Re: [keycloak-dev] A disabled user receives a confusing info message, if he tries to reset his password

From: "Michael Gerber" <gerbermichi(a)me.com&gt; To: "Stian Thorgersen" <stian(a)redhat.com&gt; Cc: keycloak-dev(a)lists.jboss.org Sent: Monday, 12 January, 2015 1:30:46 PM Subject: Re: [keycloak-dev] A disabled user receives a confusing info message, if he tries to reset his password Unfortunately, it isn't implemented like that. Have a look at the authenticateInternal method of the AuthenticationManager class. AuthenticationStatus.ACCOUNT_DISABLED; is returned before the validCredentials method is invoked. Best Michael Am 12. Januar 2015 um 12:25 schrieb Stian Thorgersen <stian(a)redhat.com&gt;: ----- Original Message ----- From: "Michael Gerber" <gerbermichi(a)me.com&gt; To: "Stian Thorgersen" <stian(a)redhat.com&gt; Cc: keycloak-dev(a)lists.jboss.org Sent: Monday, 12 January, 2015 11:20:02 AM Subject: Re: [keycloak-dev] A disabled user receives a confusing info message, if he tries to reset his password Thank you, that sounds logical. I just wondered, because you have a different error message for disabled users on the login screen. "Account is disabled, contact admin" That should only be shown after a user has logged in with valid username/password, if you try to login with an invalid password and disabled user it should show invalid username/password. Best Michael Am 12. Januar 2015 um 10:45 schrieb Stian Thorgersen <stian(a)redhat.com&gt;: This is intentional. If we provide specific error messages on reset password it can be used to find out whether or not a username/email is valid. Same applies to login, instead of saying invalid username it just says invalid username or password. As an improvement we could extend the message to say if you haven't received a message within a certain time, then retry or contact an admin/support. ----- Original Message ----- From: "Michael Gerber" <gerbermichi(a)me.com&gt; To: keycloak-dev(a)lists.jboss.org Sent: Friday, 9 January, 2015 4:01:49 PM Subject: [keycloak-dev] A disabled user receives a confusing info message, if he tries to reset his password A disabled user receives the following info message, if he tries to reset his password: You should receive an email shortly with further instructions. This is a bit confusing. A message like that would be nicer: Failed to send email, please contact the administrator. I will create a PR if that is ok with you? _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev