Re: [keycloak-dev] Cleanup of 'Change password' screen in Account app

+1 To setting re-auth after a configurable time for both admin console and account mngmt. I still think we should ask for password though. On 27 November 2015 at 11:45, Stian Thorgersen <sthorger(a)redhat.com&gt; wrote: > > > On 27 November 2015 at 10:23, Vlastimil Elias <velias(a)redhat.com&gt; wrote: > >> Hi, >> >> I have two proposals for cleanup of 'Change password' screen in Account >> app based on my experience with it: >> >> 1. remove Cancel button - it has no any meaning on this screen/form, it >> only reshowns form with empty fields. And also there is a bug, >> "Password" field is hidden when it is used, which makes whole form >> unusable. >> > > +1 > > >> >> 2. remove validation of current password (remove "Password" field). Two >> reasons for this: >> - security impact of this check is small. If attacker is able to >> compromise Account app then he can always change email and then use >> "Forgot password" feature to change password >> - user created over Identity Provider do not know old password >> (because it is not set) so he is not able to set password using this >> screen >> After we implement support for reauthentication (KEYCLOAK-2076) then we >> should set some reasonable reauth timeout for Account app instead, this >> will make it more secure at all. >> > > -1 Reset password over email may not be enabled at all. We already allow > setting password for IdPs login without requiring the existing password. > > +1 To suggestion from Thomas - we should ask for password when updating > email at least when recover password over email is enabled. > > It seems to be common practice to ask for current password when updating > the existing password. > > >> >> If you agree then I can create JIRA issue for this and provide PR. >> >> Vlastimil >> >> -- >> Vlastimil Elias >> Principal Software Engineer >> Developer Portal Engineering Team >> >> >> >> _______________________________________________ >> keycloak-dev mailing list >> keycloak-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-dev >> > >