<div dir="ltr"><pre style="color:rgb(0,0,0)">Yes, we already did our own authentication flow here a couple of weeks ago, but I decided today to communicate this situation.</pre><pre style="color:rgb(0,0,0)"><br></pre><pre style="color:rgb(0,0,0)">The question is that part of the documentation should be clarified, because at least I was confused after I saw the inconsistency </pre><pre style="color:rgb(0,0,0)">when seeing the behaviour of the registration form: A malicious user will still be capable of guessing valid users, so it's something that should </pre><pre style="color:rgb(0,0,0)">be warned to developers / admins<span style="font-family:arial,sans-serif">.</span></pre><pre style="color:rgb(0,0,0)"><br></pre><pre style="color:rgb(0,0,0)">(Sorry I activated the digest mode of the mailing list and I don't really know how to properly reply to a thread without receiving the original email)</pre><pre style="color:rgb(0,0,0)">------------------</pre><pre style="color:rgb(0,0,0)">Feel free to extend the plugin then. :)
On 6/15/16 4:49 PM, Tomás García wrote:
><i> Hi,
</i>><i>
</i>><i> In this url:
</i>><i> <a href="http://keycloak.github.io/docs/userguide/keycloak-server/html/auth_spi.html#d4e4003">http://keycloak.github.io/docs/userguide/keycloak-server/html/auth_spi.html#d4e4003</a>
</i>><i>
</i>><i> , it says:
</i>><i>
</i>><i> "This form *WILL NOT* re-ask the user to enter in an email or username
</i>><i> if the previous email or username did not exist. You need to prevent
</i>><i> attackers from being able to guess valid users. So, if
</i>><i> AuthenticationFlowContext.getUser() returns null, you should proceed
</i>><i> with the flow to make it look like a valid user was selected."
</i>><i>
</i>><i> And I totally agree with that, but it doesn't apply to all cases
</i>><i> unfortunately. If the admin enables "User registration", the user
</i>><i> registration form will tell the a possible malicious guy if the email
</i>><i> combinations she's trying already exists, invalidating what the above
</i>><i> paragraph says. And I don't think there's a way to do the same as in the
</i>><i> "forgot password" feature with the registration form, because after
</i>><i> registration, there's an autologin.
</i>><i>
</i>><i> Actually it's confusing for users telling them an email was sent event
</i>><i> if it's not... People sometimes can forget that they're not registered
</i>><i> in the Keycloak system, so the "forgot password" feature as it is today
</i>><i> will make them wait forever. At least, sending them an email telling
</i>><i> them "You're not registered. You can register visiting this link." if
</i>><i> "User registration" is enabled or "Ask your admin to register your email
</i>><i> in the system" if it's not, would be definitely better.
</i>><i>
</i>><i> Thanks.
</i>><i>
</i>><i> --
</i>><i>
</i>><i> *Tomás García Pérez
</i>><i> *
</i>><i>
</i>><i> *Software Developer*
</i>><i>
</i>><i> *IntraHouse*
</i>><i>
</i>><i>
</i>><i>
</i>><i> _______________________________________________
</i>><i> keycloak-user mailing list
</i>><i> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user">keycloak-user at lists.jboss.org</a>
</i>><i> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a>
</i>></pre><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><p style="margin:0cm 0cm 0.0001pt;color:rgb(0,0,0);font-family:"Times New Roman",serif;font-size:12pt"><b><span style="font-size:11pt;font-family:Arial,sans-serif;color:rgb(94,94,94)" lang="EN-US">Tomás García Pérez<br></span></b></p><p style="margin:0cm 0cm 0.0001pt"><font color="#5e5e5e" face="Arial, sans-serif"><span style="font-size:12px"><b>Software Developer</b></span></font></p><p style="margin:0cm 0cm 0.0001pt;color:rgb(0,0,0);font-family:"Times New Roman",serif;font-size:12pt"><span style="font-size:9pt;font-family:Calibri,sans-serif" lang="EN-US"> IntraHouse<br></span></p></div></div></div></div></div>
</div>