Auth/PM-3275 - Changes to support TDE User without MP being able to Set a Password (#6281)

* PM-3275 - Policy.service - Refactor existing mapPoliciesFromToken internal logic to provide public mapPolicyFromResponse method * PM-3275 - Add new PolicyApiService.getMasterPasswordPolicyOptsForOrgUser method for use in the set password comp * PM-3275 - Update set-password.comp to use new policyApiService.getMasterPasswordPoliciesForInvitedUsers method * PM-3275 - (1) Remove post TDE AuthN set password routing logic from SSO/2FA comps as we cannot set an initial user password until after decryption in order to avoid losing the ability to decrypt existing vault items (a new user key would be created if one didn't exist in memory) (2) Add set password routing logic post TDE decryption in LoginWithDevice/Lock components (3) Add new ForceResetPasswordReason to capture this case so that we can guard against users manually navigating away from the set password screen * PM-3275 - SyncSvc - Add logic for setting forcePasswordReset reason if TDE user w/out MP went from not having MP reset permission to having it. * PM-3275 - Rename ForceResetPasswordReason enum to ForceSetPasswordReason + update all references. * PM-3275 - Removing client deprecated calls to getPoliciesByInvitedUser and helper call getMasterPasswordPoliciesForInvitedUsers * PM-3275 - PolicyAPI service - remove no longer necessary getPoliciesByInvitedUser method * PM-3275 - LockComp - TODO cleanup * PM-3275 - SSO & 2FA comp - cleanup of incorrect routing path * PM-3275 - (1) State service refactor - change getForcePasswordResetReason / setForcePasswordResetReason to be getForceSetPasswordReason / setForceSetPasswordReason (2) Sync Service - encapsulate setForceSetPasswordReasonIfNeeded logic into own method * PM-3275 - SetPassword Comp - Rename "identifier" to be "orgSsoIdentifier" for clarity * PM-3275 - SetPasswordComp - Moving routing from SSO / 2FA comps to Lock / LoginWithDevice comps results in a loss of the the OrgSsoId. However, as part of the TDE work, we added the OrgSsoId to state so use that as a fallback so we can accurately evaluate if the user needs to be auto enrolled in admin account recovery. * PM-3275 - SetPasswordComp - add a bit more context to why/when we are reading the user org sso id out of state * PM-3275 - SetPassword Comp - (1) Add forceSetPasswordReason and ForceSetPasswordReason enum as public props on the class so we can change copy text based on which is set + set forceSetPasswordReason on ngOnInit (2) Refactor ngOnInit to use a single RxJs observable chain for primary logic as the auto enroll check was occurring before the async getUserSsoOrganizationIdentifier could finish. * PM-3275 - Desktop - App comp - missed replacing getForcePasswordResetReason with getForceSetPasswordReason * PM-3275 - TDE Decryption Option Comps - must set ForceSetPasswordReason so that we can properly enforce keeping the user on the component + display the correct copy explaining the scenario to the user. * PM-3275 - All Clients - SetPasswordComp html - Update page description per product + remove no longer used ssoCompleteRegistration translation. * PM-3275 - SetPasswordComp - hopefully the final puzzle piece - must clear ForceSetPasswordReason in order to let user navigate back to vault. * PM-3275 - SyncService - Remove check for previous value of account decryption options hasManageResetPasswordPermission as when a user logged in on a trusted device after having their permissions updated, the initial setting would be true and it would cause the flag to NOT be set when it should have. * PM-3275 - TDE User Context - (1) Remove explicit navigation to set password screen from post decryption success scenarios on lock & login w/ device comps (2) Move TdeUserWithoutPasswordHasPasswordResetPermission flag setting to SSO / 2FA components to support both trusted and untrusted device scenarios (both of which are now caught by the auth guard). * PM-3275 - (1) SetPassword comp - adjust set password logic for TDE users to avoid creating a new user asymmetric key pair and setting a new private key in memory. (2) Adjust SetPasswordRequest to allow null keys * PM-3275 - Remove unused route from login with device comp * PM-3275 - Sso & 2FA comp tests - Update tests to reflect new routing logic when TDE user needs to set a password * PM-3275 - Lock comp - per PR feedback, remove unused setPasswordRoute property. * PM-3275 - SetPasswordComp - Per PR feedback, use explicit null check * PM-3275 - Per PR Feedback, rename missed forcePasswordResetReason to be forceSetPasswordReason on account model * PM-3275 - Auth guard - rename forcePasswordResetReason to forceSetPasswordReason * PM-3275 - SSO / 2FA comps - Per PR feedback, refactor Admin Force Password reset handling to be in one place above the TDE user flows and standard user flows as it applies to both. * PM-3275 - Per PR feedback, clarify 2FA routing comment * PM-3275 - Per PR feedback, update set-password comp ngOnInit switchMaps to just return promises as switchMap converts promises to observables internally. * PM-3275 - Per PR feedback, refactor set password ngOnInit observable chain to avoid using async subscribe and instead simply sequence the calls via switchMap and tap for side effects. * PM-3275 - Per PR feedback, move tap after filter so we can remove if check * PM-3275 - Per PR feedback, update policy service mapping methods to use shorthand null checking. * PM-3275 - SetPassword comp - (1) Move force set password reason logic into onSetPasswordSuccess(...) (2) On onSetPasswordSuccess, must set hasMasterPassword to true for user verification scenarios. * PM-3275 - Per PR feedback, remove new hasManageResetPasswordPermission flag from profile response and instead simply read the information off the existing profile.organizations data as the information I needed was already present. * PM-4633 - PolicyService - mapPolicyFromResponse(...) - remove incorrect null check for data. Policies with internal null data property should still be evaluated and turned into Policy objects or the policy array ends up having null values in it and it causes errors down the line on login after acct creation.
2025-12-14 15:23:33 +00:00 · 2023-11-03 11:33:10 -04:00
parent 64152b6ed2
commit 161c1c63ff
34 changed files with 422 additions and 187 deletions
--- a/libs/common/src/admin-console/abstractions/policy/policy-api.service.abstraction.ts
+++ b/libs/common/src/admin-console/abstractions/policy/policy-api.service.abstraction.ts
@@ -14,10 +14,7 @@ export class PolicyApiServiceAbstraction {
    email: string,
    organizationUserId: string
  ) => Promise<ListResponse<PolicyResponse>>;
-  getPoliciesByInvitedUser: (
-    organizationId: string,
-    userId: string
-  ) => Promise<ListResponse<PolicyResponse>>;
-  getMasterPasswordPoliciesForInvitedUsers: (orgId: string) => Promise<MasterPasswordPolicyOptions>;
+
+  getMasterPasswordPolicyOptsForOrgUser: (orgId: string) => Promise<MasterPasswordPolicyOptions>;
  putPolicy: (organizationId: string, type: PolicyType, request: PolicyRequest) => Promise<any>;
 }
--- a/libs/common/src/admin-console/abstractions/policy/policy.service.abstraction.ts
+++ b/libs/common/src/admin-console/abstractions/policy/policy.service.abstraction.ts
@@ -30,6 +30,7 @@ export abstract class PolicyService {
    policies: Policy[],
    orgId: string
  ) => [ResetPasswordPolicyOptions, boolean];
+  mapPolicyFromResponse: (policyResponse: PolicyResponse) => Policy;
  mapPoliciesFromToken: (policiesResponse: ListResponse<PolicyResponse>) => Policy[];
  policyAppliesToUser: (
    policyType: PolicyType,
--- a/libs/common/src/admin-console/services/policy/policy-api.service.ts
+++ b/libs/common/src/admin-console/services/policy/policy-api.service.ts
@@ -1,6 +1,8 @@
 import { firstValueFrom } from "rxjs";

 import { ApiService } from "../../../abstractions/api.service";
+import { HttpStatusCode } from "../../../enums";
+import { ErrorResponse } from "../../../models/response/error.response";
 import { ListResponse } from "../../../models/response/list.response";
 import { StateService } from "../../../platform/abstractions/state.service";
 import { Utils } from "../../../platform/misc/utils";
@@ -65,27 +67,47 @@ export class PolicyApiService implements PolicyApiServiceAbstraction {
    return new ListResponse(r, PolicyResponse);
  }

-  async getPoliciesByInvitedUser(
-    organizationId: string,
-    userId: string
-  ): Promise<ListResponse<PolicyResponse>> {
-    const r = await this.apiService.send(
+  private async getMasterPasswordPolicyResponseForOrgUser(
+    organizationId: string
+  ): Promise<PolicyResponse> {
+    const response = await this.apiService.send(
      "GET",
-      "/organizations/" + organizationId + "/policies/invited-user?" + "userId=" + userId,
+      "/organizations/" + organizationId + "/policies/master-password",
      null,
-      false,
+      true,
      true
    );
-    return new ListResponse(r, PolicyResponse);
+
+    return new PolicyResponse(response);
  }

-  async getMasterPasswordPoliciesForInvitedUsers(
+  async getMasterPasswordPolicyOptsForOrgUser(
    orgId: string
-  ): Promise<MasterPasswordPolicyOptions> {
-    const userId = await this.stateService.getUserId();
-    const response = await this.getPoliciesByInvitedUser(orgId, userId);
-    const policies = await this.policyService.mapPoliciesFromToken(response);
-    return await firstValueFrom(this.policyService.masterPasswordPolicyOptions$(policies));
+  ): Promise<MasterPasswordPolicyOptions | null> {
+    try {
+      const masterPasswordPolicyResponse = await this.getMasterPasswordPolicyResponseForOrgUser(
+        orgId
+      );
+
+      const masterPasswordPolicy = this.policyService.mapPolicyFromResponse(
+        masterPasswordPolicyResponse
+      );
+
+      if (!masterPasswordPolicy) {
+        return null;
+      }
+
+      return await firstValueFrom(
+        this.policyService.masterPasswordPolicyOptions$([masterPasswordPolicy])
+      );
+    } catch (error) {
+      // If policy not found, return null
+      if (error instanceof ErrorResponse && error.statusCode === HttpStatusCode.NotFound) {
+        return null;
+      }
+      // otherwise rethrow error
+      throw error;
+    }
  }

  async putPolicy(organizationId: string, type: PolicyType, request: PolicyRequest): Promise<any> {
--- a/libs/common/src/admin-console/services/policy/policy.service.ts
+++ b/libs/common/src/admin-console/services/policy/policy.service.ts
@@ -218,13 +218,17 @@ export class PolicyService implements InternalPolicyServiceAbstraction {
    return [resetPasswordPolicyOptions, policy?.enabled ?? false];
  }

+  mapPolicyFromResponse(policyResponse: PolicyResponse): Policy {
+    const policyData = new PolicyData(policyResponse);
+    return new Policy(policyData);
+  }
+
  mapPoliciesFromToken(policiesResponse: ListResponse<PolicyResponse>): Policy[] {
-    if (policiesResponse == null || policiesResponse.data == null) {
+    if (policiesResponse?.data == null) {
      return null;
    }

-    const policiesData = policiesResponse.data.map((p) => new PolicyData(p));
-    return policiesData.map((p) => new Policy(p));
+    return policiesResponse.data.map((response) => this.mapPolicyFromResponse(response));
  }

  async policyAppliesToUser(
--- a/libs/common/src/auth/login-strategies/login.strategy.spec.ts
+++ b/libs/common/src/auth/login-strategies/login.strategy.spec.ts
@@ -33,7 +33,7 @@ import { TokenService } from "../abstractions/token.service";
 import { TwoFactorService } from "../abstractions/two-factor.service";
 import { TwoFactorProviderType } from "../enums/two-factor-provider-type";
 import { AuthResult } from "../models/domain/auth-result";
-import { ForceResetPasswordReason } from "../models/domain/force-reset-password-reason";
+import { ForceSetPasswordReason } from "../models/domain/force-set-password-reason";
 import { PasswordLoginCredentials } from "../models/domain/login-credentials";
 import { PasswordTokenRequest } from "../models/request/identity-token/password-token.request";
 import { TokenTwoFactorRequest } from "../models/request/identity-token/token-two-factor.request";
@@ -229,7 +229,7 @@ describe("LoginStrategy", () => {
      const result = await passwordLoginStrategy.logIn(credentials);

      expect(result).toEqual({
-        forcePasswordReset: ForceResetPasswordReason.AdminForcePasswordReset,
+        forcePasswordReset: ForceSetPasswordReason.AdminForcePasswordReset,
        resetMasterPassword: true,
        twoFactorProviders: null,
        captchaSiteKey: "",
--- a/libs/common/src/auth/login-strategies/login.strategy.ts
+++ b/libs/common/src/auth/login-strategies/login.strategy.ts
@@ -18,7 +18,7 @@ import { TokenService } from "../abstractions/token.service";
 import { TwoFactorService } from "../abstractions/two-factor.service";
 import { TwoFactorProviderType } from "../enums/two-factor-provider-type";
 import { AuthResult } from "../models/domain/auth-result";
-import { ForceResetPasswordReason } from "../models/domain/force-reset-password-reason";
+import { ForceSetPasswordReason } from "../models/domain/force-set-password-reason";
 import {
  AuthRequestLoginCredentials,
  PasswordLoginCredentials,
@@ -166,7 +166,7 @@ export abstract class LoginStrategy {

    // Convert boolean to enum
    if (response.forcePasswordReset) {
-      result.forcePasswordReset = ForceResetPasswordReason.AdminForcePasswordReset;
+      result.forcePasswordReset = ForceSetPasswordReason.AdminForcePasswordReset;
    }

    // Must come before setting keys, user key needs email to update additional keys
--- a/libs/common/src/auth/login-strategies/password-login.strategy.spec.ts
+++ b/libs/common/src/auth/login-strategies/password-login.strategy.spec.ts
@@ -24,7 +24,7 @@ import { AuthService } from "../abstractions/auth.service";
 import { TokenService } from "../abstractions/token.service";
 import { TwoFactorService } from "../abstractions/two-factor.service";
 import { TwoFactorProviderType } from "../enums/two-factor-provider-type";
-import { ForceResetPasswordReason } from "../models/domain/force-reset-password-reason";
+import { ForceSetPasswordReason } from "../models/domain/force-set-password-reason";
 import { PasswordLoginCredentials } from "../models/domain/login-credentials";
 import { IdentityTokenResponse } from "../models/response/identity-token.response";
 import { IdentityTwoFactorResponse } from "../models/response/identity-two-factor.response";
@@ -154,7 +154,7 @@ describe("PasswordLoginStrategy", () => {
    const result = await passwordLoginStrategy.logIn(credentials);

    expect(policyService.evaluateMasterPassword).not.toHaveBeenCalled();
-    expect(result.forcePasswordReset).toEqual(ForceResetPasswordReason.None);
+    expect(result.forcePasswordReset).toEqual(ForceSetPasswordReason.None);
  });

  it("does not force the user to update their master password when it meets requirements", async () => {
@@ -164,7 +164,7 @@ describe("PasswordLoginStrategy", () => {
    const result = await passwordLoginStrategy.logIn(credentials);

    expect(policyService.evaluateMasterPassword).toHaveBeenCalled();
-    expect(result.forcePasswordReset).toEqual(ForceResetPasswordReason.None);
+    expect(result.forcePasswordReset).toEqual(ForceSetPasswordReason.None);
  });

  it("forces the user to update their master password on successful login when it does not meet master password policy requirements", async () => {
@@ -174,10 +174,10 @@ describe("PasswordLoginStrategy", () => {
    const result = await passwordLoginStrategy.logIn(credentials);

    expect(policyService.evaluateMasterPassword).toHaveBeenCalled();
-    expect(stateService.setForcePasswordResetReason).toHaveBeenCalledWith(
-      ForceResetPasswordReason.WeakMasterPassword
+    expect(stateService.setForceSetPasswordReason).toHaveBeenCalledWith(
+      ForceSetPasswordReason.WeakMasterPassword
    );
-    expect(result.forcePasswordReset).toEqual(ForceResetPasswordReason.WeakMasterPassword);
+    expect(result.forcePasswordReset).toEqual(ForceSetPasswordReason.WeakMasterPassword);
  });

  it("forces the user to update their master password on successful 2FA login when it does not meet master password policy requirements", async () => {
@@ -210,12 +210,12 @@ describe("PasswordLoginStrategy", () => {
    );

    // First login attempt should not save the force password reset options
-    expect(firstResult.forcePasswordReset).toEqual(ForceResetPasswordReason.None);
+    expect(firstResult.forcePasswordReset).toEqual(ForceSetPasswordReason.None);

    // Second login attempt should save the force password reset options and return in result
-    expect(stateService.setForcePasswordResetReason).toHaveBeenCalledWith(
-      ForceResetPasswordReason.WeakMasterPassword
+    expect(stateService.setForceSetPasswordReason).toHaveBeenCalledWith(
+      ForceSetPasswordReason.WeakMasterPassword
    );
-    expect(secondResult.forcePasswordReset).toEqual(ForceResetPasswordReason.WeakMasterPassword);
+    expect(secondResult.forcePasswordReset).toEqual(ForceSetPasswordReason.WeakMasterPassword);
  });
 });
--- a/libs/common/src/auth/login-strategies/password-login.strategy.ts
+++ b/libs/common/src/auth/login-strategies/password-login.strategy.ts
@@ -14,7 +14,7 @@ import { AuthService } from "../abstractions/auth.service";
 import { TokenService } from "../abstractions/token.service";
 import { TwoFactorService } from "../abstractions/two-factor.service";
 import { AuthResult } from "../models/domain/auth-result";
-import { ForceResetPasswordReason } from "../models/domain/force-reset-password-reason";
+import { ForceSetPasswordReason } from "../models/domain/force-set-password-reason";
 import { PasswordLoginCredentials } from "../models/domain/login-credentials";
 import { PasswordTokenRequest } from "../models/request/identity-token/password-token.request";
 import { TokenTwoFactorRequest } from "../models/request/identity-token/token-two-factor.request";
@@ -42,7 +42,7 @@ export class PasswordLoginStrategy extends LoginStrategy {
   * Options to track if the user needs to update their password due to a password that does not meet an organization's
   * master password policy.
   */
-  private forcePasswordResetReason: ForceResetPasswordReason = ForceResetPasswordReason.None;
+  private forcePasswordResetReason: ForceSetPasswordReason = ForceSetPasswordReason.None;

  constructor(
    cryptoService: CryptoService,
@@ -82,9 +82,9 @@ export class PasswordLoginStrategy extends LoginStrategy {
    if (
      !result.requiresTwoFactor &&
      !result.requiresCaptcha &&
-      this.forcePasswordResetReason != ForceResetPasswordReason.None
+      this.forcePasswordResetReason != ForceSetPasswordReason.None
    ) {
-      await this.stateService.setForcePasswordResetReason(this.forcePasswordResetReason);
+      await this.stateService.setForceSetPasswordReason(this.forcePasswordResetReason);
      result.forcePasswordReset = this.forcePasswordResetReason;
    }

@@ -128,13 +128,13 @@ export class PasswordLoginStrategy extends LoginStrategy {
      if (!meetsRequirements) {
        if (authResult.requiresCaptcha || authResult.requiresTwoFactor) {
          // Save the flag to this strategy for later use as the master password is about to pass out of scope
-          this.forcePasswordResetReason = ForceResetPasswordReason.WeakMasterPassword;
+          this.forcePasswordResetReason = ForceSetPasswordReason.WeakMasterPassword;
        } else {
          // Authentication was successful, save the force update password options with the state service
-          await this.stateService.setForcePasswordResetReason(
-            ForceResetPasswordReason.WeakMasterPassword
+          await this.stateService.setForceSetPasswordReason(
+            ForceSetPasswordReason.WeakMasterPassword
          );
-          authResult.forcePasswordReset = ForceResetPasswordReason.WeakMasterPassword;
+          authResult.forcePasswordReset = ForceSetPasswordReason.WeakMasterPassword;
        }
      }
    }
--- a/libs/common/src/auth/login-strategies/sso-login.strategy.ts
+++ b/libs/common/src/auth/login-strategies/sso-login.strategy.ts
@@ -14,7 +14,7 @@ import { DeviceTrustCryptoServiceAbstraction } from "../abstractions/device-trus
 import { KeyConnectorService } from "../abstractions/key-connector.service";
 import { TokenService } from "../abstractions/token.service";
 import { TwoFactorService } from "../abstractions/two-factor.service";
-import { ForceResetPasswordReason } from "../models/domain/force-reset-password-reason";
+import { ForceSetPasswordReason } from "../models/domain/force-set-password-reason";
 import { SsoLoginCredentials } from "../models/domain/login-credentials";
 import { SsoTokenRequest } from "../models/request/identity-token/sso-token.request";
 import { IdentityTokenResponse } from "../models/response/identity-token.response";
@@ -75,8 +75,8 @@ export class SsoLoginStrategy extends LoginStrategy {
    this.ssoEmail2FaSessionToken = ssoAuthResult.ssoEmail2FaSessionToken;

    // Auth guard currently handles redirects for this.
-    if (ssoAuthResult.forcePasswordReset == ForceResetPasswordReason.AdminForcePasswordReset) {
-      await this.stateService.setForcePasswordResetReason(ssoAuthResult.forcePasswordReset);
+    if (ssoAuthResult.forcePasswordReset == ForceSetPasswordReason.AdminForcePasswordReset) {
+      await this.stateService.setForceSetPasswordReason(ssoAuthResult.forcePasswordReset);
    }

    return ssoAuthResult;
--- a/libs/common/src/auth/models/domain/auth-result.ts
+++ b/libs/common/src/auth/models/domain/auth-result.ts
@@ -1,7 +1,7 @@
 import { Utils } from "../../../platform/misc/utils";
 import { TwoFactorProviderType } from "../../enums/two-factor-provider-type";

-import { ForceResetPasswordReason } from "./force-reset-password-reason";
+import { ForceSetPasswordReason } from "./force-set-password-reason";

 export class AuthResult {
  captchaSiteKey = "";
@@ -13,7 +13,7 @@ export class AuthResult {
   * */
  resetMasterPassword = false;

-  forcePasswordReset: ForceResetPasswordReason = ForceResetPasswordReason.None;
+  forcePasswordReset: ForceSetPasswordReason = ForceSetPasswordReason.None;
  twoFactorProviders: Map<TwoFactorProviderType, { [key: string]: string }> = null;
  ssoEmail2FaSessionToken?: string;
  email: string;
--- a/libs/common/src/auth/models/domain/force-reset-password-reason.ts
+++ b/libs/common/src/auth/models/domain/force-reset-password-reason.ts
@@ -1,8 +1,8 @@
 /*
- * This enum is used to determine if a user should be forced to reset their password
+ * This enum is used to determine if a user should be forced to initially set or reset their password
 * on login (server flag) or unlock via MP (client evaluation).
 */
-export enum ForceResetPasswordReason {
+export enum ForceSetPasswordReason {
  /**
   * A password reset should not be forced.
   */
@@ -20,4 +20,10 @@ export enum ForceResetPasswordReason {
   * Only set client side b/c server can't evaluate MP.
   */
  WeakMasterPassword,
+
+  /**
+   * Occurs when a TDE user without a password obtains the password reset permission.
+   * Set post login & decryption client side and by server in sync (to catch logged in users).
+   */
+  TdeUserWithoutPasswordHasPasswordResetPermission,
 }
--- a/libs/common/src/auth/models/request/set-password.request.ts
+++ b/libs/common/src/auth/models/request/set-password.request.ts
@@ -5,7 +5,7 @@ export class SetPasswordRequest {
  masterPasswordHash: string;
  key: string;
  masterPasswordHint: string;
-  keys: KeysRequest;
+  keys: KeysRequest | null;
  kdf: KdfType;
  kdfIterations: number;
  kdfMemory?: number;
@@ -17,7 +17,7 @@ export class SetPasswordRequest {
    key: string,
    masterPasswordHint: string,
    orgIdentifier: string,
-    keys: KeysRequest,
+    keys: KeysRequest | null,
    kdf: KdfType,
    kdfIterations: number,
    kdfMemory?: number,
--- a/libs/common/src/platform/abstractions/state.service.ts
+++ b/libs/common/src/platform/abstractions/state.service.ts
@@ -7,7 +7,7 @@ import { ProviderData } from "../../admin-console/models/data/provider.data";
 import { Policy } from "../../admin-console/models/domain/policy";
 import { AdminAuthRequestStorable } from "../../auth/models/domain/admin-auth-req-storable";
 import { EnvironmentUrls } from "../../auth/models/domain/environment-urls";
-import { ForceResetPasswordReason } from "../../auth/models/domain/force-reset-password-reason";
+import { ForceSetPasswordReason } from "../../auth/models/domain/force-set-password-reason";
 import { KdfConfig } from "../../auth/models/domain/kdf-config";
 import { BiometricKey } from "../../auth/types/biometric-key";
 import { KdfType, ThemeType, UriMatchType } from "../../enums";
@@ -391,9 +391,9 @@ export abstract class StateService<T extends Account = Account> {
  setEverHadUserKey: (value: boolean, options?: StorageOptions) => Promise<void>;
  getEverBeenUnlocked: (options?: StorageOptions) => Promise<boolean>;
  setEverBeenUnlocked: (value: boolean, options?: StorageOptions) => Promise<void>;
-  getForcePasswordResetReason: (options?: StorageOptions) => Promise<ForceResetPasswordReason>;
-  setForcePasswordResetReason: (
-    value: ForceResetPasswordReason,
+  getForceSetPasswordReason: (options?: StorageOptions) => Promise<ForceSetPasswordReason>;
+  setForceSetPasswordReason: (
+    value: ForceSetPasswordReason,
    options?: StorageOptions
  ) => Promise<void>;
  getInstalledVersion: (options?: StorageOptions) => Promise<string>;
--- a/libs/common/src/platform/models/domain/account.ts
+++ b/libs/common/src/platform/models/domain/account.ts
@@ -8,7 +8,7 @@ import { Policy } from "../../../admin-console/models/domain/policy";
 import { AuthenticationStatus } from "../../../auth/enums/authentication-status";
 import { AdminAuthRequestStorable } from "../../../auth/models/domain/admin-auth-req-storable";
 import { EnvironmentUrls } from "../../../auth/models/domain/environment-urls";
-import { ForceResetPasswordReason } from "../../../auth/models/domain/force-reset-password-reason";
+import { ForceSetPasswordReason } from "../../../auth/models/domain/force-set-password-reason";
 import { KeyConnectorUserDecryptionOption } from "../../../auth/models/domain/user-decryption-options/key-connector-user-decryption-option";
 import { TrustedDeviceUserDecryptionOption } from "../../../auth/models/domain/user-decryption-options/trusted-device-user-decryption-option";
 import { IdentityTokenResponse } from "../../../auth/models/response/identity-token.response";
@@ -194,7 +194,7 @@ export class AccountProfile {
  entityType?: string;
  everHadUserKey?: boolean;
  everBeenUnlocked?: boolean;
-  forcePasswordResetReason?: ForceResetPasswordReason;
+  forceSetPasswordReason?: ForceSetPasswordReason;
  hasPremiumPersonally?: boolean;
  hasPremiumFromOrganization?: boolean;
  lastSync?: string;
--- a/libs/common/src/platform/services/state.service.ts
+++ b/libs/common/src/platform/services/state.service.ts
@@ -10,7 +10,7 @@ import { AccountService } from "../../auth/abstractions/account.service";
 import { AuthenticationStatus } from "../../auth/enums/authentication-status";
 import { AdminAuthRequestStorable } from "../../auth/models/domain/admin-auth-req-storable";
 import { EnvironmentUrls } from "../../auth/models/domain/environment-urls";
-import { ForceResetPasswordReason } from "../../auth/models/domain/force-reset-password-reason";
+import { ForceSetPasswordReason } from "../../auth/models/domain/force-set-password-reason";
 import { KdfConfig } from "../../auth/models/domain/kdf-config";
 import { BiometricKey } from "../../auth/types/biometric-key";
 import {
@@ -2072,24 +2072,24 @@ export class StateService<
    );
  }

-  async getForcePasswordResetReason(options?: StorageOptions): Promise<ForceResetPasswordReason> {
+  async getForceSetPasswordReason(options?: StorageOptions): Promise<ForceSetPasswordReason> {
    return (
      (
        await this.getAccount(
          this.reconcileOptions(options, await this.defaultOnDiskMemoryOptions())
        )
-      )?.profile?.forcePasswordResetReason ?? ForceResetPasswordReason.None
+      )?.profile?.forceSetPasswordReason ?? ForceSetPasswordReason.None
    );
  }

-  async setForcePasswordResetReason(
-    value: ForceResetPasswordReason,
+  async setForceSetPasswordReason(
+    value: ForceSetPasswordReason,
    options?: StorageOptions
  ): Promise<void> {
    const account = await this.getAccount(
      this.reconcileOptions(options, await this.defaultOnDiskMemoryOptions())
    );
-    account.profile.forcePasswordResetReason = value;
+    account.profile.forceSetPasswordReason = value;
    await this.saveAccount(
      account,
      this.reconcileOptions(options, await this.defaultOnDiskMemoryOptions())
--- a/libs/common/src/vault/services/sync/sync.service.ts
+++ b/libs/common/src/vault/services/sync/sync.service.ts
@@ -3,12 +3,13 @@ import { SettingsService } from "../../../abstractions/settings.service";
 import { InternalOrganizationServiceAbstraction } from "../../../admin-console/abstractions/organization/organization.service.abstraction";
 import { InternalPolicyService } from "../../../admin-console/abstractions/policy/policy.service.abstraction";
 import { ProviderService } from "../../../admin-console/abstractions/provider.service";
+import { OrganizationUserType } from "../../../admin-console/enums";
 import { OrganizationData } from "../../../admin-console/models/data/organization.data";
 import { PolicyData } from "../../../admin-console/models/data/policy.data";
 import { ProviderData } from "../../../admin-console/models/data/provider.data";
 import { PolicyResponse } from "../../../admin-console/models/response/policy.response";
 import { KeyConnectorService } from "../../../auth/abstractions/key-connector.service";
-import { ForceResetPasswordReason } from "../../../auth/models/domain/force-reset-password-reason";
+import { ForceSetPasswordReason } from "../../../auth/models/domain/force-set-password-reason";
 import { DomainsResponse } from "../../../models/response/domains.response";
 import {
  SyncCipherNotification,
@@ -21,6 +22,7 @@ import { LogService } from "../../../platform/abstractions/log.service";
 import { MessagingService } from "../../../platform/abstractions/messaging.service";
 import { StateService } from "../../../platform/abstractions/state.service";
 import { sequentialize } from "../../../platform/misc/sequentialize";
+import { AccountDecryptionOptions } from "../../../platform/models/domain/account";
 import { SendData } from "../../../tools/send/models/data/send.data";
 import { SendResponse } from "../../../tools/send/models/response/send.response";
 import { SendApiService } from "../../../tools/send/services/send-api.service.abstraction";
@@ -314,12 +316,7 @@ export class SyncService implements SyncServiceAbstraction {
    await this.stateService.setHasPremiumFromOrganization(response.premiumFromOrganization);
    await this.keyConnectorService.setUsesKeyConnector(response.usesKeyConnector);

-    // The `forcePasswordReset` flag indicates an admin has reset the user's password and must be updated
-    if (response.forcePasswordReset) {
-      await this.stateService.setForcePasswordResetReason(
-        ForceResetPasswordReason.AdminForcePasswordReset
-      );
-    }
+    await this.setForceSetPasswordReasonIfNeeded(response);

    await this.syncProfileOrganizations(response);

@@ -338,6 +335,45 @@ export class SyncService implements SyncServiceAbstraction {
    }
  }

+  private async setForceSetPasswordReasonIfNeeded(profileResponse: ProfileResponse) {
+    // The `forcePasswordReset` flag indicates an admin has reset the user's password and must be updated
+    if (profileResponse.forcePasswordReset) {
+      await this.stateService.setForceSetPasswordReason(
+        ForceSetPasswordReason.AdminForcePasswordReset
+      );
+    }
+
+    const acctDecryptionOpts: AccountDecryptionOptions =
+      await this.stateService.getAccountDecryptionOptions();
+
+    // Even though TDE users should only be in a single org (per single org policy), check
+    // through all orgs for the manageResetPassword permission. If they have it in any org,
+    // they should be forced to set a password.
+    let hasManageResetPasswordPermission = false;
+    for (const org of profileResponse.organizations) {
+      const isAdmin = org.type === OrganizationUserType.Admin;
+      const isOwner = org.type === OrganizationUserType.Owner;
+
+      // Note: apparently permissions only come down populated for custom roles.
+      if (isAdmin || isOwner || (org.permissions && org.permissions.manageResetPassword)) {
+        hasManageResetPasswordPermission = true;
+        break;
+      }
+    }
+
+    if (
+      acctDecryptionOpts.trustedDeviceOption !== undefined &&
+      !acctDecryptionOpts.hasMasterPassword &&
+      hasManageResetPasswordPermission
+    ) {
+      // TDE user w/out MP went from having no password reset permission to having it.
+      // Must set the force password reset reason so the auth guard will redirect to the set password page.
+      await this.stateService.setForceSetPasswordReason(
+        ForceSetPasswordReason.TdeUserWithoutPasswordHasPasswordResetPermission
+      );
+    }
+  }
+
  private async syncProfileOrganizations(response: ProfileResponse) {
    const organizations: { [id: string]: OrganizationData } = {};
    response.organizations.forEach((o) => {