Limit lost customer password reset to existing users

[pimzand]

The lost password reset feature can be used by any customer, even by customers who have never had a valid password.
I would prefer to only allow those customers on the portal that have been invited.

Can I do that without disabling the password reset function, and without invalidating the customer?

Thanks,
Pim

[crythias]

How do you propose to prevent password recovery a) before login and b) for users who don't exist?

[pimzand]

Hmm, "existing users" might indeed be confusing.

I was meaning to say, limit the password reset function to customers that have a non-NULL password in the customer user backend database.

Pim

[crythias]

Don't allow password reset (turn it off in config).