VirtoCommerce/vc-platform

When password login is disabled, Management UI still shows password-related components

j-mok opened this issue · 3 comments

j-mok commented

Some password-login-specific elements of the UI are still visible after switching to Azure AD authentication.

Steps to reproduce
Steps to reproduce the behavior:

  1. Disable password login in appsettings.json:
"PasswordLogin": {
        "Enabled": false
    },
  1. Enable Azure Active Directory:
"AzureAd": {
        "Enabled": true,
        ...
    },
  1. Log into VC Manager with an AD account
  2. Click the profile drop-down in the upper right corner to reveal Change password entry is still there
  3. Log into VC Manager as an administrator
  4. Go to the Security module and select an AD user to reveal that Change password button is still there

Expected behavior
All password-related features should be hidden both in own profile and security blade views when password login is disabled. Anything related to user credentials should be handled by Azure Active Directory. Alternatively password-manipulation components should be visible but marked with a warning when password login is disabled.

Version info:

  • Platform version: 3.100.0
dvvkgd commented

Hi, @j-mok .
Thanks for the feedback. Very helpful remark. I submitted this case to the platform team for research and estimate.
I will inform you about the decision.

  • 👍1