Clément "KPTN" OUDOT

icon indicating a website link https://kptn.org icon indicating an email [email protected]

icon company @Worteks icon location Lyon, France icon location Working on Identity and Access Management for @Worteks with free softwares like @ltb-project / @LemonLDAPNG / @lsc-project

Results 461 comments of Clément "KPTN" OUDOT

Spec file clean up

Thanks for the feedback. Do you plan to add Self Service Password as an official package in Fedora? I'm still thinking about including all the changes in the community package,...

Spec file clean up

My concern is about users installing from our packages and knowing where the files are. It will impact all their documentations.

Password Strength Meter

Has been done by @davidcoutadeur for 1.6

Keep sending reset requests

Seems same issue as #763

Why no logging for any actions taken by users?

I had a new request for an audit log We can do something similar that what was done for Service Desk: https://github.com/ltb-project/service-desk/issues/72

Why no logging for any actions taken by users?

The information that should be logged: * Date * IP * User * Action * Result The log should occur for both Web and REST access.

Why no logging for any actions taken by users?

Hello @TheAshwanik You can check https://github.com/ltb-project/self-service-password/pull/781

Multiple SMS tokens could be requested if an attacker finds one username, leading to big expenses

@Worteks is looking at it (thanks @armfem)

Avoid browsers prompting for storing new password

I am not very enthusiast of using a text input field. The best practice is to use the autocomplete property with "new-password" value, see https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

Avoid browsers prompting for storing new password

The latest workaround does not seem to work either. Postponing this issue as the browser behavior is quite hard to trick.