This is on purpose for security reasons. So and so, the user will contact the superadmin if they want to use the app.

@tibor.pacalat: To be honest, this is VERY confusing for the users. They try resetting their PW again and again and simply fail. We should definitely consider improving this.

It is much better to give a generic "user or password is wrong" message. Specific feedback about an expired user account helps attackers find valid usernames on your system.

Why Generic Messages Are Safer

• Hides valid names: Attackers cannot tell if a username exists or not
• Stops guessing: Bad actors cannot test lists of names to see who is active
• Blocks tracking: People cannot use your form to check if a coworker or target still has an active profile

Risks of Specific "User Expired" Messages

• Gives clues: It proves the username is real and active in the system at some point
• Aids hackers: Attackers can focus only on cracking the accounts that actually exist
• Leaks data: It shares internal account status with strangers

Best Practices for Secure Logins

• Use one exact same message for wrong passwords, locked accounts, and expired users
• Add rate limits or lockouts after too many failed tries to stop automated guessing attacks
• Send an email notice to the user instead, letting them know their account expired or needs an update

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=40099

@tibor.pacalat, I could agree to you, but then we are both wrong :-)

Even as an experienced LimeSurvey expert it took me 20 minutes to find out what finally was wrong. This was also due to the fact that the "Expiry" column is not visible by default at the admin user overview.
I still think that it would be far more user friendly to show a more accurate error message and treat the security aspect with less importance.
@DenisChenu @gabrieljenik, what's your opinion on this?

@c_schmitz, thanks for adding the minor adjustment to the error message. That at least provides some more indication on what may be wrong.