"Change password" is offered to identity-provider accounts, with copy about a local account they don't have #658

New issue

Closed

opened 2026-09-23 02:39:20 +00:00 by Cordy · 0 comments

Cordy commented

2026-09-23 02:39:20 +00:00

Owner

Found in the #656 QA pass (v0.6.247, both dogfoods).

Matrix row: §1 Sign-in / style guide, Voice ("hints explain consequences plainly").

Steps

Signed in as nikola-test, an OIDC (Keycloak) account, on files.c0rdyceps.ch and files-bao.c0rdyceps.ch.
Avatar menu → App passwords. It says: "Your account signs in through your identity provider, so those clients each need a dedicated password."
Close. Avatar menu → Change password.

Expected: an IdP-backed account either has no Change password entry, or the entry points to the IdP's account console. The menu shouldn't offer a local-password form to an account that has no local password.

Seen: a full local form (Current / New (at least 10 characters) / Repeat), captioned "Changes the password of your local Cairn account." Two adjacent menu items now contradict each other about how this account signs in. A user who types their Keycloak password here will get an error, or worse, will believe they changed it.

Reproduced on both hosts. Not submitted: password entry is manual (M) per the matrix.

Screenshot: 658-change-password-idp.jpg (outputs folder)

Found in the #656 QA pass (v0.6.247, both dogfoods). **Matrix row:** §1 Sign-in / style guide, Voice ("hints explain consequences plainly"). **Steps** 1. Signed in as `nikola-test`, an OIDC (Keycloak) account, on files.c0rdyceps.ch and files-bao.c0rdyceps.ch. 2. Avatar menu → **App passwords**. It says: *"Your account signs in through your identity provider, so those clients each need a dedicated password."* 3. Close. Avatar menu → **Change password**. **Expected:** an IdP-backed account either has no Change password entry, or the entry points to the IdP's account console. The menu shouldn't offer a local-password form to an account that has no local password. **Seen:** a full local form (Current / New (at least 10 characters) / Repeat), captioned *"Changes the password of your local Cairn account."* Two adjacent menu items now contradict each other about how this account signs in. A user who types their Keycloak password here will get an error, or worse, will believe they changed it. Reproduced on both hosts. Not submitted: password entry is manual (M) per the matrix. **Screenshot:** `658-change-password-idp.jpg` (outputs folder)