wso2 · sadilchamishka · Oct 30, 2025 · Oct 31, 2025 · Nov 1, 2025 · Nov 1, 2025
diff --git a/.changeset/large-chefs-fail.md b/.changeset/large-chefs-fail.md
@@ -0,0 +1,8 @@
+---
+"@wso2is/admin.console-settings.v1": patch
+"@wso2is/admin.claims.v1": patch
+"@wso2is/admin.users.v1": patch
+"@wso2is/console": patch
+---
+
+Refactor immutable attribute configuration view and improve administrator listing in the console settings page
diff --git a/features/admin.claims.v1/components/edit/local-claim/edit-basic-details-local-claims.tsx b/features/admin.claims.v1/components/edit/local-claim/edit-basic-details-local-claims.tsx
@@ -166,7 +166,7 @@
        "attributeDialects.sharedProfileValueResolvingMethod"
    );

    const hideUserIdDisplayConfigurations: boolean = isFeatureEnabled(
        featureConfig?.attributeDialects,
        ClaimManagementConstants.FEATURE_DICTIONARY.get(ClaimFeatureDictionaryKeys.HideUserIdDisplayConfigurations)
    );
@@ -345,6 +345,17 @@
         setIsConsoleReadOnly(claim?.profiles?.console?.readOnly ?? claim?.readOnly);
         setIsEndUserReadOnly(claim?.profiles?.endUser?.readOnly ?? claim?.readOnly);
         setIsSelfRegistrationReadOnly(claim?.profiles?.selfRegistration?.readOnly ?? claim?.readOnly);
+
+        if (claim?.claimURI === ClaimManagementConstants.USER_NAME_CLAIM_URI
+            || claim?.claimURI === ClaimManagementConstants.USER_ID_CLAIM_URI
+            || claim?.claimURI === ClaimManagementConstants.CREATED_CLAIM_URI
+            || claim?.claimURI === ClaimManagementConstants.MODIFIED_CLAIM_URI) {
+            setIsConsoleRequired(true);
+        }
+
+        if (claim?.claimURI === ClaimManagementConstants.USER_NAME_CLAIM_URI) {
+            setIsEndUserRequired(true);
+        }
     }, [ claim ]);
 
     /**
@@ -534,14 +545,14 @@
         return dialectID;
     };
 
-    // Temporary fix to check system claims and make them readonly
+
     const isReadOnly: boolean = useMemo(() => {
-        if (hideSpecialClaims || isAgentAttribute) {
+        if (isAgentAttribute) {
             return true;
         } else {
             return !hasAttributeUpdatePermissions;
         }
-    }, [ featureConfig, allowedScopes, hideSpecialClaims ]);
+    }, [ featureConfig, allowedScopes, isAgentAttribute ]);
 
     const deleteConfirmation = (): ReactElement => (
         <ConfirmationModal
@@ -855,23 +866,33 @@
          * This function checks whether the supported by default checkboxes should be disabled.
          *
          * @param isAdminConsole - Is display option for admin console.
+         * @param isSelfRegistration - Is display option for self-registration.
          * @returns Is checkbox disabled.
          */
-        const isSupportedByDefaultCheckboxDisabled = (isAdminConsole?: boolean): boolean => {
-
-            // If hideUserIdDisplayConfigurations is true, disable the checkbox for user id claim.
-            // Refer issue - https://github.com/wso2/product-is/issues/24906
-            if (!hideUserIdDisplayConfigurations && claim?.claimURI === ClaimManagementConstants.USER_ID_CLAIM_URI) {
-                // Disable only the admin console checkbox as the support is only tested in Admin Console for now.
-                // Further supported can be given under effort tracked
-                // with issue - https://github.com/wso2/product-is/issues/25482
-                if (isAdminConsole) {
-                    return false;
-                }
+        const isSupportedByDefaultCheckboxDisabled = (
+            isAdminConsole?: boolean,
+            isSelfRegistration?: boolean
+        ): boolean => {
+
+            // For immutable (special) claims, disable self-registration as they are created after user creation
+            if (isSelfRegistration && hideSpecialClaims) {
+                return true;
+            }
+
+            if (claim?.claimURI === ClaimManagementConstants.USER_NAME_CLAIM_URI) {
+                return true;
+            }
+
+            if ((claim?.claimURI === ClaimManagementConstants.CREATED_CLAIM_URI
+                    || claim?.claimURI === ClaimManagementConstants.MODIFIED_CLAIM_URI) && isAdminConsole) {
+                return true;
+            }
 
+            if (claim?.claimURI === ClaimManagementConstants.USER_ID_CLAIM_URI) {
                 return true;
             }
 
+
             return isReadOnly || isSubOrganization() || !hasMapping
                 || dataType === ClaimDataType.COMPLEX
                 || (
@@ -903,7 +924,7 @@
                         defaultValue={ claim?.profiles?.console?.supportedByDefault ?? claim?.supportedByDefault }
                         data-componentid={
                             `${ testId }-form-console-supported-by-default-checkbox` }
-                        readOnly={ isSupportedByDefaultCheckboxDisabled(true) }
+                        readOnly={ isSupportedByDefaultCheckboxDisabled(true, false) }
                         {
                             ...( isConsoleRequired
                                 ? { checked: true }
@@ -919,7 +940,7 @@
                         name="endUserSupportedByDefault"
                         defaultValue={ claim?.profiles?.endUser?.supportedByDefault ?? claim?.supportedByDefault }
                         data-componentid={ `${ testId }-form-end-user-supported-by-default-checkbox` }
-                        readOnly={ isSupportedByDefaultCheckboxDisabled() }
+                        readOnly={ isSupportedByDefaultCheckboxDisabled(false, false) }
                         {
                             ...( isEndUserRequired
                                 ? { checked: true }
@@ -937,10 +958,11 @@
                             claim?.supportedByDefault }
                         data-componentid={
                             `${ testId }-form-self-registration-supported-by-default-checkbox` }
-                        readOnly={ isSupportedByDefaultCheckboxDisabled() }
+                        readOnly={ isSupportedByDefaultCheckboxDisabled(false, true) }
                         {
-                            ...( isSelfRegistrationRequired
-                                ? { checked: true }
+                            ...( isSelfRegistrationRequired || hideSpecialClaims
+                                // Immutable (special) claims should not be displayed in self-registration
+                                ? { checked: hideSpecialClaims ? false : true }
                                 : { defaultValue: claim?.profiles?.selfRegistration?.supportedByDefault ??
                                     claim?.supportedByDefault }
                             )
@@ -1058,7 +1080,8 @@
     };
 
     const resolveAttributeRequiredRow = (): ReactElement => {
-        const isRequiredCheckboxDisabled: boolean = isReadOnly || isSubOrganization() || !hasMapping
+        const isRequiredCheckboxDisabled: boolean = hideSpecialClaims || isReadOnly || isSubOrganization()
+            || !hasMapping
             || dataType === ClaimDataType.COMPLEX
             || (
                 accountVerificationEnabled
@@ -1092,7 +1115,7 @@
                             setIsConsoleRequired(value);
                         } }
                         {
-                            ...( isConsoleReadOnly
+                            ...( isConsoleReadOnly || hideSpecialClaims
                                 ? { value: false }
                                 : { defaultValue: claim?.profiles?.console?.required ?? claim?.required }
                             )
@@ -1110,7 +1133,7 @@
                             setIsEndUserRequired(value);
                         } }
                         {
-                            ...( isEndUserReadOnly
+                            ...( isEndUserReadOnly || hideSpecialClaims
                                 ? { value: false }
                                 : { defaultValue: claim?.profiles?.endUser?.required ?? claim?.required }
                             )
@@ -1128,7 +1151,7 @@
                             setIsSelfRegistrationRequired(value);
                         } }
                         {
-                            ...( isSelfRegistrationReadOnly
+                            ...( isSelfRegistrationReadOnly || hideSpecialClaims
                                 ? { value: false }
                                 : { defaultValue: claim?.profiles?.selfRegistration?.required ?? claim?.required }
                             )
@@ -1140,8 +1163,8 @@
     };
 
     const resolveAttributeReadOnlyRow = (): ReactElement => {
-        const isReadOnlyCheckboxDisabled: boolean = isReadOnly || isSubOrganization() || !hasMapping
-            || dataType === ClaimDataType.COMPLEX;
+        const isReadOnlyCheckboxDisabled: boolean = hideSpecialClaims || isReadOnly || isSubOrganization()
+            || !hasMapping || dataType === ClaimDataType.COMPLEX;
 
         return (
             <TableRow hideBorder>
@@ -1161,7 +1184,9 @@
                     <Field.Checkbox
                         ariaLabel="Read-only in console"
                         name="consoleReadOnly"
-                        defaultValue={ claim?.profiles?.console?.readOnly ?? claim?.readOnly }
+                        defaultValue={ hideSpecialClaims
+                            ? true
+                            : claim?.profiles?.console?.readOnly ?? claim?.readOnly }
                         data-componentid={ `${ testId }-form-console-readOnly-checkbox` }
                         readOnly={ isReadOnlyCheckboxDisabled }
                         listen ={ (value: boolean) => {
@@ -1173,7 +1198,9 @@
                     <Field.Checkbox
                         ariaLabel="Read-only in My Account"
                         name="endUserReadOnly"
-                        defaultValue={ claim?.profiles?.endUser?.readOnly ?? claim?.readOnly }
+                        defaultValue={ hideSpecialClaims
+                            ? true
+                            : claim?.profiles?.endUser?.readOnly ?? claim?.readOnly }
                         data-componentid={ `${ testId }-form-end-user-readOnly-checkbox` }
                         readOnly={ isReadOnlyCheckboxDisabled }
                         listen ={ (value: boolean) => {
@@ -1212,14 +1239,12 @@
      */
     const isDisplayNameReadOnly = (): boolean => {
 
-        // If we are not using default labels and order, the display name field is editable for
-        // user ID and username claims.
+        // The following claims are editable if default labels and order are not used.
         // Refer issue - https://github.com/wso2/product-is/issues/24906
-        if (!useDefaultLabelsAndOrder && (claim?.claimURI === ClaimManagementConstants.USER_ID_CLAIM_URI
-            || claim?.claimURI === ClaimManagementConstants.USER_NAME_CLAIM_URI)) {
-            return false;
-        }
-        if (claim?.claimURI === ClaimManagementConstants.USER_ID_CLAIM_URI) {
+        if (useDefaultLabelsAndOrder && (claim?.claimURI === ClaimManagementConstants.USER_ID_CLAIM_URI
+            || claim?.claimURI === ClaimManagementConstants.USER_NAME_CLAIM_URI
+            || claim?.claimURI === ClaimManagementConstants.CREATED_CLAIM_URI
+            || claim?.claimURI === ClaimManagementConstants.MODIFIED_CLAIM_URI)) {
             return true;
         }
 
@@ -1233,15 +1258,8 @@
      */
     const showAttributeConfigurations = (): boolean => {
 
-        // Show for user ID claim when hideUserIdDisplayConfigurations is false.
-        // Refer issue - https://github.com/wso2/product-is/issues/24906
-        if (!hideUserIdDisplayConfigurations && claim?.claimURI === ClaimManagementConstants.USER_ID_CLAIM_URI) {
-            return true;
-        }
-
         return !isDistinctAttributeProfilesDisabled &&
             claim &&
-            !hideSpecialClaims &&
             mappingChecked &&
             claim.claimURI !== ClaimManagementConstants.GROUPS_CLAIM_URI &&
             !isAgentAttribute;
@@ -1254,19 +1272,7 @@
      */
     const showUpdateButton = (): boolean => {
 
-        // Show for username and user ID claims when useDefaultLabelsAndOrder is false.
-        // Refer issue - https://github.com/wso2/product-is/issues/24906
-        if (!useDefaultLabelsAndOrder && (claim?.claimURI === ClaimManagementConstants.USER_ID_CLAIM_URI
-            || claim?.claimURI === ClaimManagementConstants.USER_NAME_CLAIM_URI)) {
-            return true;
-        }
-
-        // Show for user ID claim when hideUserIdDisplayConfigurations is false.
-        if (!hideUserIdDisplayConfigurations && claim?.claimURI === ClaimManagementConstants.USER_ID_CLAIM_URI) {
-            return true;
-        }
-
-        return !hideSpecialClaims && !isSubOrganization();
+        return !isSubOrganization();
     };
 
     return (
@@ -1335,10 +1341,7 @@
                         minLength={ 3 }
                         data-testid={ `${ testId }-form-description-input` }
                         hint={ t("claims:local.forms.descriptionHint") }
-                        readOnly={ isSubOrganization() ||
-                            isReadOnly ||
-                            claim.claimURI === ClaimManagementConstants.USER_ID_CLAIM_URI
-                        }
+                        readOnly={ isSubOrganization() || isReadOnly }
                     />
                     <Field.Dropdown
                         ariaLabel={ t("claims:local.forms.dataType.label") }
@@ -1774,22 +1777,19 @@
                                         <TableBody>
                                             {
                                                 // Hides on user_id, username claims
-                                                !READONLY_CLAIM_CONFIGS.includes(claim?.claimURI)
-                                                    && claim.claimURI !== ClaimManagementConstants.USER_NAME_CLAIM_URI
+                                                (!READONLY_CLAIM_CONFIGS.includes(claim?.claimURI))
                                                     && resolveAttributeSupportedByDefaultRow()
                                             }
                                             {
-                                                !READONLY_CLAIM_CONFIGS.includes(claim?.claimURI)
-                                                    && claim.claimURI !== ClaimManagementConstants.USER_ID_CLAIM_URI
-                                                    && attributeConfig.editAttributes.showRequiredCheckBox
+                                                // Show for system claims (hideSpecialClaims=true)
+                                                (!READONLY_CLAIM_CONFIGS.includes(claim?.claimURI)
+                                                    && attributeConfig.editAttributes.showRequiredCheckBox)
                                                     && resolveAttributeRequiredRow()
                                             }
                                             {
                                                 // Hides on user_id, username and email claims
-                                                !READONLY_CLAIM_CONFIGS.includes(claim?.claimURI)
-                                                    && claim.claimURI !== ClaimManagementConstants.USER_ID_CLAIM_URI
-                                                    && claim.claimURI !== ClaimManagementConstants.USER_NAME_CLAIM_URI
-                                                    && claim.claimURI !== ClaimManagementConstants.EMAIL_CLAIM_URI
+                                                (!READONLY_CLAIM_CONFIGS.includes(claim?.claimURI)
+                                                    && claim.claimURI !== ClaimManagementConstants.EMAIL_CLAIM_URI)
                                                     && resolveAttributeReadOnlyRow()
                                             }
                                         </TableBody>

diff --git a/features/admin.claims.v1/constants/claim-management-constants.ts b/features/admin.claims.v1/constants/claim-management-constants.ts
@@ -229,6 +229,8 @@ export class ClaimManagementConstants {
      */
     public static readonly USER_ID_CLAIM_URI: string = "http://wso2.org/claims/userid";
     public static readonly USER_NAME_CLAIM_URI: string = "http://wso2.org/claims/username";
+    public static readonly CREATED_CLAIM_URI: string = "http://wso2.org/claims/created";
+    public static readonly MODIFIED_CLAIM_URI: string = "http://wso2.org/claims/modified";
     public static readonly GROUPS_CLAIM_URI: string = "http://wso2.org/claims/groups";
     public static readonly ROLES_CLAIM_URI: string = "http://wso2.org/claims/roles";
     public static readonly APPLICATION_ROLES_CLAIM_URI: string = "http://wso2.org/claims/applicationRoles";