Merge remote-tracking branch 'upstream/master'

services/src/main/java/org/keycloak/services/resources/AccountService.java

@@ -164,6 +164,15 @@ public class AccountService {
         return accessCodeEntry;
     }
 
+    @Path("totp-remove")
+    @GET
+    public Response processTotpRemove() {
+        UserModel user = getUserFromAuthManager();
+        user.setTotp(false);
+        return Flows.forms(realm, request, uriInfo).setError("successTotpRemoved").setErrorType(FormFlows.ErrorType.SUCCESS)
+                .setUser(user).forwardToTotp();
+    }
+
     @Path("totp")
     @POST
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
@@ -206,7 +215,8 @@ public class AccountService {
         if (accessCodeEntry != null) {
             return redirectOauth(user, accessCodeEntry);
         } else {
-            return Flows.forms(realm, request, uriInfo).setUser(user).forwardToTotp();
+            return Flows.forms(realm, request, uriInfo).setError("successTotp").setErrorType(FormFlows.ErrorType.SUCCESS)
+                    .setUser(user).forwardToTotp();
         }
     }
 

services/src/main/java/org/keycloak/services/resources/TokenService.java

@@ -192,6 +192,11 @@ public class TokenService {
         String username = formData.getFirst("username");
         UserModel user = realm.getUser(username);
 
+        if (user == null){
+            return Flows.forms(realm, request, uriInfo).setError(Messages.INVALID_USER).setFormData(formData)
+                    .forwardToLogin();
+        }
+
         isTotpConfigurationRequired(user);
         isEmailVerificationRequired(user);
 

services/src/main/java/org/keycloak/services/resources/flows/Urls.java

@@ -55,6 +55,10 @@ public class Urls {
         return accountBase(baseUri).path(AccountService.class, "totpPage").build(realmId);
     }
 
+    public static URI accountTotpRemove(URI baseUri, String realmId) {
+        return accountBase(baseUri).path(AccountService.class, "processTotpRemove").build(realmId);
+    }
+
     public static URI accountEmailVerification(URI baseUri, String realmId) {
         return accountBase(baseUri).path(AccountService.class, "emailVerification").build(realmId);
     }