add ability to enable / disable consumer credentials without deleting them

[ahmadnassri]

scenario:

• I want to disable certain consumers from using certain credentials temporarily without changing their keys.

expectation:

• I can change enabled flag on a credentials object (in oauth2 or other authentication plugins)

[ahmadnassri]

cc: @lucamaraschi

[b6t]

+1 or at least the ability to delete a key. If a key is compromised there are no options to invalidate the compromised key and issue a new one. is there?

[subnetmarco]

@coreybeaumont yes, you can execute an HTTP DELETE request to that key.

[b6t]

@thefosk thanks - the structure of the url was not initially apparent to successfully delete. Anyways, active | inactive would still be a great help.

[rzschech]

I would like this too. I would do the following:

1. user signs up with email address and password
2. create consumer and basic auth credentials where username=email address, password=password and disabled=true
3. send email address verification email to user
4. user can't login with basic auth credentials
5. user clicks link in verification email
6. patch basic auth credential disabled=false

This allows me to store the password while the email address verification is in progress.

[parajanoff]

+1