freeipa-password-reset
freeipa-password-reset copied to clipboard
larrabee
Slack Conversations API
Awesome work and really nice options available through the provider list. Everything works with no problems at all.
One comment, which i see making huge difference, security wise.
The SLACK Webhook provider requires the existence of a slack channel. As you can understand posting a token for a user reset to a channel is like asking for someone to test which user was it through simple brute force.
A better approach would be through the use of Slack's conversation API (https://api.slack.com/methods/conversations.open) which offers the capability to direct message the password request token to the user.
Hello.
Unfortunately we do not use Slack and this functionality is not written by me. If you use Slack and can make the PR with changes, it will be cool.
