Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not allow Raven users to 'request a new password' #44

Open
JKingsnorth opened this issue Apr 1, 2015 · 1 comment
Open

Do not allow Raven users to 'request a new password' #44

JKingsnorth opened this issue Apr 1, 2015 · 1 comment

Comments

@JKingsnorth
Copy link
Contributor

Currently, on sites that support both Raven and Drupal authentication, Raven users can 'request a new password' - which sends them a one-time login link.

Steps to recreate:
On a site that has Drupal and Raven auth enabled
Check that you have a 'Raven' account on the site
Go to /user
Click on 'request a new password'
Enter your CRSid, continue
A one-time login link is sent to the email address of the account
However the user cannot change their password on their profile, this is already blocked by the Raven module (desired behaviour!).

Preferred behaviour:
When a Raven user requests a new password:
A one-time-login link should not be sent.
The user is redirected to /user.
A message is displayed: "You cannot reset your Raven password here, see the [Raven webpages] for more information about resetting your password."

I can have a go at putting together a patch for this, but it's not top priority for us at the moment =] Are there any drawbacks to doing this?

@thewilkybarkid
Copy link
Contributor

Don't think so, unless Raven isn't enforced (as they could log in both ways).

This is similar to #16. There's also a slight issue with the emails that Drupal can generate, as they should be different.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants