ubccr / mokey

FreeIPA self-service account management portal
BSD 3-Clause "New" or "Revised" License
189 stars 45 forks source link

Send email for OTP configuration with password? Similar to setup account #54

Closed mzaranbnl closed 1 year ago

mzaranbnl commented 4 years ago

I have been having trouble with getting handler.go to require email token but still ask for password. Is it possible to configure the "enable_user_signup" to require password with an email instead of bypassing it?

I know it doesn't make sense as-is but the idea was to disable user validation and send an email for OTP configuration. Pretty much configure Mokey to allow OTP configuration for a limited amount of time only by email / token.

Thanks in advance.

aebruno commented 4 years ago

@mzaranbnl can you describe your use case a bit more? Sounds like you want to enable user signup but have users enabled by default so they don't have to verify their email? This should be possible by setting this config option:

require_verify_email: false

However, this will not send the user an verification email. Do you still want this sent?

mzaranbnl commented 4 years ago

What I want to do is send a verification email to set an OTP token. But when you click on the URL in the email I wanted to see if you can still require password login and not bypass it.

The general idea is to only allow login if you have an email sent to you. This would give an option to have a window to set the OTP token but not allow direct login otherwise.

Thanks for the quick response.

*I failed on getting handler.go to work properly. I was thinking maybe make it only allow login if an email is sent? Just an idea. Thanks again.