<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 27/11/15 10:23, Vlastimil Elias
wrote:<br>
</div>
<blockquote cite="mid:5658210D.1070301@redhat.com" type="cite">
<pre wrap="">Hi,
I have two proposals for cleanup of 'Change password' screen in Account
app based on my experience with it:
1. remove Cancel button - it has no any meaning on this screen/form, it
only reshowns form with empty fields. And also there is a bug,
"Password" field is hidden when it is used, which makes whole form unusable.
2. remove validation of current password (remove "Password" field). Two
reasons for this:
- security impact of this check is small. If attacker is able to
compromise Account app then he can always change email and then use
"Forgot password" feature to change password
- user created over Identity Provider do not know old password
(because it is not set) so he is not able to set password using this screen
After we implement support for reauthentication (KEYCLOAK-2076) then we
should set some reasonable reauth timeout for Account app instead, this
will make it more secure at all.</pre>
</blockquote>
Hmm... AFAIK if user doesn't have password set, he is already not
required to fill the existing password. That is the case when he is
registered through some social/identity providers. See PasswordBean
class. <br>
<br>
Btv. with new firstBrokerLogin changes, there is also flag
"requirePasswordUpdateAfterRegistration" on CreateUserIfUnique
authenticator. So now you can ask users registered through social to
update the password immediately after they are registered through
social provider <span class="moz-smiley-s1"><span> :-) </span></span><br>
<br>
Marek<br>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<blockquote cite="mid:5658210D.1070301@redhat.com" type="cite">
<pre wrap="">
If you agree then I can create JIRA issue for this and provide PR.
Vlastimil
</pre>
</blockquote>
<br>
</body>
</html>