<div dir="ltr"><div>Hi,</div><div><br></div><div>In this url:</div><div><a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/auth_spi.html#d4e4003">http://keycloak.github.io/docs/userguide/keycloak-server/html/auth_spi.html#d4e4003</a><br></div><div><br></div><div>, it says:</div><a id="d4e4003" style="color:rgb(51,51,51);font-family:"Lucida Grande",Geneva,Verdana,Arial,sans-serif;font-size:12px;line-height:18px;text-align:justify"><p>"This form *WILL NOT* re-ask the user to enter in an email or username if the previous email or username did not exist. You need to prevent attackers from being able to guess valid users. So, if AuthenticationFlowContext.getUser() returns null, you should proceed with the flow to make it look like a valid user was selected."</p></a><div>And I totally agree with that, but it doesn't apply to all cases unfortunately. If the admin enables "User registration", the user registration form will tell the a possible malicious guy if the email combinations she's trying already exists, invalidating what the above paragraph says. And I don't think there's a way to do the same as in the "forgot password" feature with the registration form, because after registration, there's an autologin.</div><div><br></div><div>Actually it's confusing for users telling them an email was sent event if it's not... People sometimes can forget that they're not registered in the Keycloak system, so the "forgot password" feature as it is today will make them wait forever. At least, sending them an email telling them "You're not registered. You can register visiting this link." if "User registration" is enabled or "Ask your admin to register your email in the system" if it's not, would be definitely better.</div><div><br></div><div>Thanks.</div><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><p style="margin:0cm 0cm 0.0001pt;color:rgb(0,0,0);font-family:"Times New Roman",serif;font-size:12pt"><b><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(94,94,94)" lang="EN-US">Tomás García Pérez<br></span></b></p><p style="margin:0cm 0cm 0.0001pt"><font color="#5e5e5e" face="Arial, sans-serif"><span style="font-size:12px"><b>Software Developer</b></span></font></p><p style="margin:0cm 0cm 0.0001pt"><span style="font-size:9pt"><font color="#5e5e5e" face="Arial, sans-serif"><b>IntraHouse</b></font></span><span style="font-family:Calibri,sans-serif;font-size:9pt;color:rgb(0,0,0)"> </span></p></div></div></div></div></div>
</div>