nextcloud/server

Easy registration of new accounts

Open

#15,770 opened on May 28, 2019

View on GitHub
 (21 comments) (8 reactions) (0 assignees)PHP (34,953 stars) (4,865 forks)batch import
2. developingenhancementfeature: authenticationfeature: users and groupsgood first issue

Description

I keep having problems with new users:

  1. I add their account.
  2. They receive their activation link
  3. They don't have time to click on it in that instance
  4. The mail moves down in their inbox
  5. When they first have to use their account they remember the mail, click on the link and the token is invalid.

What works:

  1. I add their account with a password
  2. I send them username and password

Problem is: I can't force them to change the password after the first login, can I? That would be a good feature:

  1. Add new account with autogenerated one-time-Password
  2. Nextcloud sends it directly to the new user

Contributor guide

Tech stack
None
Domain
backendauthentication
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Familiarity with Nextcloud serverPHP developmentUser authentication concepts
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
20
Research direction
Examine the current user registration flow in Nextcloud server, focusing on the token generation and validation in the activation email. Review the comments in this issue for prior discussion and proposed solutions. Look into the user management controllers and password change functionality to see where a one time password and forced password change could be integrated. Consider modifying the registration process to allow admin to set a temporary password and trigger a password change on first login.