Suggestion: when adding new users, unless it is overwritten, generate and assign a strong 16 (or more) character random password

[Wikinaut]

Suggestion: when adding new users assign a strong 16 (or more) character random password which can be overwritten by admin when creating the user account.

[Niduroki]

@raghunayyar

[DeepDiver1975]

@Wikinaut How will that generated password be transmitted to the user - displayed to the admin?

[Wikinaut]

How will that generated password be transmitted to the user - displayed to the admin?

Yes, like in MediaWiki:

when you have the permission to create accounts (e.g. as an admin), you de-facto trigger what I call "passwort reset sequence" for the new user: (it's not a "reset". Read "create", but has the some function.)

In other words: during account creation in ownCloud

• create a random password
• send the new user mail with this passord (it's a token and has only a short lifetime of a few days)
• to their e-mail address => of course, store this e-mail address with the new account. This is currently not possible, when an admin creates a new account. (filed as Suggestion: when adding new users allow admins also to set up an e-mail address for the new user #4310 (comment) ).

In MediaWiki, as Admin you have a checkbox so that you can see the generated token (= initial password for the new user).

In short: look, what MediaWiki is doing.

[Wikinaut]

The default action should be that when a new account is created by ownCloud admin, a cryptographically strong random password is generated and sent to the new account owner. Then - after an account e-mail confirmation cycle - the user is allowed to add further personal data (not earlier!).

[DeepDiver1975]

@MTRichards something for the road map?

[MTRichards]

Yes! As long as somehow notifies the user of the password. :)

[Wikinaut]

MTRichards wrote

Yes! As long as somehow notifies the user of the password. :)

OC can send the mail. It is the same code as for "I forgot my password". Check MediaWiki, where we have implemented all these things in a safe and secure and code-reviewed and security-audited way. No way to re-invent the wheel.

My message: copy what MediaWiki already has built-in and proved to be working.

[DeepDiver1975]

My message: copy what MediaWiki already has built-in and proved to be working.

If it's that easy: pull requests are always welcome 😉

[tflidd]

I didn't find this post in the first place that's why I created a new request: #17398