I am using LDAP mode of authentication and have written web service and clients to enable gerrit users to reset their passwords should they happen to forget it. For that, I added the following line into gerrit.config file:
[auth]
httpPasswordUrl = http://domain.com:port/Register/ChangePassword
However, this link is not visible anywhere on gerrit, either before login or post login. Can someone guide me on how to make this link "visible" to one and all (users)?
This link is displayed in the Settings -> HTTP Password screen. So this link cannot be used for users who forgot their password. I don't think there is an option to display such a link for non-logged-in users.
A possible solution would be displaying a custom footer / header which adds this link: https://gerrit-review.googlesource.com/Documentation/config-themes.html#_html_header_footer
Related
I've set up my asp.net mvc app according to this sample and if you see that line in startup.auth.cs, it says that when the user clicks on "Forgot Password" link, it should redirect to my app at which point it should catch that error in the line 101 that I've linked to and then redirect the user to the proper reset password flow.
However, when clicking forgot password, the flow is never directed back to my app, but rather I see this screen:
Where can I check as to why this happens? Is this supposed to be in my sign in policy or is there some setting in application or tenant?
This happens if you enable development mode in your custom policy.
Either remove the lines, or set it to DeploymentMode:Production.
https://learn.microsoft.com/en-us/azure/active-directory-b2c/troubleshoot-with-application-insights
We are creating an app that has a feature to reset their password respectively, since we are using keycloak so that thing will be featured via keycloak page itself, but our client need the forgot password will be provided in the app, so i need to hit the forgot password api like below flow.
App Forgot Password Page > Fill email only and proceed > User receive reset password link > Open link > Keycloak reset password page
But seems that api is not existed in the keycloak.
As far i only found below apis
PUT /{realm}/users/{id}/reset-password (need bearer, not possible since we are unable to use realm account user)
PUT /{realm}/users/{id}/execute-actions-email (don't know how to use it and need bearer, not possible since we are unable to use realm account user)
Any suggestion?
Thank you in advance
Hi there, this is 2021, my solution at this time was by using keycloak library in java service, so the service working as aggregator between my web app to keycloak, and still we are using above apis mentioned that need realm access. Good luck.
You can set required action for the user to UPDATE_PASSWORD and when user tries to log in, they will be prompted with Setting up their password.
Keycloak Admin APIs - UserResource
You can update the user and in the UserRepresentation you can set that required action.
From various googling and reading https://www.jhipster.tech/security/#oauth2 , I gathered that in order to have mobile/social integration with JHipster generated app I should use OAuth2. Am I right to think this way? (I can't seem to find a clear cut answer to this)
I created a new application with JHipster v5.1.0 with OAuth2 enabled. I noticed a couple of features missing with regards to user management. Below are my questions.
How does a new user register a new account?
How does a user change password / reset forgotten password?
Hopefully someone with experience on the above can help clarify.
Thank you in advance.
For social login, yes your best option is OAuth 2.0. You can use JWT for mobile development with React Native (via JHipster Ignite) and Ionic (via Ionic for JHipster), so it's not necessarily required for mobile.
For user registration and change password, you'll need to enable those options in Keycloak or Okta. This blog post shows you how.
To summarize:
For Keycloak, you can enable registration by navigating to http://localhost:9080 and click on Administration Console. Login with admin/admin and click on the Login tab. This screen allows you to enable forgot password, remember me, and verify by email as well.
To enable self-service registration in Okta, you’ll need to navigate to the Classic UI from the Okta Developer Dashboard. There’s a link to toggle between the two in the top left corner of your screen.
Then navigate to Directory > Self-Registration and click Enable Registration. Set the default group to ROLE_USER, the Default redirect to a Custom URL with http://localhost:8080 as its value, and click Save.
NOTE: If you get an error that says 'http://localhost:8080' is not a valid redirect URI, it’s because you need to add http://localhost:8080 as a trusted redirect under Security > API > Trusted Origins. After making this change, navigate to Directory > Self-Service Registration and edit the settings to configure the custom URL again. It should work this time.
I've been trying to use the Grails Spring Security OpenID plugin and while following the tutorial instructions https://grails-plugins.github.io/grails-spring-security-openid/docs/manual/guide/tutorials.html it just doesn't work at:
Navigate to http://localhost:8080/openidtest/secure/admins and you should be prompted with the login screen. Leave the Use OpenID checkbox checked and enter a valid OpenID. Don't check the remember-me checkbox yet (it doesn't work with the extended workflows where you create a new user or link an OpenID) and click the "Log in" button.
After authenticating at the OpenID provider, you'll be redirected to the registration page. Note that there's a link to just associate the current OpenID with a local account - for now click the "link this OpenID" link.
When I try to log in, I simply get:
Sorry, we were not able to find a user with that username and password.
The documentation is not recent, and last I saw in some other post was that Burt said he had some github issues and had not been able to updated it (I think it was a stackoverflow comment around October 2013).
Does anyone know if there is a configuration or setting that must be changed? or a new step perhaps?
Thanks in advance
So I have come to this conclusion from reading a few different sources and trying things out. I stand to be corrected, however, the current solution is working for me.
My humble understanding: The OpenID input in the plugin requests a link from the OpenID Account provider (e.g. google) with which the user will be authenticated.
Websites can just have a link for each provider they want to support instead of asking for a link, so that you would have a "Login with Google" button with the link prefilled (which by the way is https://www.google.com/accounts/o8/id).
It can help to just look at how other websites do it. You can also just google openid and your provider to find out their links.
Note that some providers have a static link, while it looks like others have user specific links. I'm not yet sure how to deal with user specific links yet.
We have our F5 LTM BIG-IP® Configuration Utility setup in an Active/Passive setup, and have different links to each admin utility console.
Is it possible to display the Failover Status (active vs standby) on the Login Page so you don't have to login to see the status? It's frustrating to login only to see you've logged into the Standby node.
I don't believe so, but if you go to System>Preferences you could modify the "Security Banner Text To Show On The Login Screen". Generally, here you would specify a custom security message which provides legal protection to your organization, such as a message stating that unauthorized access is forbidden and what password restriction that other users should be specifying (the login screen of the BIG-IP Configuration utility displays the text that you specify in this field). Here, you could probably mention which is active and which is standby without syncing this change to the group. Just make sure that whenever you fail-over from one device to the other (shouldn't be too often); that you simply adjust this message and you should therefore be good to go with that. Hope this helps :)
https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-datacenter-firewall-config-11-1-0/3.html