Repository: cloudfoundry/cli

Issue #1112: Support forced password expiry
Created: 2017-04-05T07:30:21Z
Command
cf login after a user's password has been forced to expire in UAA: https://docs.cloudfoundry.org/api/uaa/#force-user-password-to-expire
I suspect the same happens when a user's password has an expiry time set, but I haven't tested that because we don't use the functionality.
What occurred
I was told that my credentials were incorrect and prompted to try again:
Authenticating...
Credentials were rejected, please try again.

Password>

What you expected to occur
The CLI should parse the error_description from the body, tell me that my password has expired, and prompt me to set a new password.
It seems that this may not be supported by UAA yet: cloudfoundry/uaa#584
CLI Version
cf version 6.25.0+787326d95.2017-02-28
CC API Endpoint Version
API version:    2.75.0
CF Trace
Authenticating...

REQUEST: [2017-04-04T17:17:36+01:00]
POST /oauth/token HTTP/1.1
Host: REDACTED
Accept: application/json
Authorization: [PRIVATE DATA HIDDEN]
Connection: close
Content-Type: application/x-www-form-urlencoded
User-Agent: go-cli 6.25.0+787326d95.2017-02-28 / darwin

grant_type=password&password=[PRIVATE DATA HIDDEN]&scope=&username=REDACTED

RESPONSE: [2017-04-04T17:17:36+01:00]
HTTP/1.1 401 Unauthorized
Connection: close
Transfer-Encoding: chunked
Cache-Control: no-store
Content-Type: application/json;charset=UTF-8
Date: Tue, 04 Apr 2017 16:17:36 GMT
Pragma: no-cache
Server: Apache-Coyote/1.1
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Www-Authenticate: Basic realm="UAA/client", error="unauthorized", error_description="User password needs to be changed"
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block

50
{"error":"unauthorized","error_description":"User password needs to be changed"}
0


Credentials were rejected, please try again.

Password>

Platform & Shell Details
N/A
Any other relevant information
N/A

Duplicate issue #1453: rejected cf login should display UAA error_description 
Created: 2018-09-04T08:37:20Z
Describe the bug and the command you saw an issue with
Cf login following a password rotation, does not display UAA error_description, preventing users from distinguishing between invalid login/pwd case and locked account case.
What happened
Given UAA locked the account following multiple failed logins (from a CI/CD job whose login/pwd were stalled)
When cf login
Then no root cause error message is displayed:
$ cf login
API endpoint: https://api.mydomain.com
Username> my-user
Password> 
Authenticating...
Credentials were rejected, please try again.
Password> 

Expected behavior
$ cf login
API endpoint: https://api.mydomain.com
Username> my-user
Password> 
Authenticating...
Credentials were rejected with message "Your account has been locked because of too many failed attempts to login", please try again.
Password> 

Invalid login/password should display uaa error description, resulting in Credentials were rejected with message "Bad credentials", please try again.
To Reproduce

lock a uaa account by triggering multiple failed login and trigger the uaa lockout policy
try to login with a valid password
check whether the login message properly displays uaa root cause message

Provide more context

version of the CLI you are running: 6.38.0+7ddf0aadd.2018-08-07 Linux

Sample UAA API response obtained with CF_TRACE=true cf login:
POST /oauth/token HTTP/1.1
RESPONSE: [2018-09-04T08:09:47Z]
HTTP/1.1 401 Unauthorized
[...]
Www-Authenticate: Basic realm="UAA/client", error="unauthorized", error_description="Your account has been locked because of too many failed attempts to login."
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Vcap-Request-Id: 48adca24-6918-490d-62fa-4df41913d08b
X-Xss-Protection: 1; mode=block

{"error":"unauthorized","error_description":"Your account has been locked because of too many failed attempts to login."}
Credentials were rejected, please try again.

Closing comment (2018-09-05T22:48:27Z): Hi @gberche-orange thank you for creating this issue. I'm closing this issue as a duplicate of #1112. Please follow that issue instead, thanks again.