Forgotten password improvement

[Hr46ph]

The current situation is as follows:

When a user forgets his or her password, they have the option to email themselves with a link. When they reveive the link they can open it and set a new password. This works, however when they try to login with this new password, they get the message to provide a master key and their previous password.

When an Admin resets their password, they run into the same situation.

What good is a 'forgot password' option, or an admin's 'reset password' function when the user is prompted for their previous password?

Current workound: Delete the user account and recreate it. This way their current settings and profile is gone, but at least they can login again and start anew. However, this only works with local syspass accounts. Imported LDAP accounts may run into issue #1674.

Suggested change: The reason for syspass to require the users previous password is so that it can decrypt the user stored settings and profile, including their personal accounts (password entries).

Provide an option with the previous password prompt to skip this password in case a user has forgotten it. Syspass should warn the user that the above mentioned personal user settings and items are deleted and a new user profile is created.

[alienpenguin]

+1 Current implementation is not ready for real production usage. If you integrate it with domain user handling it is an extremely common scenario that users ask for their password to be reset because they forgot it. Not being able to skip the insertion of "previous password" is a huge UX issue. Besides i don't really see any security issues (the whole domain password handling works like this): if we want to add an extra-security layer, the old password should be asked when the password is changed from within the webgui when the user is logged in, to prevent that someone accessing the unguarded pc (unlikely but...) might change the password without user knowledge.