Motivation
It is desired by various issues (see below) to add a central mechanism for determining whether a user's password can be reset.
This would provide the facility to (allow contrib to):
- Switch password reset on/off entirely #2356655: Provide option to disable password recovery by e-mail. (such as when an alternative login method is used
- Restrict password reset, based on rules
- Restrict password reset based on the role of the user being reset (not necessarily current user) #658132: Limit password reset per role
- Restrict password reset, based on activity of user being reset #315742: Limit password reset for recently active users
This patch does not propose implementing the above ideas.
Proposed resolution
Standardize on a password reset access operation.
When a request for a user's password reset cannot be satisfied, the error should be vague and not leak the existence of the user, aka user enumeration.
User interface changes
None
API changes
None
Data model changes
None