Locked users are still able to log in

[saadkadhi]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Ubuntu
OS version (client)	OS X Sierra
TheHive version / git hash	2.9.1
Package Type	Binary
Browser type & version	Chrome 55, Safari 10

Problem Description

When a user is locked by an administrator, they can still authenticate, create cases and tasks and update worklogs.

Steps to Reproduce

1. Log in as an admininstrator
2. Click on Admin > Users
3. Create a user (with read and write rights for ex.)
4. Log out
5. Log in as the freshly created user
6. Do stuff
7. Log out
8. Log in again as an administrator
9. Click on Admin > Users
10. Lock the account of the freshly created user by clicking on the Lock icon
11. Log out
12. Log in as the locked user. That must not work but it does.

Possible Solutions

Make sure that a locked account cannot log in and that the error message when an attempt is made indicates that the account has been disabled/locked and that they must contact an administrator if they feel this is a mistake.