mahara-contributors team mailing list archive

[Aaron Wells <1546769@xxxxxxxxxxxxxxxxxx>]

Here's a brief discussion of why we decided to get rid of the "None"
plugin. The "None" plugin is a kind of null auth plugin. When you type
in a username, and any password, the "None" plugin will say that you
have successfully authenticated that username. If you set it to auto-
create users, it will the auto-provision a user with that username and
the last name "McAuthentication".

The code and documentation indicate that this plugin is "meant only for
testing". However, in the years we've worked on Mahara, we've never
actually used it for testing. Instead, we tend to use the "Internal"
auth method for most testing users. Potentially the plugin could be
useful for testing code that relates to the auto-provisioning of users.
But that would only be useful for Mahara developers, *not* for actual
production sites using Mahara. As such, that makes this plugin at best a
development tool, and potentially harmful development tools shouldn't be
left hanging around in the final distribution for end-users to stumble
across.

** Summary changed:

- The 'None' auth needs to be locked down more to avoid troubles with multi institutions
+ The 'None' auth needs to be locked down or removed to avoid troubles with multi institutions

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1546769

Title:
  The 'None' auth needs to be locked down or removed to avoid troubles
  with multi institutions

Status in Mahara:
  In Progress

Bug description:
  When there are multiple institutions/tenants on a mahara and one of
  the tenants decides to add the 'None' auth method to their institution
  it causes havoc for users on all institutions as if they accidentally
  enter their login details wrong they get logged in to institution with
  'None' set as a new user rather than their normal institution/account.

  Things that need to be changed to avoid this problem:

  1) When an institution tries to add the 'None' auth option it needs to
  check to see if there are any other institutions present and only
  allow it if institution count = 1

  2) Conversely if the only institution uses 'None' auth then you
  shouldn't be allowed to add a new institution until that auth is
  removed

  3) And when you are able to add "None" you should probably get some
  prominent message with "Do you really want to do this? You know, it
  means that anybody will be able to log in without any authorization"

  Also as part of this change it would be very good to add a ctime (and
  maybe userid) field to the auth_instance table to record when one
  adds/edits auth details to see when things changed as this human error
  can cause big problems for users.

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1546769/+subscriptions