Prevent discovery of CAS users via enumeration

Problem/Motivation

Background: https://www.owasp.org/index.php/Testing_for_User_Enumeration_and_Guessab...(OWASP-AT-002)

First, there are two core issues that are trying to fix "user enumeration issue:

• #2828724: Username enumeration via one time login route →
• #1521996: Password reset form reveals whether an email or username is in use →

But CAS is going beyond that: Having some hints, about user names or/and emails, an attacker is able to determine which of them are CAS users by using the /user/password form.

Proposed resolution

Don't output information about whether a user is CAS user or not. Fallback to the core behavior but fail silently on any password reset action when restrict_password_management is TRUE and the user is a CAS user.

Remaining tasks

TBD

User interface changes

TBD

API changes

None.

Data model changes

None.

Release notes snippet

N/A