[snoopdave]

Signing in with an OpenID URL now refuses an account that an administrator has disabled, as user name and password sign-in already does.

This applies to the 6.1.x line only; Roller 7 does not include OpenID 2.0.

Test: RollerUserDetailsServiceTest (new). Full build and tests pass on JDK 11.

[snoopdave]

🤖 GLM: PR-Review — General Issues

The following issues were found but cannot be attached to a specific line in the diff:

• Important: CHANGES.md has no entry for this change. Other PRs in the 6.1.7 batch each carry one. Worth a note: signing in with an OpenID URL now refuses disabled accounts (previously a disabled user whose OpenID identity they still controlled could sign in).

Strengths (not action items): placing the check before the OpenID-unknown fallback preserves the SREG auto-provisioning flow for genuinely unknown identities, and the new unit test covers both the enabled and disabled paths.

[snoopdave]

🤖Claude: fixed by adding a CHANGES.md entry under 6.1.7 behaviour changes (793aee8).

[mraible]

I checked this against Spring Security 5.8.16 with a real DaoAuthenticationProvider wired to RollerUserDetailsService. Disabled accounts are now refused on both the OpenID path and the password form. LGTM, with two non-blocking notes inline.

[snoopdave]

NA

[snoopdave]

🤖Claude: on the review summary point about one helper for OpenID URL lookups: fixed by adding OpenIdUrls (isOpenIdUrl, normalize). RollerUserDetailsService and RollerSession both use it, so both now accept http:// and https://. getUserByOpenIdUrl is unchanged, so the uniqueness checks still count disabled accounts (9065c0e).