1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-12-03 12:12:43 +01:00
phorge-phorge/src/applications/auth
epriestley 55c18bc900 During first-time setup, create an administrator account with no authentication instead of weird, detached authentication
Summary:
Ref T6703. Currently, when you create an account on a new install, we prompt you to select a password.

You can't actually use that password unless you set up a password provider, and that password can't be associated with a provider since a password provider won't exist yet.

Instead, just don't ask for a password: create an account with a username and an email address only. Setup guidance points you toward Auth.

If you lose the session, you can send yourself an email link (if email works yet) or `bin/auth recover` it. This isn't really much different than the pre-change behavior, since you can't use the password you set anyway until you configure password auth.

This also makes fixing T9512 more important, which I'll do in a followup. I also plan to add slightly better guideposts toward Auth.

Test Plan: Hit first-time setup, created an account.

Reviewers: amckinley

Reviewed By: amckinley

Subscribers: revi

Maniphest Tasks: T6703

Differential Revision: https://secure.phabricator.com/D20111
2019-02-12 14:47:47 -08:00
..
__tests__ Prevent users from selecting excessively bad passwords based on their username or email address 2018-11-06 12:44:07 -08:00
action Add a "test message" action for contact numbers 2019-01-23 14:22:27 -08:00
application Move the Auth Provider edit flow toward a more modern layout 2019-02-05 14:19:26 -08:00
capability Auth - add "manage providers" capability 2015-01-12 14:37:58 -08:00
conduit Deactivate SSH keys instead of destroying them completely 2016-05-18 14:54:28 -07:00
constants Allow MFA providers to be deprecated or disabled 2019-01-28 09:29:27 -08:00
controller During first-time setup, create an administrator account with no authentication instead of weird, detached authentication 2019-02-12 14:47:47 -08:00
data Add session and request hooks to PhabricatorAuthSessionEngine 2016-11-17 13:09:29 -08:00
editor Bring Duo MFA upstream 2019-01-28 18:26:45 -08:00
engine Require MFA to edit MFA providers 2019-01-28 09:44:39 -08:00
engineextension Allow any transaction group to be signed with a one-shot "Sign With MFA" action 2018-12-28 00:09:30 -08:00
exception Get rid of "throwResult()" for control flow in MFA factors 2019-01-28 09:40:28 -08:00
extension Add a more modern object for storing password hashes 2018-01-22 15:35:28 -08:00
factor Autofocus form control for adding TOTP codes 2019-02-07 11:56:49 -08:00
future Replace manual query string construction with "phutil_build_http_querystring()" 2019-01-30 19:14:57 -08:00
garbagecollector Add a garbage collector for MFA challenges 2018-12-17 07:00:55 -08:00
guidance Don't show "registration might be too open" warnings unless an auth provider actually allows registration 2019-02-07 15:32:42 -08:00
mail Send forced mail on SSH key edits 2016-05-19 15:01:25 -07:00
management Update bin/auth MFA commands for the new "MFA Provider" indirection layer 2019-01-23 13:38:44 -08:00
message Add "Auth Messages" to support customizing onboarding/welcome flows 2019-01-18 19:53:19 -08:00
password Prevent users from selecting excessively bad passwords based on their username or email address 2018-11-06 12:44:07 -08:00
phid Implement SMS MFA 2019-01-23 14:17:38 -08:00
provider Replace "getQueryParams()" callsites in Phabricator 2019-02-12 06:37:03 -08:00
query Remove weird integration between Legalpad and the ExternalAccount table 2019-02-07 15:00:00 -08:00
revoker Add "bin/auth revoke --list" to explain what can be revoked 2018-01-23 14:01:39 -08:00
sshkey Send forced mail on SSH key edits 2016-05-19 15:01:25 -07:00
storage Make the default behavior of getApplicationTransactionCommentObject() "return null" instead of "throw" 2019-02-07 14:56:38 -08:00
tokentype Redesign Config Application 2016-08-29 15:49:49 -07:00
view Explicitly add rel="noreferrer" to all external links 2018-02-17 17:46:11 -08:00
worker Send emails for email invites 2015-02-11 06:06:09 -08:00
xaction Fix an issue where Duo validation could incorrectly apply to other factor types 2019-02-03 06:36:49 -08:00