Refactor password reset link domain flow

[erikbocks]

Description

Currently, when a user tries to reset their password, an email is sent with a link that leads to a page where the user can redefine its password. However, this link uses the first value of the host configuration as the Management Server's domain. For some environments, it may not be interesting to expose the Management Server's IP in the URL.

In order to fix this, the Management Server's domain definition workflow was refactored. Now, the request's domain is obtained. Then, GUI themes whose common names match the request's domain are fetched (being the common name a wildcard or the domain itself). If a theme is found, the request's domain is used for the password reset link.

Nevertheless, if no theme is found, the value of the user.password.reset.mail.domain.url global configuration is obtained. If the configuration has a defined value, it is used as the email's domain. But, if no value is defined, the current behavior is maintained and the first IP address of the host configuration is used.

With the refactoring, logs were also added to the domain selection process, allowing an easier troubleshooting process.

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Screenshots (if appropriate):

How Has This Been Tested?

Without any GUI theme and the user.password.reset.mail.domain.url set as null, I requested a password reset link. Then, I validated that the host configuration first IP was used, and the right protocol and port were set automatically.

Management's IP test

2026-05-21 11:26:24,195 DEBUG [o.a.c.u.UserPasswordResetManagerImpl] (qtp1845623216-27:[ctx-20e31090]) (logid:dded0813) Searching for GUI theme with common name that matches the request's domain: [192.168.122.200]
2026-05-21 11:26:24,196 DEBUG [o.a.c.u.UserPasswordResetManagerImpl] (qtp1845623216-27:[ctx-20e31090]) (logid:dded0813) No GUI theme was found with a common name that matches the request's domain.
2026-05-21 11:26:24,198 DEBUG [o.a.c.u.UserPasswordResetManagerImpl] (qtp1845623216-27:[ctx-20e31090]) (logid:dded0813) Using the first IP address in the [host] configuration for the reset password email domain because the [user.password.reset.mail.domain.url] configuration is not defined.

Then, I set the user.password.reset.mail.domain.url configuration to another domain and requested a new password reset link. After checking the email, It was possible to observe that the configuration's value was used.

Configuration test

2026-05-21 11:32:42,926 DEBUG [o.a.c.u.UserPasswordResetManagerImpl] (qtp1845623216-369:[ctx-90b4d491]) (logid:cfe79631) Searching for GUI theme with common name that matches the request's domain: [192.168.122.200]
2026-05-21 11:32:42,927 DEBUG [o.a.c.u.UserPasswordResetManagerImpl] (qtp1845623216-369:[ctx-90b4d491]) (logid:cfe79631) No GUI theme was found with a common name that matches the request's domain.
2026-05-21 11:32:42,928 DEBUG [o.a.c.u.UserPasswordResetManagerImpl] (qtp1845623216-369:[ctx-90b4d491]) (logid:cfe79631) Defaulting reset link's domain to the [user.password.reset.mail.domain.url] configuration value: [labdomain.com.br].

At last, I created a GUI theme with a common name and also mapped it to my local /etc/hosts file. I used the configured common name to access the application login page, and requested a password reset link. When I received it, it was possible to observe that the reset link's domain was the GUI theme's configured common name.

GUI theme test

026-05-21 11:44:16,999 DEBUG [o.a.c.u.UserPasswordResetManagerImpl] (qtp1845623216-404:[ctx-069fe969]) (logid:f7f485e0) Searching for GUI theme with common name that matches the request's domain: [laboratorio.com]
2026-05-21 11:44:17,001 DEBUG [o.a.c.u.UserPasswordResetManagerImpl] (qtp1845623216-404:[ctx-069fe969]) (logid:f7f485e0) GUI theme with ID 1 was found; using request's domain for password reset link.

[codecov]

Codecov Report

❌ Patch coverage is 8.82353% with 31 lines in your changes missing coverage. Please review.
✅ Project coverage is 18.09%. Comparing base (a470914) to head (dc4bcb1).
⚠️ Report is 27 commits behind head on main.

Files with missing lines	Patch %	Lines
.../cloudstack/user/UserPasswordResetManagerImpl.java	0.00%	27 Missing ⚠️
...ava/org/apache/cloudstack/context/CallContext.java	33.33%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##               main   #13209    +/-   ##
==========================================
  Coverage     18.08%   18.09%            
- Complexity    16718    16730    +12     
==========================================
  Files          6037     6037            
  Lines        542611   542803   +192     
  Branches      66433    66465    +32     
==========================================
+ Hits          98136    98224    +88     
- Misses       433448   433530    +82     
- Partials      11027    11049    +22     

Flag	Coverage Δ
uitests	3.51% <ø> (ø)
unittests	19.26% <8.82%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[winterhazel]

@blueorangutan package

[blueorangutan]

@winterhazel a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18204

[DaanHoogland]

@blueorangutan test

[blueorangutan]

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

[blueorangutan]

[SF] Trillian test result (tid-16326)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 49365 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13209-t16326-kvm-ol8.zip
Smoke tests completed. 151 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File