<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Done.<div class=""><a href="https://issues.jboss.org/browse/KEYCLOAK-1576" class="">https://issues.jboss.org/browse/KEYCLOAK-1576</a></div><div class=""><br class=""></div><div class="">Thanks!</div><div class=""><br class="">
<br class=""><div style=""><blockquote type="cite" class=""><div class="">Am 16.07.2015 um 14:32 schrieb Stian Thorgersen <<a href="mailto:stian@redhat.com" class="">stian@redhat.com</a>>:</div><br class="Apple-interchange-newline"><div class="">Can you create a JIRA for this please?<br class=""><br class="">----- Original Message -----<br class=""><blockquote type="cite" class="">From: "Niko Köbler" <<a href="mailto:niko@n-k.de" class="">niko@n-k.de</a>><br class="">To: "Stian Thorgersen" <<a href="mailto:stian@redhat.com" class="">stian@redhat.com</a>><br class="">Cc: <a href="mailto:keycloak-user@lists.jboss.org" class="">keycloak-user@lists.jboss.org</a><br class="">Sent: Thursday, 16 July, 2015 2:30:31 PM<br class="">Subject: Re: [keycloak-user] Login user action lifespan<br class=""><br class="">sorry, I forgot to mention this step, I actually changed the password (set it<br class="">the first time)<br class=""><br class="">In the meantime I tried this loop (click link in mail, change password, log<br class="">in) more than 5 times… it still works!<br class=""><br class=""><br class=""><blockquote type="cite" class="">Am 16.07.2015 um 14:26 schrieb Stian Thorgersen <<a href="mailto:stian@redhat.com" class="">stian@redhat.com</a>>:<br class=""><br class=""><br class=""><br class="">----- Original Message -----<br class=""><blockquote type="cite" class="">From: "Niko Köbler" <<a href="mailto:niko@n-k.de" class="">niko@n-k.de</a>><br class="">To: "Stian Thorgersen" <<a href="mailto:stian@redhat.com" class="">stian@redhat.com</a>><br class="">Cc: <a href="mailto:keycloak-user@lists.jboss.org" class="">keycloak-user@lists.jboss.org</a><br class="">Sent: Thursday, 16 July, 2015 2:24:40 PM<br class="">Subject: Re: [keycloak-user] Login user action lifespan<br class=""><br class="">We are still on 1.2.0<br class=""><br class="">Steps to reproduce:<br class="">- create a user via Admin API<br class="">- trigger to send the password-reset mail via Admin API<br class="">- click on the link in the mail to set the password<br class="">- try to log in -> works<br class=""></blockquote><br class="">Have you actually changed the password here, or just log in?<br class=""><br class=""><blockquote type="cite" class="">- go back to your mails, click again on the password-reset link in the<br class="">mail<br class="">- change your password<br class="">- try to log in with old password -> doesn’t work<br class="">- try to log in with new password -> works<br class="">- and so on…<br class=""><br class=""><br class=""><br class=""><blockquote type="cite" class="">Am 16.07.2015 um 14:00 schrieb Stian Thorgersen <<a href="mailto:stian@redhat.com" class="">stian@redhat.com</a>>:<br class=""><br class="">That's definitively not correct behavior. What version are you on? Can<br class="">you<br class="">give me exact steps to reproduce?<br class=""><br class="">----- Original Message -----<br class=""><blockquote type="cite" class="">From: "Niko Köbler" <<a href="mailto:niko@n-k.de" class="">niko@n-k.de</a>><br class="">To: "Stian Thorgersen" <<a href="mailto:stian@redhat.com" class="">stian@redhat.com</a>><br class="">Cc: <a href="mailto:keycloak-user@lists.jboss.org" class="">keycloak-user@lists.jboss.org</a><br class="">Sent: Thursday, 16 July, 2015 1:58:21 PM<br class="">Subject: Re: [keycloak-user] Login user action lifespan<br class=""><br class="">It is valid.<br class="">I can change my password again and again…<br class=""><br class=""><br class=""><blockquote type="cite" class="">Am 16.07.2015 um 13:49 schrieb Stian Thorgersen <<a href="mailto:stian@redhat.com" class="">stian@redhat.com</a>>:<br class=""><br class="">Does it seem that it is valid, or is it valid? It should only be usable<br class="">once.<br class=""><br class="">----- Original Message -----<br class=""><blockquote type="cite" class="">From: "Niko Köbler" <<a href="mailto:niko@n-k.de" class="">niko@n-k.de</a>><br class="">To: <a href="mailto:keycloak-user@lists.jboss.org" class="">keycloak-user@lists.jboss.org</a><br class="">Sent: Thursday, 16 July, 2015 1:45:43 PM<br class="">Subject: [keycloak-user] Login user action lifespan<br class=""><br class="">Hi,<br class=""><br class="">you can set the „login user action lifespan“ in realm settings for the<br class="">time<br class="">the link is valid for a user to set a password (or other tasks).<br class="">This link seems to be valid and working even if the user has clicked<br class="">on<br class="">it<br class="">and has done the tasks.<br class=""><br class="">Is it possible to configure this link to be valid only once during its<br class="">lifespan ? Or at least to be invalid as soon the user has set his<br class="">password/done the login actions?<br class="">Otherwise this link could be used to change the password again, after<br class="">the<br class="">user has already set his password - possibly from third persons who<br class="">got<br class="">known of this link. May be a security issue?<br class=""><br class="">Thanks & regards,<br class="">- Niko<br class="">_______________________________________________<br class="">keycloak-user mailing list<br class=""><a href="mailto:keycloak-user@lists.jboss.org" class="">keycloak-user@lists.jboss.org</a><br class="">https://lists.jboss.org/mailman/listinfo/keycloak-user<br class=""></blockquote></blockquote><br class=""><br class=""></blockquote></blockquote><br class=""><br class=""></blockquote></blockquote><br class=""><br class=""></blockquote></div></blockquote></div><br class=""></div></body></html>