2

My website allows medical professionals to sign up for an account. After they sign up and provide basic information about their credentials and their practice, we tell them that we need to manually verify their credentials before their account is activated.

My question is: What do I tell the user if he or she tries to log in before we've enabled the account?

My inclination is to politely tell the user that their account has not yet been enabled after they've successfully logged in (via username + password + MFA).

Is there a security problem with this scenario? It seems to me that this is no different than most MFA implementations, which ask for the additional factor after the user has successfully entered a valid username/password combination. In both cases, the user knows that the username/password combination worked because the "next thing" happened.

Improve this question

1 Answer 1

Reset to default
2

Yes if they have authenticated then letting them know the account is disabled at the moment is appropriate. I like to add a link to resend the email verification as a convenience to the user, if you are using email verification in your provisioning.

Improve this answer
3
  • It sounds like they are doing some manual verification, not email verification. But otherwise, I agree.
    – hft
    Commented Mar 11, 2022 at 3:57
  • 1
    Thanks good point. I clarified my answer.
    – Rodrigo Murillo
    Commented Mar 11, 2022 at 4:01
  • 1
    Part of the reason I asked this question is because of the way Microsoft's ASP.Net template works. If the account is locked for some reason, the template just denies the login with a generic message rather than telling the user why the account is locked (e.g. lack of payment, violation of Terms of Service, not yet enabled, etc.)
    – Bob.at.Indigo.Health
    Commented Mar 12, 2022 at 0:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .