Changes between Version 23 and Version 24 of AccountManagerPlugin/Modules


Ignore:
Timestamp:
Sep 6, 2016, 6:03:28 AM (8 years ago)
Author:
figaro
Comment:

Further cosmetic changes

Legend:

Unmodified
Added
Removed
Modified

  • AccountManagerPlugin/Modules

    v23 v24  
    1717There's even some information on how to get not-yet-implemented [wiki:AccountManagerPlugin/AuthStores#LDAP LDAP authentication].
    1818
    19 ----
    20 
    21 == !AccountManagerAdminPanel ^note1^
     19== !AccountManagerAdminPanel
    2220
    2321 '''Package''':: acct_mgr.admin
    2422
    2523This component adds a whole new section with a couple of pages to the trac:WebAdmin section for managing user accounts:
    26  * admin/accounts/config - basic configuration, such as !AuthStore activation and ordering
    27  * admin/accounts/notification - !AccountManager change notification settings
    28  * admin/accounts/users - user account listing with some management functions:
     24 * admin/accounts/config: basic configuration, such as !AuthStore activation and ordering
     25 * admin/accounts/notification: !AccountManager change notification settings
     26 * admin/accounts/users: user account listing with some management functions:
    2927  * add/delete accounts
    3028  * change password and other account attributes
    3129  * reset password similar to the 'lost password', but triggered by admin (since acct_mgr-0.3)
    3230  * review account details (since acct_mgr-0.3)
    33   * review and erase entries of Trac database table `session_attribute` (since acct_mgr-0.4) ^note2^
     31  * review and erase entries of Trac database table `session_attribute` (since acct_mgr-0.4)
    3432
    35 '''^note1^''' In version acct_mgr-0.3, module name was !AccountManagerAdminPage. If you are upgrading to acct_mgr-0.4 from an earlier version, and this feature was enabled using `acct_mgr.admin.AccountManagerAdminPage`, this feature will now be disabled until it is enabled using `acct_mgr.admin.AccountManagerAdminPanel`.[[BR]]
    36 '''^note2^''' Requires `ACCTMGR_ADMIN` or `TRAC_ADMIN`, but ''handle with care'' anyway - no problem to shoot yourself in the foot by deleting your own `SessionStore` admin password. So double-check, and especially have a current, working Trac database backup before starting cleanup here.
     33'''Notes'''
     34 * In version acct_mgr-0.3, the module name was !AccountManagerAdminPage. If you are upgrading to acct_mgr-0.4 from an earlier version, and this feature was enabled using `acct_mgr.admin.AccountManagerAdminPage`, this feature will now be disabled until it is enabled using `acct_mgr.admin.AccountManagerAdminPanel`.
     35 * Deleting entries from the `session_attribute` table requires `ACCTMGR_ADMIN` or `TRAC_ADMIN` permissions, but ''handle with care'' anyway: it is easy to delete your own `SessionStore` admin password. So double-check, and especially have a current, working Trac database backup before starting cleanup here.
    3736
    38 [[Image(AccountManagerPlugin:account-manager-admin_v0.4.png)]]
     37[[Image(AccountManagerPlugin:account-manager-admin_v0.4.png, border=2)]]
    3938
    4039Older versions required the `TRAC_ADMIN` permission to access any of the admin pages, but a more granular set of permissions has been introduced since acct_mgr-0.3 (see changeset [9280]):
    … …  
    5655Requires Trac >= 0.10
    5756
    58 ----
    59 
    6057== !AccountModule
    6158
    … …  
    6461Allows users to change their password, or delete their account. When logged in it will appear as a tab "Account" after clicking the "Preferences" link.
    6562
    66 [[Image(AccountManagerPlugin:my-account.png)]]
     63[[Image(AccountManagerPlugin:my-account.png, border=2)]]
    6764
    6865=== Configuration
    … …  
    7370}}}
    7471
    75 You'll need to activate at least one of the [wiki:AccountManagerPlugin/AuthStores authentication resources] bundled with !AccountManagerPlugin. From a programmers view these are all IPasswordStore implementations. An error telling you "This password store does not support listing users" indicates that you didn't successfully activate/configure any authentication credential provider yet. Easiest way to do that is using the web-UI. Just go to admin/accounts/config and select a value different from setting "--" at least for one of the authentication resources listed there.
     72You'll need to activate at least one of the [wiki:AccountManagerPlugin/AuthStores authentication resources] bundled with !AccountManagerPlugin. From a programmers view these are all IPasswordStore implementations. An error telling you "This password store does not support listing users" indicates that you didn't successfully activate/configure any authentication credential provider yet. The easiest way to do that is using the web-UI. Just go to admin/accounts/config and select a value different from setting "--" at least for one of the authentication resources listed there.
    7673
    7774==== Disabling account deletion
    7875
    79 If you want your users to be able to change their password in Trac user preferences (see 'Account' tab of 'Preferences' from the meta navigation bar), but don't want them to be able to delete their account, you should configure as follows in `trac.ini` (since acct_mgr-0.3):
     76If you want your users to be able to change their password in Trac user preferences (see 'Account' tab of 'Preferences' from the meta navigation bar), but don't want them to be able to delete their account, you should configure that as follows in `trac.ini` (since acct_mgr-0.3):
    8077
    8178{{{#!ini
    … …  
    9390=== Lost password procedure
    9491
    95 A user-triggered password reset is less intrusive starting with acct_mgr-0.3, ''not altering the current password before a successful login'' using it. Resetting your password you actually end up with two passwords before next valid login:
     92A user-triggered password reset is less intrusive starting with acct_mgr-0.3, ''not altering the current password before a successful login'' using it. Resetting your password you actually end up with two passwords before the next valid login:
    9693 * Login with the new one from !ResetPwStore to silently and finally overwrite the old with the new.
    97  * Login with the old will just chancel the latest lost/new password request.
     94 * Login with the old one will just chancel the latest lost/new password request.
    9895
    9996Or in other words: The temporary password is stored in !ResetPwStore, a special !SessionStore (sharing configuration with any other !SessionStore) and merely checked as a fallback, if the regular authentication has failed. On authentication success with the old password any temporary password is deleted to prevent abuse of the 'lost password' procedure by others.
    10097
    101 [[Image(AccountManagerPlugin:reset-password.png)]]
     98[[Image(AccountManagerPlugin:reset-password.png, border=2)]]
    10299
    103100==== Disabling password reset
    … …  
    117114}}}
    118115
    119 ----
    120 
    121116== !LoginModule
    122117
    … …  
    125120Allows users to login via a HTML form instead of using HTTP authentication.
    126121
    127 [[Image(AccountManagerPlugin:login-form.png)]]
     122[[Image(AccountManagerPlugin:login-form.png, border=2)]]
    128123
    129124The template has been modified for acct_mgr-0.3 to allow for better [attachment:login-form_v0.3_custom.png custom CSS styling]. See `style.css` in the [source:accountmanagerplugin/0.11/contrib contrib] directory for a jump-start.
    … …  
    131126=== Configuration
    132127
    133 To use the AccountManager’s HTML form, you need to explicitly disable Trac's own HTTP authentication module. To do so add this your trac.ini or find and modify existing lines accordingly:
     128To use the AccountManager's HTML form, you need to explicitly disable Trac's own HTTP authentication module. To do so add this your `trac.ini` file or find and modify these existing lines accordingly:
    134129
    135130{{{#!ini
    … …  
    151146}}}
    152147
    153 Deleting or commenting the `Require valid-user` line should be sufficient to disable HTTP authentication. After you’ve tested it, you can probably delete or comment out the rest of the authentication options. In some pre-bundled packages as Bitnami Trac you will find it inside an apache configuration extension as trac.conf (!BitnamiTrac\trac\conf\trac.conf)
     148Deleting or commenting the `Require valid-user` line should be sufficient to disable HTTP authentication. After you've tested it, you can probably delete or comment out the rest of the authentication options. In some pre-bundled packages as Bitnami Trac you will find it inside an Apache configuration extension as trac.conf (!BitnamiTrac\trac\conf\trac.conf)
    154149
    155150=== Compatibility
    … …  
    157152requires Trac >= 0.10
    158153 To use this module with [trac:TracStandalone tracd] stand-alone server you'll need Trac 0.10 or later version, or an external webserver such as Apache.
    159 
    160 ----
    161154
    162155== !AccountGuard
    … …  
    167160Enabling the guard means, that even legitimate login attempts will get rejected as long as account lock conditions are met. So an account is not reachable for the user while under attack. An admin could still log in (to a different account), check the source(s) of the malicious login attempts and stop them by other means to help the user restore access to his/her account.
    168161
    169 See some example configurations it the [wiki:CookBook/AccountManagerPluginConfiguration#AccountLocking cookbook page] and look at screenshot series below to get an idea, how this looks like and is meant to work.
     162See some example configurations in the [wiki:CookBook/AccountManagerPluginConfiguration#AccountLocking cookbook page] and look at the screenshot series below to get an idea how this is meant to work.
    170163
    171164'''Hitting account soft (temporary) lock condition on login failure'''
    172165
    173 [[Image(acct_mgr_with_acct-guard_login-failure_v0.3.png)]]
     166[[Image(acct_mgr_with_acct-guard_login-failure_v0.3.png, border=2)]]
    174167
    175168'''Account details page showing failed login attempts and other details'''
    176169
    177 [[Image(acct_mgr-admin_acct-details_v0.3.png)]]
     170[[Image(acct_mgr-admin_acct-details_v0.3.png, border=2)]]
    178171
    179172'''Display of total failed login attempts since last successful login'''
    180173
    181 [[Image(acct_mgr_with_acct-guard_login-success_v0.3.png)]]
     174[[Image(acct_mgr_with_acct-guard_login-success_v0.3.png, border=2)]]
    182175
    183176----