Re: [keycloak-dev] reset-password-email web service proposal for modification
----- Original Message -----
From: "Michael Gerber" <gerbermichi(a)me.com>
To: keycloak-dev(a)lists.jboss.org
Sent: Thursday, 1 January, 2015 2:26:12 PM
Subject: [keycloak-dev] reset-password-email web service proposal for modification
Hi
The reset-password-email rest web service sends an email to the user with the
following content:
Someone just requested to change your Keycloak account's password. If this
was you, click on the link below to set a new password:
http://localhost:8081/auth/realms/master/login-actions/password-reset?cod...
The link above navigates to a form where the user has to enter his username
or email address. After that he retrieves an other email with the following
content:
Someone just requested to change your Keycloak account's password. If this
was you, click on the link below to set a new password:
http://localhost:8081/auth/realms/master/login-actions/password-reset?key...
The user can than finally change his password and gets redirected to the
keycloak account page.
That's not the correct behaviour. The user should just be asked to update password
immediately. Please file a jira and do a PR for your fix.
Adding the redirect param is separate, so create another jira issue for that. If you'd
like you can send a separate PR for it, but you also would need to specify client_id so
Keycloak can verify it's a valid redirect_uri and generate a code that is associated
with the correct client.
I think this process is a bit complicated. Isn’t it possible to send just one
email? And it would be nice to pass a redirect URI to the web service.
I implemented the described changes to show you what I mean:
https://github.com/gerbermichi/keycloak/commit/1a892b70b1e788dfc5565d29f1...
Best
Michael
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev