Implement User Account Recovery V2 API

[Rashmini]

Is your suggestion related to an experience ? Please describe.
We have encountered following issues with the current recovery V1 API [1] we have.

• When the user submits an OTP in the recovery flow, the OTP itself is used to correlate the user, which is not a correct behaviour.
• The resend code can be used and refreshed indefinitely to keep resending OTPs to the user/ flooding the OTP services.

Considering the above, we need to provide a new V2 API based on the following approach,

• There will be a unique identifier(UUID) for a particular password recovery attempt which is bound to a particular user.
• This identifier will be generated at the recovery flow initiation, and it will not be changed in the rest of the flow.
• The generated OTP will be bound to the above unique identifier.
• When the password is reset, the API call should include the above UUID, OTP and the new password.
• Validation happens for the submitted OTP against the recovery context data retrieved from the UUID in the request.
• To mitigate possible brute force attacks, the UUID will be invalidated when a certain number of failed OTP validations is exceeded.

UI support for the User Account Recovery V2 API will be onboarded at a later phase.

[1] https://is.docs.wso2.com/en/latest/guides/identity-lifecycles/extend-username-and-password-recovery/#with-internal-notification-management

[Rashmini]

We have decided to disable the current recovery service along with this improvement. A config is introduced to enable/disable the service.

Related PRs:

• Disable recovery V1 API carbon-identity-framework#4878
• Disable current recovery service wso2-extensions/identity-governance#766
• Handle client exception when API is disabled identity-api-user#178

The following config should be added to the deployment.toml file to enable the service.

[identity_mgt.recovery]
enable_v1_api = true

[Rashmini]

Recovery V2 API is implemented with:

• Add DB changes for the recovery V2 API carbon-identity-framework#4883
• Update recovery service for recovery V2 API wso2-extensions/identity-governance#751
• Add User Account Recovery V2 API identity-api-user#179
• Handle error scenarios related to recovery flow id identity-api-user#181

[Rashmini]

DB migration is tracked with #16576

[Rashmini]

There's an issue in Recovery V2 /confirm API when the channel is EXTERNAL. It will be fixed with #16884