diff --git a/en/asgardeo/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png b/en/asgardeo/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png new file mode 100644 index 0000000000..8ee12fc039 Binary files /dev/null and b/en/asgardeo/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png differ diff --git a/en/identity-server/7.2.0/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png b/en/identity-server/7.2.0/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png new file mode 100644 index 0000000000..8ee12fc039 Binary files /dev/null and b/en/identity-server/7.2.0/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png differ diff --git a/en/identity-server/7.3.0/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png b/en/identity-server/7.3.0/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png new file mode 100644 index 0000000000..8ee12fc039 Binary files /dev/null and b/en/identity-server/7.3.0/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png differ diff --git a/en/identity-server/next/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png b/en/identity-server/next/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png new file mode 100644 index 0000000000..8ee12fc039 Binary files /dev/null and b/en/identity-server/next/docs/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png differ diff --git a/en/includes/guides/flows/password-recovery.md b/en/includes/guides/flows/password-recovery.md index da7a107374..dcd96282c1 100644 --- a/en/includes/guides/flows/password-recovery.md +++ b/en/includes/guides/flows/password-recovery.md @@ -92,6 +92,31 @@ Follow the steps below: Users can now enter any of their configured alternative login identifiers (such as email address) on the **Forgot Password?** page to start password recovery. +## Control account information disclosure + +The **Resolve User** step (the first step, where the user submits their identifier) has two settings that control how much the recovery flow reveals about an account: + +- **Notify User Existence**: Reveals whether the submitted identifier matches an existing account. +- **Notify User Account Status**: Reveals whether the account is locked or disabled. + +Both settings are **disabled by default** to prevent user enumeration. For the full behavior of each option, see [Resolve user properties](#resolve-user-properties). + +!!! warning + Enabling these notifications reveals account information (whether an account exists and its lock/disable status) and may lead to **user enumeration**. Keep them disabled unless immediate user feedback (such as catching a mistyped identifier) outweighs that risk. + +To enable the notifications: + +1. On the **Edit Password Recovery Flow** canvas, in the first step (where the user is resolved), hover over the action button (for example, **Continue**) and click the pencil icon that appears to open the button's **Properties** panel. + + ![Resolve User properties showing the Notify User Existence and Notify User Account Status checkboxes]({{base_path}}/assets/img/guides/flows/flow-password-recovery-resolve-user-properties.png){: width="400" style="display: block; margin: 0; border: 0.3px solid lightgrey;"} + +2. Under **Resolve User**, enable the required checkboxes: + + - **Notify User Existence** + - **Notify User Account Status** + +3. Click **Save Draft**, then publish the flow. + ## Reference This section provides details on the configuration options available in the Password Recovery Flow. @@ -102,3 +127,10 @@ The Flow Completion Properties, configured on the End node, define the final act - **Auto Login**: If enabled, the user is automatically logged into their account immediately after successfully completing the password recovery flow. - **Send a notification email on flow completion:** When enabled, the user will receive an email confirming that their password recovery is complete and their account is ready to use. + +### Resolve user properties + +The Resolve User properties, configured on the action button of the first step, control what the recovery flow reveals when a user submits an identifier. Both are **disabled by default** — the secure posture, where every identifier (valid, non-existent, locked, or disabled) produces the same response, protecting the recovery form against user enumeration attacks. These controls apply regardless of whether the user starts recovery with a username or an [alternative login identifier](#configure-for-alternative-login-identifiers) such as an email address or mobile number. + +- **Notify User Existence**: When enabled, submitting an identifier that doesn't match any account shows a *"User does not exist"* error. When disabled, the flow continues to the next step (for example, the OTP screen) exactly as it would for a valid user, so it isn't possible to tell whether an account exists. +- **Notify User Account Status**: When enabled, a user with a locked or disabled account sees a specific error (for example, *"The account is locked"*, with reason-specific variants). When disabled, the account status is not revealed and the flow continues.