1:40 a.m.
Hi,
When a user clicks on reset password/forget password and enters an email id
which is not registered with keycloak, it does not show any error.
Is there any option to give an error message to the user saying "email id
doesn't exist".
Note : We are using keycloak 1.6.0Final.
Thanks,
Jayapriya Atheesan
7:02 a.m.
Hi All,
Any help would be appreciated.
Thanks,
Jayapriya Atheesan
On Mon, May 23, 2016 at 12:10 PM, JAYAPRIYA ATHEESAN <
jayapriya.atheesan(a)gmail.com> wrote:
Hi,
When a user clicks on reset password/forget password and enters an email
id which is not registered with keycloak, it does not show any error.
Is there any option to give an error message to the user saying “email id
doesn’t exist”.
Note : We are using keycloak 1.6.0Final.
Thanks,
Jayapriya Atheesan
--
*Regards,*
Jayapriya Atheesan
7:36 a.m.
Hi!
For security reasons I don't think Keycloak should reveal whether or not
the account exists. Instead the message shown to the user in response
should be something like "If the email address was found, you should soon
receive further instructions."
Best regards,
Thomas
On Tue, May 24, 2016 at 3:02 PM, Jayapriya Atheesan <
jayapriya.atheesan(a)gmail.com> wrote:
Hi All,
Any help would be appreciated.
Thanks,
Jayapriya Atheesan
On Mon, May 23, 2016 at 12:10 PM, JAYAPRIYA ATHEESAN <
jayapriya.atheesan(a)gmail.com> wrote:
> Hi,
>
>
>
> When a user clicks on reset password/forget password and enters an email
> id which is not registered with keycloak, it does not show any error.
>
> Is there any option to give an error message to the user saying “email id
> doesn’t exist”.
>
> Note : We are using keycloak 1.6.0Final.
>
>
>
> Thanks,
>
> Jayapriya Atheesan
>
>
>
--
*Regards,*
Jayapriya Atheesan
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
1:29 a.m.
Yep, the result to the user is the same regardless if a user with the email
exist. Same with the login screen it display invalid username or password,
not just invalid username.
On 24 May 2016 at 14:36, Thomas Raehalme <thomas.raehalme(a)aitiofinland.com>
wrote:
Hi!
For security reasons I don't think Keycloak should reveal whether or not
the account exists. Instead the message shown to the user in response
should be something like "If the email address was found, you should soon
receive further instructions."
Best regards,
Thomas
On Tue, May 24, 2016 at 3:02 PM, Jayapriya Atheesan <
jayapriya.atheesan(a)gmail.com> wrote:
> Hi All,
>
> Any help would be appreciated.
>
> Thanks,
> Jayapriya Atheesan
>
> On Mon, May 23, 2016 at 12:10 PM, JAYAPRIYA ATHEESAN <
> jayapriya.atheesan(a)gmail.com> wrote:
>
>> Hi,
>>
>>
>>
>> When a user clicks on reset password/forget password and enters an email
>> id which is not registered with keycloak, it does not show any error.
>>
>> Is there any option to give an error message to the user saying “email
>> id doesn’t exist”.
>>
>> Note : We are using keycloak 1.6.0Final.
>>
>>
>>
>> Thanks,
>>
>> Jayapriya Atheesan
>>
>>
>>
>
>
>
> --
> *Regards,*
> Jayapriya Atheesan
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
3:02 a.m.
OK.. Thanks a lot..
Thanks,
Jayapriya Atheesan
From: Stian Thorgersen [mailto:sthorger@redhat.com]
Sent: Wednesday, May 25, 2016 12:00 PM
To: Thomas Raehalme
Cc: Jayapriya Atheesan; keycloak-user
Subject: Re: [keycloak-user] Resetting password
Yep, the result to the user is the same regardless if a user with the email exist. Same
with the login screen it display invalid username or password, not just invalid username.
On 24 May 2016 at 14:36, Thomas Raehalme <thomas.raehalme(a)aitiofinland.com> wrote:
Hi!
For security reasons I don't think Keycloak should reveal whether or not the account
exists. Instead the message shown to the user in response should be something like
"If the email address was found, you should soon receive further instructions."
Best regards,
Thomas
On Tue, May 24, 2016 at 3:02 PM, Jayapriya Atheesan <jayapriya.atheesan(a)gmail.com>
wrote:
Hi All,
Any help would be appreciated.
Thanks,
Jayapriya Atheesan
On Mon, May 23, 2016 at 12:10 PM, JAYAPRIYA ATHEESAN <jayapriya.atheesan(a)gmail.com>
wrote:
Hi,
When a user clicks on reset password/forget password and enters an email id which is not
registered with keycloak, it does not show any error.
Is there any option to give an error message to the user saying “email id doesn’t exist”.
Note : We are using keycloak 1.6.0Final.
Thanks,
Jayapriya Atheesan
--
Regards,
Jayapriya Atheesan
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
3150
days inactive
3152
days old
4 comments
4 participants
participants (4)
-
JAYAPRIYA ATHEESAN -
Jayapriya Atheesan
-
Stian Thorgersen -
Thomas Raehalme