Basic http preauthentication #360
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $user = $this->userManager->createUser(); | ||
| /* @var PackagistUser $user */ | ||
| $user->setUsername($userName); | ||
| $user->setPlainPassword($user->getUsername()); |
There was a problem hiding this comment.
If the http authentication is enabled, the password is only used when you want to change your email address.
Can you suggest an alternative solution?
I was thinking about putting condictions on the code to not display the password field on the edit profile page, and into the validator in the controller, since in the http authentication usecase password has no meaning.
There was a problem hiding this comment.
|
@stof still no thoughts on this? |
|
Closing as I'd rather have people use https://toranproxy.com than private packagist since the latter will evolve without care for non-packagist.org users of the code. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Provides an optional basic http authentication.
It can be used to host private packagist service behind any kind of http authentication (htpasswd, apache with mod_ldap, etc).
This modification solves #265 without having bigger modifications on the current running instances.
The two new options are preauthenticated_provider.enabled and preauthenticated_provider.default_email_domain.
With the enabled flag you can enable http authentication listener and user provider. If you leave it false, no further modifications required.
If enabled, the userprovider is being put behind a userproviderproxy object, which proxies all the method calls to the userprovider instance, but when no user is found, it creates one.
The default_email_domain is used to create an email address for the new user as email is not nullable.