New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable creating user accounts without passwords #1459

Closed
seanh opened this Issue Jan 27, 2014 · 3 comments

Comments

Projects
None yet
2 participants
@seanh
Copy link
Contributor

seanh commented Jan 27, 2014

When users are using an IAuthenticator plugin to create and login to accounts using an external authentication service rather than CKAN's traditional username and password system, we still need to create user objects for these accounts in CKAN's database and these objects need to have randomly generated passwords even though those passwords will never be used. So it'd be good to allow creating passwordless user accounts that just can't be logged-in to via the traditional method, unless a sysadmin adds a password to the account.

Example:

ckanext-persona is an IAuthenticator extension that lets users login to CKAN using Mozilla Persona. When the user clicks the login button in CKAN they're redirected to Persona which asks them to give an email address and prove that they own it (by entering an email or Persona password, or responding to a verification email), Persona then passes on this verfication to CKAN. CKAN will find the user account that has the verified email address and log the user into it, or if no user account with that email address exists CKAN will create one and log them into it.

When creating a new user account for a Persona user one thing we need to do is generate a password for the account, simply because CKAN user accounts must have passwords. The user doesn't need this password to login - they do that via Persona. In fact, they won't be able to login using the autogenerated password because the password will never be shown to them. The password is nothing but a security vulnerability.

So it'd be nice if we could create user accounts with no passwords in CKAN, and logging into those accounts via the traditional username and password method would simply not work (they could only be logged-in to via Persona, or if a sysadmin adds a password to the account).

Creating a passwordless account could be something that only internal CKAN and extension code can do, and not via the API. Or maybe only sysadmin users could be allowed to do it via the API.

@ghost ghost assigned seanh Jan 28, 2014

@seanh

This comment has been minimized.

Copy link
Contributor

seanh commented Jan 30, 2014

We discussed this in a dev meeting and decided it would be good to enable user accounts without passwords in CKAN, that cannot be logged-in to the traditional way. I can't remember what we decided about exactly how it should be implemented - usable by internal code only? Or by the API, but sysadmin only? Or just doable by the API, if you pass an explicit option?

@seanh

This comment has been minimized.

Copy link
Contributor

seanh commented Apr 1, 2014

I'm going to close this due to lack of time, when there's a project or feature in development that needs this then it can be implemented, but I don't think it'll get done on its own

@seanh seanh closed this Apr 1, 2014

@adamamyl

This comment has been minimized.

Copy link
Member

adamamyl commented Apr 1, 2014

This will hopefully be funded in April/May (I've been wanting to add a tag/label to things to say, "going to happen/ties in with spec'd work", but can't)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment