Add docs for enumeration and account status controls in password recovery flow

[VIHANGAGIT]

Purpose

Documents the new enumeration and account-status controls on the Resolve User step of the flow-based password recovery, introduced in WSO2 Identity Server.

Two per-tenant settings, configured on the action button of the first (Resolve User) step in the password recovery flow builder:

• Notify User Existence (notifyUserExistence) — when enabled, an unknown identifier returns a "User does not exist" error; when disabled, the flow continues silently as it would for a valid user.
• Notify User Account Status (notifyUserAccountStatus) — when enabled, locked/disabled accounts return a status-specific error; when disabled, the status is hidden and the flow continues.

Both are disabled by default (secure posture that prevents user enumeration). The docs explain the settings, the security trade-off, and how to enable them via the flow builder.

Changes

• en/includes/guides/flows/password-recovery.md (shared include):
  • New "Control account information disclosure" how-to section.
  • New "Resolve user properties" entry under Reference.

Related Issues

• Support for Account Status & User Enumeration Controls in new Flows product-is#27725

[coderabbitai]

Warning

Review limit reached

@VIHANGAGIT, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 29 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: a85cfaea-7a06-4f16-95db-f4c5dbd62ec1

📥 Commits

Reviewing files that changed from the base of the PR and between 6e32a7e and 54f6337.

⛔ Files ignored due to path filters (4)

• en/asgardeo/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png is excluded by !**/*.png
• en/identity-server/7.2.0/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png is excluded by !**/*.png
• en/identity-server/7.3.0/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png is excluded by !**/*.png
• en/identity-server/next/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png is excluded by !**/*.png

📒 Files selected for processing (1)

• en/includes/guides/flows/password-recovery.md

📝 Walkthrough

Walkthrough

This PR updates the password recovery guide to document two Resolve User settings, their default disabled state, the account-enumeration warning, and how they change observable recovery errors.

Changes

Password Recovery Documentation

Layer / File(s)	Summary
Account information disclosure controls en/includes/guides/flows/password-recovery.md	Adds the "Control account information disclosure" reference section and updates "Resolve user properties" to describe the "Notify User Existence" and "Notify User Account Status" settings, including their disabled-by-default behavior and error handling changes.

Suggested labels: Team/Authentication & registration

Suggested reviewers: KD23243

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers purpose and changes, but it omits the required Related PRs, Test environment, and Security checks sections.	Add the missing template sections: Related PRs, Test environment, and Security checks, and fill them out or mark them not applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the added documentation for enumeration and account-status controls in password recovery.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Docs preview: https://dairy-materials-operating-observed.trycloudflare.com

Product: asgardeo · Ref: recovery-flow-enumeration-controls · Live for 120 min.

Triggered by @ImalshaD via the Preview Docs workflow.

[ImalshaD]

Add a pointer