this.toast.showInfo('USER.TOAST.INITEMAILSENT', true);
+          this.refreshChanges$.emit();
        }).catch(error => {
-            this.toast.showError(error);
+          this.toast.showError(error);
        });
-    }
+      }
+    });
+  }

-    public saveEmail(email: string): void {
-        if (this.user.id && email) {
-            this.mgmtUserService.updateHumanEmail(this.user.id, email).then(() => {
-                this.toast.showInfo('USER.TOAST.EMAILSAVED', true);
-                if (this.user.state === UserState.USER_STATE_INITIAL) {
-                    this.mgmtUserService.resendHumanInitialization(this.user.id, email ?? '').then(() => {
-                        this.toast.showInfo('USER.TOAST.INITEMAILSENT', true);
-                        this.refreshChanges$.emit();
-                    }).catch(error => {
-                        this.toast.showError(error);
-                    });
-                }
-                if (this.user.human) {
-                    this.user.human.email = new Email().setEmail(email).toObject();
-                    this.refreshUser();
-                }
-            }).catch(error => {
-                this.toast.showError(error);
-            });
-        }
-    }
-
-    public savePhone(phone: string): void {
-        if (this.user.id && phone) {
-            this.mgmtUserService
-                .updateHumanPhone(this.user.id, phone).then(() => {
-                    this.toast.showInfo('USER.TOAST.PHONESAVED', true);
-                    if (this.user.human) {
-                        this.user.human.phone = new Phone().setPhone(phone).toObject();
-                        this.refreshUser();
-                    }
-                }).catch(error => {
-                    this.toast.showError(error);
-                });
-        }
-    }
-
-    public navigateBack(): void {
-        this._location.back();
-    }
-
-    public sendSetPasswordNotification(): void {
-        this.mgmtUserService.sendHumanResetPasswordNotification(
-            this.user.id,
-            SendHumanResetPasswordNotificationRequest.Type.TYPE_EMAIL,
-        ).then(() => {
-            this.toast.showInfo('USER.TOAST.PASSWORDNOTIFICATIONSENT', true);
-            this.refreshChanges$.emit();
-        }).catch(error => {
-            this.toast.showError(error);
-        });
-    }
-
-    public deleteUser(): void {
-        const dialogRef = this.dialog.open(WarnDialogComponent, {
-            data: {
-                confirmKey: 'ACTIONS.DELETE',
-                cancelKey: 'ACTIONS.CANCEL',
-                titleKey: 'USER.DIALOG.DELETE_TITLE',
-                descriptionKey: 'USER.DIALOG.DELETE_DESCRIPTION',
-            },
-            width: '400px',
+  public openEditDialog(type: EditDialogType): void {
+    switch (type) {
+      case EditDialogType.PHONE:
+        const dialogRefPhone = this.dialog.open(EditDialogComponent, {
+          data: {
+            confirmKey: 'ACTIONS.SAVE',
+            cancelKey: 'ACTIONS.CANCEL',
+            labelKey: 'ACTIONS.NEWVALUE',
+            titleKey: 'USER.LOGINMETHODS.PHONE.EDITTITLE',
+            descriptionKey: 'USER.LOGINMETHODS.PHONE.EDITDESC',
+            value: this.user.human?.phone?.phone,
+            type: EditDialogType.PHONE,
+          },
+          width: '400px',
        });

-        dialogRef.afterClosed().subscribe(resp => {
-            if (resp) {
-                this.mgmtUserService.removeUser(this.user.id).then(() => {
-                    const params: Params = {
-                        'deferredReload': true,
-                    };
-                    this.router.navigate(['/users/list', this.user.human ? 'humans' : 'machines'], { queryParams: params });
-                    this.toast.showInfo('USER.TOAST.DELETED', true);
-                }).catch(error => {
-                    this.toast.showError(error);
-                });
-            }
+        dialogRefPhone.afterClosed().subscribe(resp => {
+          if (resp) {
+            this.savePhone(resp);
+          }
        });
-    }
-
-    public resendInitEmail(): void {
-        const dialogRef = this.dialog.open(ResendEmailDialogComponent, {
-            width: '400px',
+        break;
+      case EditDialogType.EMAIL:
+        const dialogRefEmail = this.dialog.open(EditDialogComponent, {
+          data: {
+            confirmKey: 'ACTIONS.SAVE',
+            cancelKey: 'ACTIONS.CANCEL',
+            labelKey: 'ACTIONS.NEWVALUE',
+            titleKey: 'USER.LOGINMETHODS.EMAIL.EDITTITLE',
+            descriptionKey: 'USER.LOGINMETHODS.EMAIL.EDITDESC',
+            value: this.user.human?.email?.email,
+            type: EditDialogType.EMAIL,
+          },
+          width: '400px',
        });

-        dialogRef.afterClosed().subscribe(resp => {
-            if (resp.send && this.user.id) {
-                this.mgmtUserService.resendHumanInitialization(this.user.id, resp.email ?? '').then(() => {
-                    this.toast.showInfo('USER.TOAST.INITEMAILSENT', true);
-                    this.refreshChanges$.emit();
-                }).catch(error => {
-                    this.toast.showError(error);
-                });
-            }
+        dialogRefEmail.afterClosed().subscribe(resp => {
+          if (resp) {
+            this.saveEmail(resp);
+          }
        });
+        break;
    }
-
-    public openEditDialog(type: EditDialogType): void {
-        switch (type) {
-            case EditDialogType.PHONE:
-                const dialogRefPhone = this.dialog.open(EditDialogComponent, {
-                    data: {
-                        confirmKey: 'ACTIONS.SAVE',
-                        cancelKey: 'ACTIONS.CANCEL',
-                        labelKey: 'ACTIONS.NEWVALUE',
-                        titleKey: 'USER.LOGINMETHODS.PHONE.EDITTITLE',
-                        descriptionKey: 'USER.LOGINMETHODS.PHONE.EDITDESC',
-                        value: this.user.human?.phone?.phone,
-                        type: EditDialogType.PHONE,
-                    },
-                    width: '400px',
-                });
-
-                dialogRefPhone.afterClosed().subscribe(resp => {
-                    if (resp) {
-                        this.savePhone(resp);
-                    }
-                });
-                break;
-            case EditDialogType.EMAIL:
-                const dialogRefEmail = this.dialog.open(EditDialogComponent, {
-                    data: {
-                        confirmKey: 'ACTIONS.SAVE',
-                        cancelKey: 'ACTIONS.CANCEL',
-                        labelKey: 'ACTIONS.NEWVALUE',
-                        titleKey: 'USER.LOGINMETHODS.EMAIL.EDITTITLE',
-                        descriptionKey: 'USER.LOGINMETHODS.EMAIL.EDITDESC',
-                        value: this.user.human?.email?.email,
-                        type: EditDialogType.EMAIL,
-                    },
-                    width: '400px',
-                });
-
-                dialogRefEmail.afterClosed().subscribe(resp => {
-                    if (resp) {
-                        this.saveEmail(resp);
-                    }
-                });
-                break;
-        }
-    }
+  }
 }