Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Automatically log in for EveryonesAnAdminProvider and EveryonesReadOnlyProvider #282

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

AlexSikilinda
Copy link
Contributor

When EveryonesAnAdmin or EveryonesReadOnly is selected as the security provider users are redirected to the login page where they are supposed to type random login/password.

This commit introduces custom view which contains auto-submitted form so that users don't need to login.

@NickCraver
Copy link
Member

This isn't the intent of the "EveryoneIsAnAdmin". A key aspect is you still need to login. Actions should still be traceable to you, including in exceptions, admin operations, etc.

EveryoneIsAnAdmin is also everyone who can log in is an admin, this may or may not be everyone. Such a view breaks that use case (and the intent above).

@AlexSikilinda
Copy link
Contributor Author

Was under the impression that EveryonesAnAdminProvider means everyone can login + everyone is an admin, since ValidateUser always returns true:

public class EveryonesAnAdminProvider : SecurityProvider
{
    public override bool IsAdmin => true;

    internal override bool InAdminGroups(ISecurableModule settings) { return true; }
    public override bool InGroups(string groupNames, string accountName) { return true; }
    public override bool ValidateUser(string userName, string password) { return true; } // <-- here
}

But I got your point about authenticating an admin, it's just a little bit confusing that you have to type a random password which actually isn't validated. Maybe the password input should be hidden on the login page, just wondering.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants