webservice and password recovery

I my development, I need to have a password recovery page on my website, rather than redirecting the user to FD's own password recovery page.

I would be good If we could use FD's recovery/reset password feature through the webservice, what do you think ?

Cheers,

(from redmine: issue id 4822, created on 2016-05-30, closed on 2017-01-11)

• Relations:
  • relates #5317
• Changesets:
  • Revision 42209e5c by Côme Chilliet on 2017-01-10T14:57:14.000Z:

Fixes #4822 Adding recovery support to webservice

• Revision 3990a0b1 by Côme Chilliet on 2017-01-10T14:58:00.000Z:

Fixes #4822 Adding recovery support to webservice

• Revision 0e0a2dc0 by Côme Chilliet on 2017-01-10T15:58:07.000Z:

Fixes #4822 Added ACL check for recovery from webservice

• Revision 5c9d81b4 by Côme Chilliet on 2017-01-10T15:59:02.000Z:

Fixes #4822 Added ACL check for recovery from webservice

• Revision 8a10a442 by Côme Chilliet on 2017-01-11T09:08:04.000Z:

Fixes #4822 Building password recovery in non-interactive mode for webservice

• Revision 27f52fdc by Côme Chilliet on 2017-01-11T09:08:46.000Z:

Fixes #4822 Building password recovery in non-interactive mode for webservice

• Revision b291c75f by Côme Chilliet on 2017-01-11T10:23:17.000Z:

Fixes #4822 Added recovery methods to webservice doxygen

• Revision 608ab190 by Côme Chilliet on 2017-01-11T10:24:00.000Z:

Fixes #4822 Added recovery methods to webservice doxygen

• Custom Fields:
  • Bug in version: 1.0.13

Why can’t you use FD’s password recovery page? You can change what it looks like if needed through the theme.

Regarding using the recovery through the webservice, could you provide an API example?

(from redmine: written on 2016-06-21)

Côme BERNIGAUD wrote:

Why can’t you use FD’s password recovery page? You can change what it looks like if needed through the theme.

Right, the most obvious reason is I don't want the user - by visiting FD's subdomain that hosts the recovery page - to get off the track of the initial website. Maybe with some kind of redirection whenever the password is changed successfully.

Indeed, in the end we might have to change the theme with links to the original website.

What I want to avoid is to force the user to click too much links, then get "lost".

Regarding using the recovery through the webservice, could you provide an API example?

I'll think about it.

Cheers

(from redmine: written on 2016-06-21)

hello,

have you thought about this ? do you have an api exemple in mind

Cheers

(from redmine: written on 2016-09-01)

I have in mind is the following example:

Let's assume I have a reset password form on my own website, asking for an email. The field could be passed to FD's webservice as: @$token = $client->resetpassword($email);@

At this point we can send a mail on our own, with a link to a password1/password2 form on the website (not FD) that includes the token/key as parameter.

Then simply call FD's webservice again as a second step:

@$result = $client->confirmpassword($password1, $password2, $token);@

The main idea here is to avoid FD's webservice users to write their own token routine (like we did) when they want to implement a lost password function in any website.

(from redmine: written on 2016-09-02)

hello,

yes i agree this should be fixed somehow to have the webservice cover all FusionDirectory functionalities for now. i have put it back to 1.1

Cheers

(from redmine: written on 2016-09-06)

Pushed a first draft, can you try it? The two added methods are: recoveryGenToken($email) -> finds a user and store a token for it, returns token and uid (or errors) recoveryConfirmPasswordChange($uid, $password1, $password2, $token) -> change the passwords and returns TRUE (or errors)

(from redmine: written on 2017-01-10)

Close issue

(from redmine: written on 2017-01-11)

closed

added Added label

mentioned in issue #5955 (closed)

marked this issue as related to #5955 (closed)