[JS1-517] Newly created user is allowed to log in even before acceptance by the administrator

• Type: Improvement
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 1.6-dev
• Component/s: Security
• Environment: All platforms
• Assignee: Unassigned
• Reporter: Jaq Marit
• Created: 04/Sep/04 06:29
• Updated: 04/Sep/04 06:29

Description

When a user registers for a new account, logs in immediately even without confirmation (awaiting acceptance from the administrator), the portal allows authentication and once authenticated, the portal prompts the user to change password. However, the portal keeps on prompting the user for the confirmation key. I think the user should never be allowed to log in if the account is not yet enabled/accepted.

Note the following settings:
newuser.confirm.enable=true
newuser.confirm.email.template=new-user-confirmation.vm

1. Manual approval of a new user by Jetspeed Administrator
   newuser.approval.enable=true

1. New user notification email to Jetspeed Administrator.
   newuser.notification.enable=true