Discovery - Identity provider research

[ericdrosas87]

Discovery work to find answers to broad questions:

• Can Craft users be migrated over from one CMS to another?
• Where are User fields stored in the database?
• Confirm function of security key
• What is the CIC module doing with the JWTs? What's needed to ensure that the JWT expiry date is updated with each request?
• Is jamesedmonston amenable adding the delete-user-without-password confirmation to the Craft v4.x version of the plugin?

[ericdrosas87]

Is jamesedmonston amenable adding the delete-user-without-password confirmation to the Craft v4.x version of the plugin?

https://github.com/jamesedmonston/graphql-authentication/issues/153

[ericdrosas87]

Can Craft users be migrated over from one CMS to another?

Yes, it seems that simply copying over the user data to the Investigations database will allow for auth without reactivation/password resets

Confirm function of security key

The security key does not factor into the password hash

[ericdrosas87]

Where are User fields stored in the database?

In the following tables:

• Column in content table - where all custom fields go, and where user custom field data is stored
• Row in fields table - where the field data is stored (description, handle, name)
• Row in projectconfig table - for creating the project config files

When a user is created, an element record is also created. It is this element record that uses the PK elementId to associate a user to field data in the content table in a column specific to the user custom field. The column name in the content table has what Craft refers to as a "column suffix" appended to the column name, this "column suffix" is also stored in the fields table and this is how Craft associates custom user field data with a user. The fields table associates the custom user field to a fieldgroup specific to users.

In order to prevent requiring users to repopulate these custom user fields I'll need to manually export the data for the above tables and insert it into the Investigations database.

[ericdrosas87]

What is the CIC module doing with the JWTs? What's needed to ensure that the JWT expiry date is updated with each request?

The UserRegistraiton module that CIC doesn't do anything with JWTs or authentication.