Re: [Django] #15366: AuthenticationForm should optionally permit inactive user login

[Django]

#15366: AuthenticationForm should optionally permit inactive user login
--+-
 Reporter:  krejcik@… |Owner:  hjeffrey
 Type:  New feature   |   Status:  closed
Component:  contrib.auth  |  Version:  1.3-beta
 Severity:  Normal|   Resolution:  duplicate
 Keywords:  inactive  | Triage Stage:  Accepted
Has patch:  1 |  Needs documentation:  1
  Needs tests:  1 |  Patch needs improvement:  1
Easy pickings:  0 |UI/UX:  0
--+-
Changes (by claudep):

 * status:  assigned => closed
 * resolution:   => duplicate


Comment:

 For me, #12103 is actually a duplicate with a much more elaborate patch
 (including tests and docs).

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

Re: [Django] #15366: AuthenticationForm should optionally permit inactive user login

[Django]

#15366: AuthenticationForm should optionally permit inactive user login
--+
 Reporter:  krejcik@… |Owner:  hjeffrey
 Type:  New feature   |   Status:  assigned
Component:  contrib.auth  |  Version:  1.3-beta
 Severity:  Normal|   Resolution:
 Keywords:  inactive  | Triage Stage:  Accepted
Has patch:  1 |  Needs documentation:  1
  Needs tests:  1 |  Patch needs improvement:  1
Easy pickings:  0 |UI/UX:  0
--+
Changes (by aaugustin):

 * needs_better_patch:  0 => 1
 * needs_tests:  0 => 1
 * easy:   => 0
 * needs_docs:  0 => 1
 * ui_ux:   => 0
 * stage:  Design decision needed => Accepted


Comment:

 We must consider:
 - backwards compatibility: suddenly allowing inactive users to log in is
 absolutely unsafe;
 - the
 
[https://docs.djangoproject.com/en/dev/topics/auth/#django.contrib.auth.models.User.is_active
 docs for User.is_active]: indeed, it doesn't preclude login of inactive
 users;
 - the [https://docs.djangoproject.com/en/dev/releases/1.3/#permissions-
 for-inactive-users release notes] and
 [https://docs.djangoproject.com/en/dev/topics/auth/#authorization-for-
 inactive-users docs for supports_inactive_user]: they say that
 `supports_inactive_user` is primarily related to permissions.

 Currently, the best solution is to subclass `AuthenticationForm` and
 override `clean` entirely. I'm attaching a patch that makes it easier to
 support inactive users in a subclass. This would need a little bit more
 investigation (where is `AuthenticationForm` used? what do the docs say?),
 possibly a more complete patch, then tests and docs.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.

Re: [Django] #15366: AuthenticationForm should optionally permit inactive user login

[Django]

#15366: AuthenticationForm should optionally permit inactive user login
-+-
   Reporter:  krejcik@…  |Owner:  hjeffrey
   Type:  New|   Status:  assigned
  feature|Component:  contrib.auth
  Milestone: | Severity:  Normal
Version:  1.3-beta   | Keywords:  inactive
 Resolution: |Has patch:  1
   Triage Stage:  Design |  Needs tests:  0
  decision needed|
Needs documentation:  0  |
Patch needs improvement:  0  |
-+-

Comment (by hvdklauw):

 #12103 is also about inactive users login

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.

Re: [Django] #15366: AuthenticationForm should optionally permit inactive user login

[Django]

#15366: AuthenticationForm should optionally permit inactive user login
--+
   Reporter:  krejcik@…   |Owner:  hjeffrey
 Status:  assigned|Milestone:
  Component:  Authentication  |  Version:  1.3-beta
 Resolution:  | Keywords:  inactive
   Triage Stage:  Design decision needed  |Has patch:  1
Needs documentation:  0   |  Needs tests:  0
Patch needs improvement:  0   |
--+
Changes (by hjeffrey):

 * stage:  Accepted => Design decision needed


Comment:

 I don't know it this is the best way of handling the problem, but it
 seemed the simplest and most straight forward solution that would work
 generically.

 There is possibly the issue that could arise were there are several
 backends for which the user has inactive accounts, some of which allow
 inactive users to log in while others do not. In this scenario the user
 would be rejected if the first backend that had credentials for him
 didn't allow inactive users to log in ever if others in the list did or
 even if he had an active account further down the list of backends.

 Is inactive user login going to be a project wide setting for all backends
 or be handled on a backend by backend basis? If it's project wide the
 approach should work alright, but it still ignore active accounts further
 down in the list. If it's backend by backend what would be the appropriate
 authentication handling under the scenario presented?

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.

Re: [Django] #15366: AuthenticationForm should optionally permit inactive user login

[Django]

#15366: AuthenticationForm should optionally permit inactive user login
--+
   Reporter:  krejcik@…   |Owner:  hjeffrey
 Status:  assigned|Milestone:
  Component:  Authentication  |  Version:  1.3-beta
 Resolution:  | Keywords:  inactive
   Triage Stage:  Accepted|Has patch:  1
Needs documentation:  0   |  Needs tests:  0
Patch needs improvement:  0   |
--+
Changes (by hjeffrey):

 * has_patch:  0 => 1


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.

Re: [Django] #15366: AuthenticationForm should optionally permit inactive user login

[Django]

#15366: AuthenticationForm should optionally permit inactive user login
--+
   Reporter:  krejcik@…   |Owner:  hjeffrey
 Status:  assigned|Milestone:
  Component:  Authentication  |  Version:  1.3-beta
 Resolution:  | Keywords:  inactive
   Triage Stage:  Accepted|Has patch:  0
Needs documentation:  0   |  Needs tests:  0
Patch needs improvement:  0   |
--+
Changes (by hjeffrey):

 * owner:  nobody => hjeffrey
 * cc: hjeffrey (added)
 * status:  new => assigned


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.

Re: [Django] #15366: AuthenticationForm should optionally permit inactive user login

[Django]

#15366: AuthenticationForm should optionally permit inactive user login
--+-
   Reporter:  krejcik@…   | Owner:  nobody  
 Status:  new | Milestone:  
  Component:  Authentication  |   Version:  1.3-beta
 Resolution:  |  Keywords:  inactive
   Triage Stage:  Accepted| Has patch:  0   
Needs documentation:  0   |   Needs tests:  0   
Patch needs improvement:  0   |  
--+-
Changes (by russellm):

  * needs_docs:  => 0
  * needs_better_patch:  => 0
  * stage:  Unreviewed => Accepted
  * needs_tests:  => 0
  * milestone:  1.3 =>


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.

[Django] #15366: AuthenticationForm should optionally permit inactive user login

[Django]

#15366: AuthenticationForm should optionally permit inactive user login
+---
 Reporter:  krejcik@…   |  Owner:  nobody
   Status:  new |  Milestone:  1.3   
Component:  Authentication  |Version:  1.3-beta  
 Keywords:  inactive|   Triage Stage:  Unreviewed
Has patch:  0   |  
+---
 ModelBackend now allows login with inactive user (it has
 supports_inactive_user property).
 But AuthenticationForm never allows login of such user.
 I guess it should be configurable because it is designed as base form for
 all authetication forms.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.