Change profile fields without privileged session mode

[dro-sh]

I would like to update some not critical user profile fields. But kratos requires to reauthnticate me again after privileged session lifetime. Is there opportunity to update such fields without reauthentication?

[vinckr]

Hello @dro-sh

In Ory Kratos fields that are used for authentication (e.g., as a login identifier) or for recovery/verification are considered privileged and will require a privileged session to update.
You should be able to update critical traits without reauthentication.

[dro-sh]

Thank you for answer! But I dont understand, maybe I didn't explained properly my usecase.
For example, I use quickstart from kratos repository using email-password schema.
Do next steps:

1. In kratos.yml change selfservice.flows.settings.privileged_session_max_age to 1m and remove required_aal: highest_available, disable haveibeenpwned_enabled to set simplest password.
2. Run quickstart

git checkout v1.3.1
docker-compose -f quickstart.yml -f quickstart-standalone.yml up --force-recreate

3. In http://localhost:4455/registration register user. Email: test@example.com. First Name: First. Last name: Last. Password: test12345.
4. Verify account in http://localhost:4436/
5. Open settings http://127.0.0.1:4455/settings
6. Try to change First Name and/or Last Name after privileged_session_max_age in 1m. System requires me to reauthenticate.

So how to setup First Name and Last Name to be changeable without privileged session?

P.S. I found place where checked protected traits: https://github.com/ory/kratos/blob/master/identity/manager.go#L499
But I dont understand, why this method returns error, if I change only First Name or Last Name and keep Email the same. Any suggestions? @vinckr

[dro-sh]

I found issue. See on second condition in method requiresPrivilegedAccess, it uses reflect.DeepEqual for deep VerifiableAddresses comparation. I create gist for testing deep comparation of VerifiableAddresses. And turn out that slices are not deeply equal then VerifiedAt is not nil.

So if email (the identifier for example below) not verified, user can change not protected traits without privileged session, because. But then email verified user must reauthenticate to get privileged session

[dro-sh]

@vinckr any update?