title: Keycloak: Login Disabled User Gives HTTP 400 (Bad Request)
body: <p>I'm using version 3.4.3 of Keycloak. When I deactivate a user using <code>PUT</code> and setting the <code>enabled</code> flag to false, he cannot login anymore. This is exactly what I want. However, instead of a HTTP status code 403 (Access denied) or 401 (Unauthorized) that I'd expect to get from a login attempt of a deactivated user, I get a 400 (Bad Request) instead. When I reactivate the user, using <code>PUT</code> and setting the <code>enabled</code> flag back to <code>true</code>, he can login again.</p>
  
  <p>Here's my <code>curl</code> script:</p>
  
  <pre><code>token=`cat .file_containing_admins_token`
  curl -v -X PUT -H "Content-Type: application/json" -H "Authorization: Bearer $token" --data "{\"enabled\": false}" "http://localhost:8080/auth/admin/realms/[my-realm]/users/[user-id-to-block]"
  </code></pre>
  
  <p>The <a href="https://www.keycloak.org/docs-api/3.4/rest-api/index.html#_users_resource" rel="nofollow noreferrer">documentation</a> is rather terse on status codes.</p>
  
  <p>There's also a second, more specific API endpoint <code>PUT /{realm}/users/{id}/disable-credential-types</code>. But there I am missing to re-enable the credential, which is a requirement for my use case.</p>