[AC-1435] Single Organization policy prerequisite for Account Recovery policy

[shane-melton]

Type of change

- [ ] Bug fix
- [X] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Make the Single Organization policy a prerequisite for the Account Recovery policy and by extension Trusted Device Encryption.

See related copy/UI changes in Clients repo: bitwarden/clients#5774

Code changes

• src/Core/Auth/Services/Implementations/SsoConfigService.cs: Whenever TDE is enabled, automatically turn on the Single Organization policy.
• src/Core/Services/Implementations/PolicyService.cs: Add new dependency checks when modifying the Single Org and/or Account Recovery policies.
• SsoConfigServiceTests and PolicyServiceTests: Add unit tests to ensure desired functionality

Before you submit

• Please check for formatting errors (dotnet format --verify-no-changes) (required)
• If making database changes - make sure you also update Entity Framework queries and/or migrations
• Please add unit tests where it makes sense to do so (encouraged but not required)
• If this change requires a documentation update - notify the documentation team
• If this change has particular deployment requirements - notify the DevOps team

[bitwarden-bot]

Checkmarx One – Scan Summary & Details – 90cff02f-bc05-4336-8953-f79ba7b6710c

New Issues

Severity	Issue	Source File / Package	Checkmarx Insight
	Passwords And Secrets - Generic Password	/bootstrap-local.yml: 20	Query to find passwords and secrets in infrastructure code.
	Passwords And Secrets - Generic Password	/bootstrap-hml.yml: 11	Query to find passwords and secrets in infrastructure code.
	Passwords And Secrets - Generic Password	/bootstrap.yml: 19	Query to find passwords and secrets in infrastructure code.

Fixed Issues

Severity	Issue	Source File / Package	Checkmarx Insight
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Missing User Instruction	/Dockerfile: 1	A user should be specified in the dockerfile, otherwise the image will run as root
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 7	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile-k8s: 8	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile-k8s: 8	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 7	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Apt Get Install Pin Version Not Defined	/Dockerfile: 5	When installing a package, its pin version should be defined
	Container Traffic Not Bound To Host Interface	/docker-compose.yml: 15	Incoming container traffic should be bound to a specific host interface
	Container Traffic Not Bound To Host Interface	/docker-compose.yml: 73	Incoming container traffic should be bound to a specific host interface
	Container Traffic Not Bound To Host Interface	/docker-compose.yml: 59	Incoming container traffic should be bound to a specific host interface
	Container Traffic Not Bound To Host Interface	/docker-compose.yml: 35	Incoming container traffic should be bound to a specific host interface
	Container Traffic Not Bound To Host Interface	/docker-compose.yml: 103	Incoming container traffic should be bound to a specific host interface
	Container Traffic Not Bound To Host Interface	/docker-compose.yml: 23	Incoming container traffic should be bound to a specific host interface
	Container Traffic Not Bound To Host Interface	/docker-compose.yml: 43	Incoming container traffic should be bound to a specific host interface
	Container Traffic Not Bound To Host Interface	/docker-compose.yml: 92	Incoming container traffic should be bound to a specific host interface
	Healthcheck Not Set	/docker-compose.yml: 4	Check containers periodically to see if they are running properly.
	Healthcheck Not Set	/docker-compose.yml: 98	Check containers periodically to see if they are running properly.
	Healthcheck Not Set	/docker-compose.yml: 33	Check containers periodically to see if they are running properly.
	Healthcheck Not Set	/docker-compose.yml: 84	Check containers periodically to see if they are running properly.
	Healthcheck Not Set	/docker-compose.yml: 70	Check containers periodically to see if they are running properly.
	Healthcheck Not Set	/docker-compose.yml: 56	Check containers periodically to see if they are running properly.
	Healthcheck Not Set	/docker-compose.yml: 41	Check containers periodically to see if they are running properly.
	Healthcheck Not Set	/docker-compose.yml: 21	Check containers periodically to see if they are running properly.
	Host Namespace is Shared	/docker-compose.yml: 98	The hosts process namespace should not be shared by containers
	Host Namespace is Shared	/docker-compose.yml: 56	The hosts process namespace should not be shared by containers
	Host Namespace is Shared	/docker-compose.yml: 41	The hosts process namespace should not be shared by containers
	Host Namespace is Shared	/docker-compose.yml: 4	The hosts process namespace should not be shared by containers
	Host Namespace is Shared	/docker-compose.yml: 70	The hosts process namespace should not be shared by containers
	Host Namespace is Shared	/docker-compose.yml: 33	The hosts process namespace should not be shared by containers
	Host Namespace is Shared	/docker-compose.yml: 21	The hosts process namespace should not be shared by containers
	Host Namespace is Shared	/docker-compose.yml: 84	The hosts process namespace should not be shared by containers
	Memory Not Limited	/docker-compose.yml: 21	Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...
	Memory Not Limited	/docker-compose.yml: 84	Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...
	Memory Not Limited	/docker-compose.yml: 41	Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...
	Memory Not Limited	/docker-compose.yml: 33	Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...
	Memory Not Limited	/docker-compose.yml: 98	Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...
	Memory Not Limited	/docker-compose.yml: 56	Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...
	Memory Not Limited	/docker-compose.yml: 4	Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...
	Memory Not Limited	/docker-compose.yml: 70	Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...
	Networks Not Set	/docker-compose.yml: 70	Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.
	Networks Not Set	/docker-compose.yml: 84	Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.
	Networks Not Set	/docker-compose.yml: 33	Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.
	Networks Not Set	/docker-compose.yml: 4	Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.
	Networks Not Set	/docker-compose.yml: 56	Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.
	Networks Not Set	/docker-compose.yml: 21	Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.
	Networks Not Set	/docker-compose.yml: 98	Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.
	Networks Not Set	/docker-compose.yml: 41	Setting networks in services ensures you are not using dockers default bridge (docker0), which shares traffic bewteen all containers.
	Privacy_Violation	/src/Api/Controllers/OrganizationAuthRequestsController.cs: 62	Attack Vector
	Privileged Ports Mapped In Container	/docker-compose.yml: 92	Privileged ports (1 to 1023) should not be mapped. Also you should drop net_bind_service linux capability from the container unless you absolutely ...
	Security Opt Not Set	/docker-compose.yml: 98	Attribute 'security_opt' should be defined.
	Security Opt Not Set	/docker-compose.yml: 4	Attribute 'security_opt' should be defined.
	Security Opt Not Set	/docker-compose.yml: 33	Attribute 'security_opt' should be defined.
	Security Opt Not Set	/docker-compose.yml: 56	Attribute 'security_opt' should be defined.
	Security Opt Not Set	/docker-compose.yml: 70	Attribute 'security_opt' should be defined.
	Security Opt Not Set	/docker-compose.yml: 21	Attribute 'security_opt' should be defined.
	Security Opt Not Set	/docker-compose.yml: 41	Attribute 'security_opt' should be defined.
	Security Opt Not Set	/docker-compose.yml: 84	Attribute 'security_opt' should be defined.
	Container Capabilities Unrestricted	/docker-compose.yml: 41	Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...
	Container Capabilities Unrestricted	/docker-compose.yml: 33	Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...
	Container Capabilities Unrestricted	/docker-compose.yml: 56	Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...
	Container Capabilities Unrestricted	/docker-compose.yml: 84	Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...
	Container Capabilities Unrestricted	/docker-compose.yml: 70	Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...
	Container Capabilities Unrestricted	/docker-compose.yml: 98	Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...
	Container Capabilities Unrestricted	/docker-compose.yml: 21	Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...
	Container Capabilities Unrestricted	/docker-compose.yml: 4	Some capabilities are not needed in certain (or any) containers. Make sure that you only add capabilities that your container needs. Drop unnecessa...
	Cpus Not Limited	/docker-compose.yml: 21	CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
	Cpus Not Limited	/docker-compose.yml: 33	CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
	Cpus Not Limited	/docker-compose.yml: 84	CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
	Cpus Not Limited	/docker-compose.yml: 98	CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
	Cpus Not Limited	/docker-compose.yml: 56	CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
	Cpus Not Limited	/docker-compose.yml: 70	CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
	Cpus Not Limited	/docker-compose.yml: 4	CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
	Cpus Not Limited	/docker-compose.yml: 41	CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests
	Healthcheck Instruction Missing	/Dockerfile: 1	Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working
	Healthcheck Instruction Missing	/Dockerfile: 1	Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working
	Healthcheck Instruction Missing	/Dockerfile: 1	Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working
	Multiple RUN, ADD, COPY, Instructions Listed	/Dockerfile-k8s: 17	Multiple commands (RUN, COPY, ADD) should be grouped in order to reduce the number of layers.
	Multiple RUN, ADD, COPY, Instructions Listed	/Dockerfile: 11	Multiple commands (RUN, COPY, ADD) should be grouped in order to reduce the number of layers.
	Multiple RUN, ADD, COPY, Instructions Listed	/Dockerfile: 13	Multiple commands (RUN, COPY, ADD) should be grouped in order to reduce the number of layers.

[JaredSnider-Bitwarden]

Great work on this, and thank you for including thorough tests!