inveniosoftware / invenio-oauthclient

Invenio module that provides OAuth web authorization support.
https://invenio-oauthclient.readthedocs.io
MIT License
6 stars 74 forks source link

global: auto-registration is broken #50

Closed omelkonian closed 8 years ago

omelkonian commented 8 years ago

When user is not found on the db, we automatically register them with password=None, as seen here: https://github.com/inveniosoftware/invenio-oauthclient/blob/master/invenio_oauthclient/utils.py#L92-L103

But Passlib does not allow None passwords, although it allows empty ones (''). To verify it, run:

>>> from passlib.hash import oracle10
>>> hash = oracle10.encrypt(None, user='admin')
>>> hash = oracle10.encrypt('', user='admin')

Therefore, if the user is not already registered, an internal server error will occur.