Date of Birth accepts future dates and dates that do not exist

[RushanNanayakkara]

Description

The Date of Birth claim (http://wso2.org/claims/dob) is validated only against a format pattern, ^\d{4}-\d{2}-\d{2}$. That constrains the shape of the value, not its meaning, so two classes of invalid value are accepted and persisted:

1. Future dates — 2030-01-01 matches the pattern.
2. Dates that do not exist — 2025-02-30 and 2025-02-29 also match the pattern.

The value is stored on every write path that reaches the user store: self-registration (both the classic page and the dynamic registration flow), the Console user create and edit forms, and the SCIM2 user endpoints. My Account's profile page already rejected future dates in the browser, so the same claim was enforced inconsistently depending on which UI the value came through, and a value blocked in one place could be stored from another.

Steps to Reproduce

1. Create a user through SCIM2 with a future date of birth:

   POST /scim2/Users
   {
     "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
     "userName": "DEFAULT/dobtest@example.com",
     "password": "<password>",
     "emails": [{ "primary": true, "value": "dobtest@example.com" }],
     "urn:scim:wso2:schema": { "dateOfBirth": "2030-01-01" }
   }
   

   Expected: rejected with HTTP 400. Actual: HTTP 201, and a GET on the created user returns dateOfBirth: 2030-01-01.

2. Repeat with "dateOfBirth": "2025-02-30", a date that does not exist. Same result.

3. Register through the self-registration page and enter a future date of birth. The value is accepted and stored.

4. Open the same user's profile in My Account. The future date is rejected there, so the value cannot be re-saved even though it was stored.

Please select the area issue is related to

Authentication & Registration

Version

7.4.0-SNAPSHOT (master)

Environment Details (with versions)

Reproducible on any deployment; not specific to a database or user store. Note that server-side claim validation runs only when UserClaimUpdate.EnableUserClaimInputRegexValidation is enabled, which is the shipped default.

[RushanNanayakkara]

Fixes

Server-side enforcement, applied at the user store listener so it covers every write path:

• Reject non-existing and future dates for the Date of Birth claim wso2-extensions/identity-inbound-provisioning-scim2#800 — reject non-existent and future dates
• Report a distinct message when the date of birth is not a real date wso2-extensions/identity-inbound-provisioning-scim2#803 — report a distinct message for a date that is not a real date, instead of reusing the format message

Client-side validation, so the user sees the error before submitting:

• Prevent future dates for Date of Birth in registration and user profile forms identity-apps#10558 — classic self-registration page, dynamic flow date field, Console user forms
• Emit DateValidator client rule for date claims that disallow future values carbon-identity-framework#8212 — emit a date validation rule to the client for the DOB claim
• Make the date of birth future-date rule fixed instead of configurable carbon-identity-framework#8250 — make that rule fixed in code rather than read from claim metadata, so it applies to tenants provisioned before the property existed

Follow-ups found while verifying the above:

• Validate the no-future-date claim rule at flow step submit carbon-identity-framework#8260 — the flow engine emitted the rule to the client but did not enforce it at step submit, so a caller that skipped the client check failed late instead of inline
• Fix registration form crash when the date field holds a future date identity-apps#10631 — the date field capped its calendar at today, which made an unguarded empty-array access in the calendar component reachable and unmounted the registration form
• Let a date of birth validation error be corrected on the missing claims page identity-apps#10632 — a date of birth validation error on the missing-claims page during federated login forwarded the user to a generic error page instead of letting them correct the field