<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">AFAIK one of the reasons is security.
If an attacker guesses username "foo", which exists, but not
password of user "foo", you don't want to tell him that he
successfully guessed username. So instead of first checking that
user "foo" is disabled and display the message "The user account
is disabled", you rather check password first and then display the
message "Incorrect username or password", so attacker don't have a
clue if account really exists or password was incorrect etc. Also
if BruteForce protector is enabled, you want to log the event as
failed login, so we're checking the password of user.<br>
<br>
Marek<br>
<br>
<br>
On 30/03/16 17:40, Ariel Carrera wrote:<br>
</div>
<blockquote
cite="mid:CAFzO_6fQ9T_g15KKo2AfWiPBahTzFQO7HN8Lv0FW2GuR6qFWYQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>Hi, I am developing a Federation Provider, and I have a
question...</div>
<div><br>
</div>
<div>Why the method () checks if the user "is enabled" after
validate the password instead of before of the password
validation?</div>
</div>
<div><br>
</div>
<div>AbstractUsernameFormAuthenticator.validateUserAndPassword:
line 141/151<br>
</div>
<div>...</div>
<div>
<div> if (invalidUser(context, user)){</div>
<div> return false;</div>
<div> }</div>
<div><br>
</div>
<div><b> if (!validatePassword(context, user,
inputData)){</b></div>
<div><b> return false;</b></div>
<div><b> }</b></div>
<div><br>
</div>
<div><b> if(!enabledUser(context, user)){</b></div>
<div><b> return false;</b></div>
<div><b> }</b></div>
</div>
<div>...</div>
<div><br>
</div>
<div>If the user is disabled... why validate his password and
return a password validation error message?<br>
</div>
<div><br>
</div>
<div>-- <br>
<div class="gmail_signature">Ariel Carrera</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-dev">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a></pre>
</blockquote>
<br>
</body>
</html>