#4653 There is no method to compare old and current password since SecretTexts cannot be compared in Cloud

[bc4all]

Summary

Adding the function to compare secret texts for Password module. The new function is needed to make sure that the two passwords match. There is already function ValidateOldPasswordMatch in Implementation however it cannot be used since:

1. Name is not correct
2. It is not used in any facade codeunit
3. it exists if the input is empty

Therefore for clarity the similar function has been added with the proper name. Also to facade codeunit the function has been added to be able to run it by developers.

Work Item(s) #4653

Fixes #4653

Fixes AB#602113

[bc4all]

@microsoft-github-policy-service agree

[JesperSchulz]

The PR did not pass the security review 🥺 @darjoo might be able to elaborate.

[bc4all]

@JesperSchulz @darjoo thank you for info but I need more info since the MS broke our code (an therefore whole solution that is used by customers). Moreover there is no alternative ways to do it in proper way just by bypassing MS system modules:

1. The code is exact copy of code you already use in the module - check functions ValidateOldPasswordMatch and ValidateNewPasswordUniqueness. How this procedure that is propose does not pass security validation and Microsoft code pass it?
2. How it is possible that nondebuggable code that is marked as onPrem only (run only on MS server) is not secure?
3. If this code break the security how developers can in a secure way compare SecretTexts? Password is only one thing but there are other partners also waiting on this.
4. If there are no ways to do it why you remove functions that cannot be replaced by other way that coping whole module?

I am really looking forward to get your answer on this since I need to take an action

[bc4all]

BTW: Without this change the whole module is rather useless in the system (and this is not a comment - but rather fact or question so it would help to solve the issue with the process).

If I am missing something and having this scenario:

1. User use Password Dialog to create new password
2. Developer get a SecretText from the function OpenSecretPasswordDialog(true, true)
3. Developer store the password somewhere (example - islolated storege) - most likely with hash etc.
4. User run function that requires confirm the password (there are reasons why someone use passwords after all)
5. Developer runs the function OpenSecretPasswordDialog(false,false) and get the password typed by user as SecretText
6. Developer needs to compare if passwords match

How to accomplish in current state point 6?
As mentioned before:

1. AL does not allow to compare SecretTexts
2. AL Cloud does not allow unwrap() on SecretTexts
3. There is no public function that allow to compare SecretTexts on server side

The problem is that OpenSecretPasswordDialog in 26 returned texts now secret texts - which in general of course make sense but without any option to compare SecretTexts it is breaking change

[StefanMaron]

I dont see any issues with this

[JesperSchulz]

I don't know any details yet unfortunately, but I will try to get answers to your questions! I should have waited to post the rejection until I know the background. Was a bit too quick there.
But then again, now we have more context, which is helpful. We'll be in touch!

[JesperSchulz]

@bc4all, your case has been reopened based on the detailed background you provided, which was most helpful. We're looking into options to unblock you.
When do you need those changes. Are these a must for 27.0, or can you wait until 27.1? Just so that I understand the urgency of this request?

[bc4all]

In the worst case scenario we can wait until 27.1 I know how you all are busy right now before release.

[dannoe]

Maybe it was rejected because we can bruteforce SecretTexts with this method.

[JesperSchulz]

Maybe it was rejected because we can bruteforce SecretTexts with this method.

That was indeed one of the points that was brought up, but after thorough discussions we've landed on the conclusion that the risk of abuse is minimal, while the benefits of having this capability are clear. The decision has hence been revised and we now got security clearance to move forward with this PR 🥳

[darjoo]

Rediscussed internally, approving.