Begin of the insertionTo avoid confusion, improve theEnd of the insertion Begin of the deletion **As** an OpenProjectEnd of the deletion user Begin of the insertionexperience and reduce the workload for support (only small effect) <mention class="mention" data-id="3762" data-type="user" data-text="@Robin Wagner">@Robin Wagner</mention> andEnd of the insertion Begin of the deletion
**I want to** get an error message which doesn&#39;t tell me &quot;your account is locked&quot; or &quot;you tried a wrong username/password multiple times&quot; although this is not true whenEnd of the deletion I Begin of the insertionpropose the following changes:

Current situation: Basically, there are three cases (fromEnd of the insertion Begin of the deletion enterEnd of the deletion a Begin of the insertionuser&#39;s perspective):

* user forgot his/her password
* user forgotEnd of the insertion Begin of the deletion wrong usernameEnd of the deletion or Begin of the insertionmisspelled his/herEnd of the insertion password Begin of the insertionand gets blocked temporarily
* user has been locked permanently by an adminEnd of the insertion Begin of the deletion
**so that** I don&#39;t get confused.End of the deletion

Begin of the insertionThe current situation and the &quot;process&quot; can be found in this overview, as well as the proposed solution (desired changes marked with dotted box in the lower display): 

<figure class="image op-uc-figure" style="width:75%;"><div class="op-uc-figure--content"><img class="op-uc-image" src="/api/v3/attachments/20830/content"></div></figure>



End of the insertion **Acceptance criteria**

Begin of the insertion_(&quot;Optional&quot; points can be dropped if the implementation effort would exceed the benefits)_

End of the insertion * Begin of the deletion Split error message in two cases:
* End of the deletion Change error message for Begin of the insertionwrong password and for temporary block to: 
End of the insertion Begin of the deletion failed login attempt:End of the deletion &quot;Invalid Begin of the insertionusernameEnd of the insertion Begin of the deletion user nameEnd of the deletion or Begin of the insertionpassword.
IfEnd of the insertion Begin of the deletion password entered. Please try again or use the link &#39;ForgotEnd of the deletion your Begin of the insertioncredentials are correct, your account may have been blocked due to multiple failed login attempts. If so, it will be unblocked automatically in a short time.
For questions please contact your administrator.&quot;
End of the insertion Begin of the deletion password?&#39;&quot;
End of the deletion * Begin of the insertionOptional: AddEnd of the insertion Begin of the deletion If possible,End of the deletion link Begin of the deletion text &quot;Forgot your password?&quot;End of the deletion to the password reset Begin of the insertionscreen, like so: &quot;Invalid username or password. \[Click here if you forgot your password.\] &lt;br&gt; If ...&quot;
End of the insertion Begin of the deletion screen (/account/lost\_password)
End of the deletion * Begin of the insertionOptional: ChangeEnd of the insertion Begin of the deletion AdditionalEnd of the deletion error message Begin of the insertionfor permanently locked users to:
&quot;YourEnd of the insertion Begin of the deletion when the user is blocked: &quot;UserEnd of the deletion account Begin of the insertionhas beenEnd of the insertion locked Begin of the insertionby an administrator.
For questions please contact your administrator.&quot;
* Optional: Unify behavior of the application after having entered an email address for password reset: RedirectEnd of the insertion Begin of the deletion temporarily dueEnd of the deletion to Begin of the insertionsignEnd of the insertion Begin of the deletion multiple failed login attempts. It will be unlocked automaticallyEnd of the deletion in Begin of the insertionpage also for non-existing (i.e. unknown) email addresses
* WhenEnd of the insertion a Begin of the insertionuser who has been permanently locked tries to reset his/her password send this email instead of the password reset email:
&quot;Your account has been permanently locked. For questionsEnd of the insertion Begin of the deletion short time. Alternatively,End of the deletion please contact your Begin of the insertionadministrator&quot;
* Optional: Option for administratorsEnd of the insertion Begin of the deletion adminEnd of the deletion to Begin of the insertionenter some form of contact details for contacting the admin
End of the insertion Begin of the deletion be unlocked.&quot;

**To be discussed**

End of the deletion * Begin of the insertionWhen a user who has been blocked temporarily resets his/her password he/she should be able to log in with the new password (currently user the block isEnd of the insertion Begin of the deletion Verify that these two cases doEnd of the deletion not Begin of the insertionlifted when resetting the password)



End of the insertion Begin of the deletion pose an additional security risk.

End of the deletion ### Current situation

<figure class="image op-uc-figure"><div class="op-uc-figure--content"><img class="op-uc-image" src="/api/v3/attachments/20367/content"></div></figure>