Password reset not working

So far, the password reset only works for admins of the platform.

The OIDC provider should allow non users to reset their password. Might be a bug of django-oidc-provider, or it might be a faulty configuration.

changed milestone to %Projects part I

By Alexandre on 2019-10-07T20:14:10 (imported from GitLab project)

changed the description

By Alexandre on 2019-10-07T20:14:25 (imported from GitLab project)

I can't find the form to reset the password as a regular user on SIB. The only place I know is /admin which should not be accessible to regular users. Can someone provide me the steps to reproduce the bug?

By Christophe Henry on 2019-10-14T12:34:41 (imported from GitLab project)

@christophehenry : You can access it via https://api.alpha.happy-dev.fr/accounts/login/

You can click on Lost password? here, which brings you to Django's admin. That's not what we want :-)

@balessan, @Alice-P : Have you implemented that part on CoopStarter, allowing the user to reset her password? If yes, could you point us to the relevant part in the code base ?

By Alexandre on 2019-10-14T12:34:41 (imported from GitLab project)

It is not part of the coopstarter code base, but provided directly by the djangoldp_account package, and the associated URL is of type: https://api.coopstarter.happy-dev.fr/auth/password_reset/

And I am pretty sure that it works out of the box.

I think the link is correct. For some reason it uses the admin template. I'm not sure if it's the default behavior or if you did something special. Can you check your templates?

You can also check the order in which applications are registered in the settings. The djangoldp packages should be first

@christophehenry : Keep us posted ;-)

By Alexandre on 2019-10-14T12:55:19 (imported from GitLab project)

Ok it's actually a bug of sib-manager. It appends the djangoldp packages at the end of the app list, instead of the begining.

The order seems not influencial. Here, on local, I have:

INSTALLED_APPS = [
    'djangoldp',
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'guardian',
    'django_extensions'
]

And the template is still Django's default. It does not seems like there's an existing template for password reset.

By Christophe Henry on 2019-10-15T11:48:22 (imported from GitLab project)

Yes but the other template is in DjangoLDP Accounts, right? It's missing here.

And the order does matter, see the last line of https://docs.djangoproject.com/fr/1.11/ref/settings/#std:setting-INSTALLED_APPS

Test Paris have the latest version of each packages. Resetting password seems working fine even unlogged. => https://api.test-paris.happy-dev.fr/auth/password_reset/

Also, alpha with older version works too. => https://api.alpha.happy-dev.fr/accounts/password_reset/

closed

@jbpasquier : Have you tested with an account that is not an admin?

By Alexandre on 2019-10-15T13:23:06 (imported from GitLab project)

No it doesn't work, as it's the admin template that is used.

reopened

I just did it on private browsing session with a newly created testguy account on test-paris. It works fine.

It does, but the layout is the one of the admin pages, right?

Yes & No, it's a django template. You don't need to be logged nor in debug to make it works. See on test-paris.