[keycloak-dev] Cleanup of 'Change password' screen in Account app

[Marek Posolda]

On 27/11/15 10:23, Vlastimil Elias wrote:
> Hi,
>
> I have two proposals for cleanup of 'Change password' screen in Account
> app based on my experience with it:
>
> 1. remove Cancel button - it has no any meaning on this screen/form, it
> only reshowns form with empty fields. And also there is a bug,
> "Password" field is hidden when it is used, which makes whole form unusable.
>
> 2. remove validation of current password (remove "Password" field). Two
> reasons for this:
>     - security impact of this check is small. If attacker is able to
> compromise Account app then he can always change email and then use
> "Forgot password" feature to change password
>     - user created over Identity Provider do not know old password
> (because it is not set) so he is not able to set password using this screen
> After we implement support for reauthentication (KEYCLOAK-2076) then we
> should set some reasonable reauth timeout for Account app instead, this
> will make it more secure at all.
Hmm... AFAIK if user doesn't have password set, he is already not 
required to fill the existing password. That is the case when he is 
registered through some social/identity providers. See PasswordBean class.

Btv. with new firstBrokerLogin changes, there is also flag 
"requirePasswordUpdateAfterRegistration" on CreateUserIfUnique 
authenticator. So now you can ask users registered through social to 
update the password immediately after they are registered through social 
provider :-)

Marek
>
> If you agree then I can create JIRA issue for this and provide PR.
>
> Vlastimil
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-dev/attachments/20151127/b94bdde7/attachment.html