Hi Ankur,
Our development team explained why it would be a concern to provide an option to hide the link 'Can't access your account':
- as of Stash 3.5, the user is already provided with sufficient information to understand why the password can or cannot be resetted and what's the follow-up action he/she should perform:
- if the user's account is from a editable directory (in practice that means "Stash Internal Directory"), the user is notified that a link was sent to the account's email to reset its password;
- if the user's account is from a read-only directory, the user is notified of why the account's password cannot be resetted and that he/she could contact his/her administrator to change it;
- if the user's account does not exist, the user is notified that the account was not found and that he/she would verify the provided account name or email;
- additionally, except in the rare case where all the directories are external directories, Stash has usually one editable internal directory (because it is created by default when Stash is setup). And the users in that directory (such as the administrative account created during the setup) needs to be able to reset their accounts' passwords. If the link Can't access your account link was removed from the login page, our concern is that it would allow some (potentially critical) users to completely lock themselves out of Stash, without any mean to reset their passwords.
Please refer to https://jira.atlassian.com/browse/STASH-4458 for full discussion.
Note that Stash is 'read-only' for users fetched from external directories, meaning they can only be changed in the external directory itself and not using Stash UI.
We hope that this answer clarifies the decision.
Best regards,
Thiago Bomfim
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.