We have two different but similar problems:

• Auth force password change: We are avoiding create a token via login/token.php, this was done because WS weren't usable in that case (require_login throws an exception) but right now that there is a way to do auto-login we should have a valid token to redirect the user to the site-version so he can change his password.
• User not fully setup: In this case we are returning a token but require_login throws an exception, as I previously commented in this case we should auto-login the user in Moodle and point the browser to the form where the user can add the rest of the required data.

Changes required:

• Throw proper exceptions with an exceptioncode that can be captured by the mobile app in require_login
• Remove the auth_forcepasswordchange restriction in login/token.php so the user can't get a token (as I said before, this is double checked in the require_login/validate_context so the user won't be able to do anything)
• Modify the get_autologin_key WS so the validate_context expects and handle those exceptions and the user can get a valid autologin key.

In the mobile app, when we capture one of those 2 exceptions, we'll be opening an inappbrowser pointing to the Moodle web page to change the password or add the missing required fields. Ideally, it should be handled via Web Serrvices but until is done the inappbrowser with auto-login should be enough.