Skip to content

overwriting existing discourse user email #62

Open
Open
overwriting existing discourse user email#62

Description

@frollard
frollard
opened on Sep 19, 2021

spaceport/authserver/auth_functions.py

Line 128 in 520d11c

logger.info('Email found on different user %s, changing to: %s', user['username'], new_email)

No idea if I'm doing this right...this function seems to find an existing discourse account and if email is in use it changes the existing discourse account to a random email, and assigns a new account the existing correct email; this can lock a user out of doing password resets or logins via that email. may be more common if people decide to join after becoming public forum members.

Activity

  1. tanner37 commented on Sep 19, 2021

    @tanner37
    tanner37
    on Sep 19, 2021
    Contributor

    It's required for integration. Discourse requires that each account has a unique email, so the new account will be given their portal email.

  2. frollard commented on Sep 19, 2021

    @frollard
    frollard
    on Sep 19, 2021
    ContributorAuthor

    When that situation is detected does it make sense to keep the existing account but change the discourse username to portal firstname.lastname and password to portalpassword?

  3. frollard commented on Sep 19, 2021

    @frollard
    frollard
    on Sep 19, 2021
    ContributorAuthor

    https://meta.discourse.org/t/how-does-one-change-a-username-via-the-api/96118 seems to have a change username endpoint

  4. tanner37 commented on Sep 19, 2021

    @tanner37
    tanner37
    on Sep 19, 2021
    Contributor

    --Yes! that could work and it saves us from merging the accounts later. I'll try implementing that tomorrow.--

    Edit: this creates a security hole

  5. frollard commented on Sep 19, 2021

    @frollard
    frollard
    on Sep 19, 2021
    ContributorAuthor

    Only other issue with this as the warning comment points out - portal emails are unverified and in theory a person could hijack a forum account through creating a portal account...not sure if that's a risk worth worrying about. Would be nice if it could force entry of the old password to enact the change, but I can't find any way to use the discourse api to validate the user.
    Does portal email verification make sense for this?

  6. tanner37 commented on Sep 23, 2021

    @tanner37
    tanner37
    on Sep 23, 2021
    Contributor

    Yup, that's the problem with changing the Discourse username method:

    1. I set my portal email to frollard@example.com, matching your Discourse account
    2. I do a Spaceport auth using my portal account
    3. Your Discourse account username and password are changed to mine
    4. I can log into your Discourse account

    The current method allows:

    1. I set my portal email to frollard@example.com, matching your Discourse account
    2. I do a Spaceport auth using my portal account
    3. My new Discourse account has your email. Your Discourse account email is set to something unguessable.
    4. You do a Discourse password reset on my new account.
    5. You can log into MY account. I shot myself in the foot.

    The alternative is we do email verification on the portal, but that's not practical without Mailgun and more friction for signing up. It's also a massive amount of code I don't wanna write.

  7. frollard commented on Sep 23, 2021

    @frollard
    frollard
    on Sep 23, 2021 via email
    ContributorAuthor
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions