5:24 a.m.
We are having issues with some users when they are attempting to use the password reset
feature. It does work for most users however for some they always end up at an error page
saying "WE'RE SORRY ... An error occurred, please login again through your
application"
What I have been able to determine so far is that for the affected users we are seeing a
double hit on that URL in the server logs and from what I understand, these reset URLs are
invalidated as soon as they are accessed.
So here's the state of play
* works for most users
* some users hitting the reset URL twice
* URL is only valid for the first access (I'm not 100% sure about this, can someone
confirm please?)
* URL is only valid for 30 minutes (but is being accessed within a few minutes of
generation)
* affected users are mostly using Outlook
* some people tend to double click links in emails but I've verified with a reliable
user that they are only clicking the link once
* having the affected person send themselves another reset email and then copy and paste
the URL from the mail client usually resolves this problem
And questions
* is this an issue anyone else has noticed with Outlook, doesn't affect ALL Outlook
users, just some
* is there a way to prevent the URL from being invalidated on initial access
* is it feasible to change the behavior so that the URL is only invalidated when the
password is changed
* any other thoughts on how to avoid this issue?
Thanks and Regards,
Michael Anthon
InfoView Technologies Pty Ltd
12/15 Adelaide St, Brisbane Qld 4000
P O Box 15478, City East, Brisbane Qld 4000
PH: +61 7 3014 2204
F: +61 7 3014 2200
M: +61 408 768 055
michael.anthon(a)infoview.com.au
The information transmitted is intended only for the person or entity to which it is
addressed and may contain confidential and/or privileged material. Any review,
retransmission, dissemination or other use of, or taking of any action in reliance upon,
this information by persons or entities other than the intended recipient is prohibited.
If you received this in error, please contact the sender and delete the material from any
computer. Any views or opinions expressed in this email are solely those of the author and
do not necessarily represent those of InfoView Technologies Pty Ltd.
10:21 a.m.
It should be possible to open the link multiple times, but only submit the
password reset once. If that's not the case (sounds like it is) feel free
to create a JIRA issue to report this as a bug.
On 10 February 2016 at 05:24, Michael Anthon <michael.anthon(a)infoview.com.au
wrote:
We are having issues with some users when they are attempting to use
the
password reset feature. It does work for most users however for some they
always end up at an error page saying "WE'RE SORRY ... An error occurred,
please login again through your application"
What I have been able to determine so far is that for the affected users
we are seeing a double hit on that URL in the server logs and from what I
understand, these reset URLs are invalidated as soon as they are accessed.
So here's the state of play
* works for most users
* some users hitting the reset URL twice
* URL is only valid for the first access (I'm not 100% sure about this,
can someone confirm please?)
* URL is only valid for 30 minutes (but is being accessed within a few
minutes of generation)
* affected users are mostly using Outlook
* some people tend to double click links in emails but I've verified with
a reliable user that they are only clicking the link once
* having the affected person send themselves another reset email and then
copy and paste the URL from the mail client usually resolves this problem
And questions
* is this an issue anyone else has noticed with Outlook, doesn't affect
ALL Outlook users, just some
* is there a way to prevent the URL from being invalidated on initial
access
* is it feasible to change the behavior so that the URL is only
invalidated when the password is changed
* any other thoughts on how to avoid this issue?
Thanks and Regards,
Michael Anthon
InfoView Technologies Pty Ltd
12/15 Adelaide St, Brisbane Qld 4000
P O Box 15478, City East, Brisbane Qld 4000
PH: +61 7 3014 2204
F: +61 7 3014 2200
M: +61 408 768 055
michael.anthon(a)infoview.com.au
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material. Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited. If you received
this in error, please contact the sender and delete the material from any
computer. Any views or opinions expressed in this email are solely those of
the author and do not necessarily represent those of InfoView Technologies
Pty Ltd.
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
2:53 p.m.
We changed the "error" message in I think 1.9? Maybe 1.8 to say "You
clicked on a stale link. Maybe you have already verified your email?"
I'll look into improving this I guess.
On 2/10/2016 4:21 AM, Stian Thorgersen wrote:
It should be possible to open the link multiple times, but only
submit
the password reset once. If that's not the case (sounds like it is)
feel free to create a JIRA issue to report this as a bug.
On 10 February 2016 at 05:24, Michael Anthon
<michael.anthon(a)infoview.com.au
<mailto:michael.anthon@infoview.com.au>> wrote:
We are having issues with some users when they are attempting to
use the password reset feature. It does work for most users
however for some they always end up at an error page saying "WE'RE
SORRY ... An error occurred, please login again through your
application"
What I have been able to determine so far is that for the affected
users we are seeing a double hit on that URL in the server logs
and from what I understand, these reset URLs are invalidated as
soon as they are accessed.
So here's the state of play
* works for most users
* some users hitting the reset URL twice
* URL is only valid for the first access (I'm not 100% sure about
this, can someone confirm please?)
* URL is only valid for 30 minutes (but is being accessed within a
few minutes of generation)
* affected users are mostly using Outlook
* some people tend to double click links in emails but I've
verified with a reliable user that they are only clicking the link
once
* having the affected person send themselves another reset email
and then copy and paste the URL from the mail client usually
resolves this problem
And questions
* is this an issue anyone else has noticed with Outlook, doesn't
affect ALL Outlook users, just some
* is there a way to prevent the URL from being invalidated on
initial access
* is it feasible to change the behavior so that the URL is only
invalidated when the password is changed
* any other thoughts on how to avoid this issue?
Thanks and Regards,
Michael Anthon
InfoView Technologies Pty Ltd
12/15 Adelaide St, Brisbane Qld 4000
P O Box 15478, City East, Brisbane Qld 4000
PH: +61 7 3014 2204 <tel:%2B61%207%203014%202204>
F: +61 7 3014 2200 <tel:%2B61%207%203014%202200>
M: +61 408 768 055 <tel:%2B61%20408%20768%20055>
michael.anthon(a)infoview.com.au <mailto:michael.anthon@infoview.com.au>
The information transmitted is intended only for the person or
entity to which it is addressed and may contain confidential
and/or privileged material. Any review, retransmission,
dissemination or other use of, or taking of any action in reliance
upon, this information by persons or entities other than the
intended recipient is prohibited. If you received this in error,
please contact the sender and delete the material from any
computer. Any views or opinions expressed in this email are solely
those of the author and do not necessarily represent those of
InfoView Technologies Pty Ltd.
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
2:58 p.m.
It's not about the error message though. It should be possible to open the
link multiple times as long as the form is not submitted.
On 10 February 2016 at 14:53, Bill Burke <bburke(a)redhat.com> wrote:
We changed the "error" message in I think 1.9? Maybe 1.8
to say "You
clicked on a stale link. Maybe you have already verified your email?"
I'll look into improving this I guess.
On 2/10/2016 4:21 AM, Stian Thorgersen wrote:
It should be possible to open the link multiple times, but only submit the
password reset once. If that's not the case (sounds like it is) feel free
to create a JIRA issue to report this as a bug.
On 10 February 2016 at 05:24, Michael Anthon <
michael.anthon(a)infoview.com.au> wrote:
> We are having issues with some users when they are attempting to use the
> password reset feature. It does work for most users however for some they
> always end up at an error page saying "WE'RE SORRY ... An error occurred,
> please login again through your application"
>
> What I have been able to determine so far is that for the affected users
> we are seeing a double hit on that URL in the server logs and from what I
> understand, these reset URLs are invalidated as soon as they are accessed.
>
> So here's the state of play
> * works for most users
> * some users hitting the reset URL twice
> * URL is only valid for the first access (I'm not 100% sure about this,
> can someone confirm please?)
> * URL is only valid for 30 minutes (but is being accessed within a few
> minutes of generation)
> * affected users are mostly using Outlook
> * some people tend to double click links in emails but I've verified with
> a reliable user that they are only clicking the link once
> * having the affected person send themselves another reset email and then
> copy and paste the URL from the mail client usually resolves this problem
>
> And questions
> * is this an issue anyone else has noticed with Outlook, doesn't affect
> ALL Outlook users, just some
> * is there a way to prevent the URL from being invalidated on initial
> access
> * is it feasible to change the behavior so that the URL is only
> invalidated when the password is changed
> * any other thoughts on how to avoid this issue?
>
> Thanks and Regards,
>
> Michael Anthon
> InfoView Technologies Pty Ltd
> 12/15 Adelaide St, Brisbane Qld 4000
> P O Box 15478, City East, Brisbane Qld 4000
> PH: +61 7 3014 2204 <%2B61%207%203014%202204>
> F: +61 7 3014 2200 <%2B61%207%203014%202200>
> M: +61 408 768 055 <%2B61%20408%20768%20055>
> michael.anthon(a)infoview.com.au
>
> The information transmitted is intended only for the person or entity to
> which it is addressed and may contain confidential and/or privileged
> material. Any review, retransmission, dissemination or other use of, or
> taking of any action in reliance upon, this information by persons or
> entities other than the intended recipient is prohibited. If you received
> this in error, please contact the sender and delete the material from any
> computer. Any views or opinions expressed in this email are solely those of
> the author and do not necessarily represent those of InfoView Technologies
> Pty Ltd.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
_______________________________________________
keycloak-user mailing
listkeycloak-user@lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hathttp://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
3:15 p.m.
I think this may have been fixed in 1.9 with the flow changes I made. I
don't have time to try it out right now though.
On 2/10/2016 8:58 AM, Stian Thorgersen wrote:
It's not about the error message though. It should be possible to
open
the link multiple times as long as the form is not submitted.
On 10 February 2016 at 14:53, Bill Burke <bburke(a)redhat.com
<mailto:bburke@redhat.com>> wrote:
We changed the "error" message in I think 1.9? Maybe 1.8 to say
"You clicked on a stale link. Maybe you have already verified
your email?" I'll look into improving this I guess.
On 2/10/2016 4:21 AM, Stian Thorgersen wrote:
> It should be possible to open the link multiple times, but only
> submit the password reset once. If that's not the case (sounds
> like it is) feel free to create a JIRA issue to report this as a bug.
>
> On 10 February 2016 at 05:24, Michael Anthon
> <michael.anthon(a)infoview.com.au
> <mailto:michael.anthon@infoview.com.au>> wrote:
>
> We are having issues with some users when they are attempting
> to use the password reset feature. It does work for most
> users however for some they always end up at an error page
> saying "WE'RE SORRY ... An error occurred, please login again
> through your application"
>
> What I have been able to determine so far is that for the
> affected users we are seeing a double hit on that URL in the
> server logs and from what I understand, these reset URLs are
> invalidated as soon as they are accessed.
>
> So here's the state of play
> * works for most users
> * some users hitting the reset URL twice
> * URL is only valid for the first access (I'm not 100% sure
> about this, can someone confirm please?)
> * URL is only valid for 30 minutes (but is being accessed
> within a few minutes of generation)
> * affected users are mostly using Outlook
> * some people tend to double click links in emails but I've
> verified with a reliable user that they are only clicking the
> link once
> * having the affected person send themselves another reset
> email and then copy and paste the URL from the mail client
> usually resolves this problem
>
> And questions
> * is this an issue anyone else has noticed with Outlook,
> doesn't affect ALL Outlook users, just some
> * is there a way to prevent the URL from being invalidated on
> initial access
> * is it feasible to change the behavior so that the URL is
> only invalidated when the password is changed
> * any other thoughts on how to avoid this issue?
>
> Thanks and Regards,
>
> Michael Anthon
> InfoView Technologies Pty Ltd
> 12/15 Adelaide St, Brisbane Qld 4000
> P O Box 15478, City East, Brisbane Qld 4000
> PH: +61 7 3014 2204 <tel:%2B61%207%203014%202204>
> F: +61 7 3014 2200 <tel:%2B61%207%203014%202200>
> M: +61 408 768 055 <tel:%2B61%20408%20768%20055>
> michael.anthon(a)infoview.com.au
> <mailto:michael.anthon@infoview.com.au>
>
> The information transmitted is intended only for the person
> or entity to which it is addressed and may contain
> confidential and/or privileged material. Any review,
> retransmission, dissemination or other use of, or taking of
> any action in reliance upon, this information by persons or
> entities other than the intended recipient is prohibited. If
> you received this in error, please contact the sender and
> delete the material from any computer. Any views or opinions
> expressed in this email are solely those of the author and do
> not necessarily represent those of InfoView Technologies Pty Ltd.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> <mailto:keycloak-user@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
3:25 p.m.
Michael,
Can you confirm if this issue still exists on 1.9.0.CR1 and if it does
create a JIRA issue?
On 10 February 2016 at 15:15, Bill Burke <bburke(a)redhat.com> wrote:
I think this may have been fixed in 1.9 with the flow changes I made.
I
don't have time to try it out right now though.
On 2/10/2016 8:58 AM, Stian Thorgersen wrote:
It's not about the error message though. It should be possible to open the
link multiple times as long as the form is not submitted.
On 10 February 2016 at 14:53, Bill Burke <bburke(a)redhat.com> wrote:
> We changed the "error" message in I think 1.9? Maybe 1.8 to say "You
> clicked on a stale link. Maybe you have already verified your email?"
> I'll look into improving this I guess.
>
>
> On 2/10/2016 4:21 AM, Stian Thorgersen wrote:
>
> It should be possible to open the link multiple times, but only submit
> the password reset once. If that's not the case (sounds like it is) feel
> free to create a JIRA issue to report this as a bug.
>
> On 10 February 2016 at 05:24, Michael Anthon <
> <michael.anthon@infoview.com.au>michael.anthon(a)infoview.com.au> wrote:
>
>> We are having issues with some users when they are attempting to use the
>> password reset feature. It does work for most users however for some they
>> always end up at an error page saying "WE'RE SORRY ... An error
occurred,
>> please login again through your application"
>>
>> What I have been able to determine so far is that for the affected users
>> we are seeing a double hit on that URL in the server logs and from what I
>> understand, these reset URLs are invalidated as soon as they are accessed.
>>
>> So here's the state of play
>> * works for most users
>> * some users hitting the reset URL twice
>> * URL is only valid for the first access (I'm not 100% sure about this,
>> can someone confirm please?)
>> * URL is only valid for 30 minutes (but is being accessed within a few
>> minutes of generation)
>> * affected users are mostly using Outlook
>> * some people tend to double click links in emails but I've verified
>> with a reliable user that they are only clicking the link once
>> * having the affected person send themselves another reset email and
>> then copy and paste the URL from the mail client usually resolves this
>> problem
>>
>> And questions
>> * is this an issue anyone else has noticed with Outlook, doesn't affect
>> ALL Outlook users, just some
>> * is there a way to prevent the URL from being invalidated on initial
>> access
>> * is it feasible to change the behavior so that the URL is only
>> invalidated when the password is changed
>> * any other thoughts on how to avoid this issue?
>>
>> Thanks and Regards,
>>
>> Michael Anthon
>> InfoView Technologies Pty Ltd
>> 12/15 Adelaide St, Brisbane Qld 4000
>> P O Box 15478, City East, Brisbane Qld 4000
>> PH: +61 7 3014 2204 <%2B61%207%203014%202204>
>> F: +61 7 3014 2200 <%2B61%207%203014%202200>
>> M: +61 408 768 055 <%2B61%20408%20768%20055>
>> michael.anthon(a)infoview.com.au
>>
>> The information transmitted is intended only for the person or entity to
>> which it is addressed and may contain confidential and/or privileged
>> material. Any review, retransmission, dissemination or other use of, or
>> taking of any action in reliance upon, this information by persons or
>> entities other than the intended recipient is prohibited. If you received
>> this in error, please contact the sender and delete the material from any
>> computer. Any views or opinions expressed in this email are solely those of
>> the author and do not necessarily represent those of InfoView Technologies
>> Pty Ltd.
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
>
> _______________________________________________
> keycloak-user mailing
listkeycloak-user@lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> --
> Bill Burke
> JBoss, a division of Red Hathttp://bill.burkecentral.com
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
--
Bill Burke
JBoss, a division of Red Hathttp://bill.burkecentral.com
5:42 a.m.
Thanks for the replies, I forgot to mention we are currently on 1.6.1.Final however we do
have a test setup where we can run an upgrade and check this out.
Will try that and report back and/or create a ticket as required.
Cheers,
Michael
From: Stian Thorgersen [mailto:sthorger@redhat.com]
Sent: Thursday, 11 February 2016 12:26 AM
To: Bill Burke <bburke(a)redhat.com>; Michael Anthon
<michael.anthon(a)infoview.com.au>
Cc: keycloak-user <keycloak-user(a)lists.jboss.org>
Subject: Re: [keycloak-user] Issues with password reset link expiration
Michael,
Can you confirm if this issue still exists on 1.9.0.CR1 and if it does create a JIRA
issue?
On 10 February 2016 at 15:15, Bill Burke
<bburke@redhat.com<mailto:bburke@redhat.com>> wrote:
I think this may have been fixed in 1.9 with the flow changes I made. I don't have
time to try it out right now though.
On 2/10/2016 8:58 AM, Stian Thorgersen wrote:
It's not about the error message though. It should be possible to open the link
multiple times as long as the form is not submitted.
On 10 February 2016 at 14:53, Bill Burke
<bburke@redhat.com<mailto:bburke@redhat.com>> wrote:
We changed the "error" message in I think 1.9? Maybe 1.8 to say "You
clicked on a stale link. Maybe you have already verified your email?" I'll look
into improving this I guess.
On 2/10/2016 4:21 AM, Stian Thorgersen wrote:
It should be possible to open the link multiple times, but only submit the password reset
once. If that's not the case (sounds like it is) feel free to create a JIRA issue to
report this as a bug.
On 10 February 2016 at 05:24, Michael Anthon
<michael.anthon@infoview.com.au<mailto:michael.anthon@infoview.com.au>>
wrote:
We are having issues with some users when they are attempting to use the password reset
feature. It does work for most users however for some they always end up at an error page
saying "WE'RE SORRY ... An error occurred, please login again through your
application"
What I have been able to determine so far is that for the affected users we are seeing a
double hit on that URL in the server logs and from what I understand, these reset URLs are
invalidated as soon as they are accessed.
So here's the state of play
* works for most users
* some users hitting the reset URL twice
* URL is only valid for the first access (I'm not 100% sure about this, can someone
confirm please?)
* URL is only valid for 30 minutes (but is being accessed within a few minutes of
generation)
* affected users are mostly using Outlook
* some people tend to double click links in emails but I've verified with a reliable
user that they are only clicking the link once
* having the affected person send themselves another reset email and then copy and paste
the URL from the mail client usually resolves this problem
And questions
* is this an issue anyone else has noticed with Outlook, doesn't affect ALL Outlook
users, just some
* is there a way to prevent the URL from being invalidated on initial access
* is it feasible to change the behavior so that the URL is only invalidated when the
password is changed
* any other thoughts on how to avoid this issue?
Thanks and Regards,
Michael Anthon
InfoView Technologies Pty Ltd
12/15 Adelaide St, Brisbane Qld 4000
P O Box 15478, City East, Brisbane Qld 4000
PH: +61 7 3014 2204<tel:%2B61%207%203014%202204>
F: +61 7 3014 2200<tel:%2B61%207%203014%202200>
M: +61 408 768 055<tel:%2B61%20408%20768%20055>
michael.anthon@infoview.com.au<mailto:michael.anthon@infoview.com.au>
The information transmitted is intended only for the person or entity to which it is
addressed and may contain confidential and/or privileged material. Any review,
retransmission, dissemination or other use of, or taking of any action in reliance upon,
this information by persons or entities other than the intended recipient is prohibited.
If you received this in error, please contact the sender and delete the material from any
computer. Any views or opinions expressed in this email are solely those of the author and
do not necessarily represent those of InfoView Technologies Pty Ltd.
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
8:44 a.m.
We have verified that the behavior is correct in 1.9.0.CR1.
Cheers,
Michael
From: keycloak-user-bounces(a)lists.jboss.org [mailto:keycloak-user-bounces@lists.jboss.org]
On Behalf Of Michael Anthon
Sent: Thursday, 11 February 2016 2:42 PM
To: keycloak-user(a)lists.jboss.org
Subject: Re: [keycloak-user] Issues with password reset link expiration
Thanks for the replies, I forgot to mention we are currently on 1.6.1.Final however we do
have a test setup where we can run an upgrade and check this out.
Will try that and report back and/or create a ticket as required.
Cheers,
Michael
From: Stian Thorgersen [mailto:sthorger@redhat.com]
Sent: Thursday, 11 February 2016 12:26 AM
To: Bill Burke <bburke@redhat.com<mailto:bburke@redhat.com>>; Michael Anthon
<michael.anthon@infoview.com.au<mailto:michael.anthon@infoview.com.au>>
Cc: keycloak-user
<keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>>
Subject: Re: [keycloak-user] Issues with password reset link expiration
Michael,
Can you confirm if this issue still exists on 1.9.0.CR1 and if it does create a JIRA
issue?
On 10 February 2016 at 15:15, Bill Burke
<bburke@redhat.com<mailto:bburke@redhat.com>> wrote:
I think this may have been fixed in 1.9 with the flow changes I made. I don't have
time to try it out right now though.
On 2/10/2016 8:58 AM, Stian Thorgersen wrote:
It's not about the error message though. It should be possible to open the link
multiple times as long as the form is not submitted.
On 10 February 2016 at 14:53, Bill Burke
<bburke@redhat.com<mailto:bburke@redhat.com>> wrote:
We changed the "error" message in I think 1.9? Maybe 1.8 to say "You
clicked on a stale link. Maybe you have already verified your email?" I'll look
into improving this I guess.
On 2/10/2016 4:21 AM, Stian Thorgersen wrote:
It should be possible to open the link multiple times, but only submit the password reset
once. If that's not the case (sounds like it is) feel free to create a JIRA issue to
report this as a bug.
On 10 February 2016 at 05:24, Michael Anthon
<michael.anthon@infoview.com.au<mailto:michael.anthon@infoview.com.au>>
wrote:
We are having issues with some users when they are attempting to use the password reset
feature. It does work for most users however for some they always end up at an error page
saying "WE'RE SORRY ... An error occurred, please login again through your
application"
What I have been able to determine so far is that for the affected users we are seeing a
double hit on that URL in the server logs and from what I understand, these reset URLs are
invalidated as soon as they are accessed.
So here's the state of play
* works for most users
* some users hitting the reset URL twice
* URL is only valid for the first access (I'm not 100% sure about this, can someone
confirm please?)
* URL is only valid for 30 minutes (but is being accessed within a few minutes of
generation)
* affected users are mostly using Outlook
* some people tend to double click links in emails but I've verified with a reliable
user that they are only clicking the link once
* having the affected person send themselves another reset email and then copy and paste
the URL from the mail client usually resolves this problem
And questions
* is this an issue anyone else has noticed with Outlook, doesn't affect ALL Outlook
users, just some
* is there a way to prevent the URL from being invalidated on initial access
* is it feasible to change the behavior so that the URL is only invalidated when the
password is changed
* any other thoughts on how to avoid this issue?
Thanks and Regards,
Michael Anthon
InfoView Technologies Pty Ltd
12/15 Adelaide St, Brisbane Qld 4000
P O Box 15478, City East, Brisbane Qld 4000
PH: +61 7 3014 2204<tel:%2B61%207%203014%202204>
F: +61 7 3014 2200<tel:%2B61%207%203014%202200>
M: +61 408 768 055<tel:%2B61%20408%20768%20055>
michael.anthon@infoview.com.au<mailto:michael.anthon@infoview.com.au>
The information transmitted is intended only for the person or entity to which it is
addressed and may contain confidential and/or privileged material. Any review,
retransmission, dissemination or other use of, or taking of any action in reliance upon,
this information by persons or entities other than the intended recipient is prohibited.
If you received this in error, please contact the sender and delete the material from any
computer. Any views or opinions expressed in this email are solely those of the author and
do not necessarily represent those of InfoView Technologies Pty Ltd.
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
8:56 a.m.
Great, thanks for the update
On 12 February 2016 at 08:44, Michael Anthon <michael.anthon(a)infoview.com.au
wrote:
> We have verified that the behavior is correct in 1.9.0.CR1.
>
>
>
> Cheers,
>
> Michael
>
>
>
> *From:* keycloak-user-bounces(a)lists.jboss.org [mailto:
> keycloak-user-bounces(a)lists.jboss.org] *On Behalf Of *Michael Anthon
> *Sent:* Thursday, 11 February 2016 2:42 PM
> *To:* keycloak-user(a)lists.jboss.org
>
> *Subject:* Re: [keycloak-user] Issues with password reset link expiration
>
>
>
> Thanks for the replies, I forgot to mention we are currently on
> 1.6.1.Final however we do have a test setup where we can run an upgrade and
> check this out.
>
>
>
> Will try that and report back and/or create a ticket as required.
>
>
>
> Cheers,
>
> Michael
>
>
>
> *From:* Stian Thorgersen [mailto:sthorger@redhat.com <sthorger(a)redhat.com>]
>
> *Sent:* Thursday, 11 February 2016 12:26 AM
> *To:* Bill Burke <bburke(a)redhat.com>; Michael Anthon <
> michael.anthon(a)infoview.com.au>
> *Cc:* keycloak-user <keycloak-user(a)lists.jboss.org>
> *Subject:* Re: [keycloak-user] Issues with password reset link expiration
>
>
>
> Michael,
>
>
>
> Can you confirm if this issue still exists on 1.9.0.CR1 and if it does
> create a JIRA issue?
>
>
>
> On 10 February 2016 at 15:15, Bill Burke <bburke(a)redhat.com wrote:
>
> I think this may have been fixed in 1.9 with the flow changes I made. I
> don't have time to try it out right now though.
>
>
>
> On 2/10/2016 8:58 AM, Stian Thorgersen wrote:
>
> It's not about the error message though. It should be possible to open the
> link multiple times as long as the form is not submitted.
>
>
>
> On 10 February 2016 at 14:53, Bill Burke <bburke(a)redhat.com wrote:
>
> We changed the "error" message in I think 1.9? Maybe 1.8 to say "You
> clicked on a stale link. Maybe you have already verified your email?"
> I'll look into improving this I guess.
>
>
>
> On 2/10/2016 4:21 AM, Stian Thorgersen wrote:
>
> It should be possible to open the link multiple times, but only submit the
> password reset once. If that's not the case (sounds like it is) feel free
> to create a JIRA issue to report this as a bug.
>
>
>
> On 10 February 2016 at 05:24, Michael Anthon <
> michael.anthon(a)infoview.com.au wrote:
>
> We are having issues with some users when they are attempting to use the
> password reset feature. It does work for most users however for some they
> always end up at an error page saying "WE'RE SORRY ... An error occurred,
> please login again through your application"
>
> What I have been able to determine so far is that for the affected users
> we are seeing a double hit on that URL in the server logs and from what I
> understand, these reset URLs are invalidated as soon as they are accessed.
>
> So here's the state of play
> * works for most users
> * some users hitting the reset URL twice
> * URL is only valid for the first access (I'm not 100% sure about this,
> can someone confirm please?)
> * URL is only valid for 30 minutes (but is being accessed within a few
> minutes of generation)
> * affected users are mostly using Outlook
> * some people tend to double click links in emails but I've verified with
> a reliable user that they are only clicking the link once
> * having the affected person send themselves another reset email and then
> copy and paste the URL from the mail client usually resolves this problem
>
> And questions
> * is this an issue anyone else has noticed with Outlook, doesn't affect
> ALL Outlook users, just some
> * is there a way to prevent the URL from being invalidated on initial
> access
> * is it feasible to change the behavior so that the URL is only
> invalidated when the password is changed
> * any other thoughts on how to avoid this issue?
>
> Thanks and Regards,
>
> Michael Anthon
> InfoView Technologies Pty Ltd
> 12/15 Adelaide St, Brisbane Qld 4000
> P O Box 15478, City East, Brisbane Qld 4000
> PH: +61 7 3014 2204
> F: +61 7 3014 2200
> M: +61 408 768 055
> michael.anthon(a)infoview.com.au
>
> The information transmitted is intended only for the person or entity to
> which it is addressed and may contain confidential and/or privileged
> material. Any review, retransmission, dissemination or other use of, or
> taking of any action in reliance upon, this information by persons or
> entities other than the intended recipient is prohibited. If you received
> this in error, please contact the sender and delete the material from any
> computer. Any views or opinions expressed in this email are solely those of
> the author and do not necessarily represent those of InfoView Technologies
> Pty Ltd.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
>
>
> _______________________________________________
>
> keycloak-user mailing list
>
> keycloak-user(a)lists.jboss.org
>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
> --
>
> Bill Burke
>
> JBoss, a division of Red Hat
>
> http://bill.burkecentral.com
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
>
>
> --
>
> Bill Burke
>
> JBoss, a division of Red Hat
>
> http://bill.burkecentral.com
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
3060
days inactive
3062
days old
8 comments
3 participants
participants (3)
-
Bill Burke -
Michael Anthon -
Stian Thorgersen