WSO2 Identity Server 5.11账号重置密码API首次校验异常咨询

问题现象 #

使用账号恢复REST API重置密码时，首次将密码设回注册时的初始密码，密码历史验证策略未生效（API返回200）；第二次及之后重复该操作，会触发预期的密码历史校验（返回412错误）。

复现步骤 #

1. 配置密码历史验证规则：

[identity_mgt.password_policy]
enable_password_history=true
no_of_previous_passwords_to_disallow=10

2. 发送密码恢复确认请求：

curl -X POST -H "Authorization: Basic YWRtaW46YWRtaW4=" -H "Content-Type: application/json" -d '{"user": {"username": "[USERNAME]","realm": "[USER STORE NAME]","tenant-domain":"[TENANT DOMAIN NAME]"},"properties": []}' "https://localhost:9443/api/identity/recovery/v0.9/recover-password?type=email&notify=true"

3. 使用确认密钥，将密码重置为注册时的初始密码：

curl -X POST -H "Authorization: Basic YWRtaW46YWRtaW4=" -H "Content-Type: application/json" -d '{"key": "[CONFIRMATION KEY]", "password": "[注册时的初始密码]","properties": []}' "https://localhost:9443/api/identity/recovery/v0.9/set-password"

实际与预期响应 #

• 实际响应（首次操作）：

< HTTP/1.1 200 
< X-Frame-Options: DENY
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Date: Thu, 30 Nov 2023 14:33:41 GMT
< Content-Length: 0

• 预期响应（首次操作）：

< HTTP/1.1 412 
< X-Frame-Options: DENY
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
/v0.9; Secure; HttpOnly
< Date: Thu, 30 Nov 2023 14:34:50 GMT
< Content-Type: application/json
< Transfer-Encoding: chunked
< Server: 
< 
* Connection #1 to host localhost left intact
{"code":"22001","message":"This password has been used in recent history. Please choose a different password","description":"This password has been used in recent history. Please choose a different password","key":"XXXX-XXXX-XXXX"}

核心疑问解答 #

注册时设置的初始密码默认不会被纳入密码历史记录：

WSO2 IS 5.11的密码历史机制仅会记录用户后续主动修改/重置成功后的密码，注册阶段的初始密码不会自动写入历史存储。这就导致第一次重置回初始密码时，系统无法检测到该密码属于历史密码，因此跳过校验返回200。

而当第一次重置操作成功完成后（哪怕是设回初始密码），该密码会被添加到密码历史列表中，因此第二次尝试设回该密码时，系统会触发历史校验，返回预期的412错误。

内容的提问来源于stack exchange，提问作者Soufiane