From 8b7f11fc6ae6b5b53aa2bb9e4763b62190e2c722 Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Thu, 26 Feb 2026 12:21:30 +0000 Subject: [PATCH] docs: note disabled-account failures during WebAuthn login verification Clarify that provider WebAuthn login verification may reject disabled accounts with credential-style failures despite valid authenticator assertions. --- docs/INTEGRATION_GUIDE.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md index a448be0..5c027ee 100644 --- a/docs/INTEGRATION_GUIDE.md +++ b/docs/INTEGRATION_GUIDE.md @@ -137,6 +137,7 @@ try { `UserInfoException` with `invalid_token` can occur when provider-side subject scope is no longer active (for example user/project disabled) between token issuance and userinfo retrieval. `TokenExchangeException` with `invalid_grant` can also occur when provider-side client/user/project state is inactive at exchange time. Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion. +WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid. ## Operational guidance