rejectedsoftware / userman

Embeddable user management library and authentication provider (user registration, activation mails, password authentication)

UserMan - A User Management System

This package doubles as a library that provides an embeddable user management interface for websites and as a standalone server that provides a user administration front end, as well as a RESTful service that can be used for authentication or to manage user accounts.

A major revision of the source code is currently underway. More instructions will be added in that process.

Migration notes for 0.3.x to 0.4.x

In 0.4.x, the database layout for storing groups has changed and will be migrated automatically on the first run. Care should be taken to not run 0.3.x afterwards, as that will lead to exceptions if groups are used. Data corruption on the other hand should not happen.

userman's Issues

Issue with MongoDB setup

I am using this configuration:

https://github.com/cummerbund/testrepo/blob/master/source/app.d

I get the following error when running:

vibe.db.mongo.connection.MongoDriverException@../../../../home/dev/.dub/packages/vibe-d-0.7.23/source/vibe/db/mongo/connection.d(155): Failed to connect to MongoDB server at .:27017. object.Exception@../../../../home/dev/.dub/packages/vibe-d-0.7.23/source/vibe/core/drivers/libevent2.d(260): Failed to lookup host '.': non-recoverable failure in name resolution

I am using a clean install MongoDB on Ubuntu, DB established "test" - and ideas?

send_mail and message aren't used by UserManController

it looks like they do something, but in the implementation, nothing.

v0.3 seems to be incompatible with D 2.091.1

../../.dub/packages/vibe-d-0.8.6/vibe-d/web/vibe/web/web.d(197,6): Error: static assert:  "Instances may only be returned from parameter-less functions (__ctor)!"
source/userman/web.d(34,29):        instantiated from here: registerWebInterface!(UserManWebInterface, cast(MethodStyle)5)

• https://github.com/rejectedsoftware/userman/blob/0.3/source/userman/web.d#L34
• https://github.com/vibe-d/vibe.d/blob/v0.8.6/web/vibe/web/web.d#L197

I wonder whether this is caused by a regression or expected (new) behavior?

userman.web.authenticate() assumes no session data if not logged in

This function simply checks if req.session exists. This is not correct, as web applications may keep session data for non-authenticated visitors.

Compatibility with vibe-d 0.8.1

I tried to make this work, but got completely bogged down in @safe etc.

Better password hash generation in generatePasswordHash

vibe-d/vibe.d#2365

I'm not sure what's best, bcrypt or else?

Namespacing of session keys

Libraries should generally be careful to limit chances of naming conflicts with applications using the library and other libraries used by the application. As session data keys are only session-scoped, such naming conflicts may arise. Therefore, using a library specific namespace prefix in session keys is probably a good habit. I.e. something like projectname.key (which is the way I do it in the oauth project).

Segfault over updateUser() in userman 0.2.0

Hi,

I get a segfault calling updateUser(user) inside activateUser(...) in controller.d

I call the MongoUserManController updateUser(...) implementation. I'm on linux debian wheezy.

When compiled with dmd the output of a run under gdb is anemic, just nothing. I want to try with a gdc compiled debug version but can't figure out how to use gdc with dub as reported here (http://forum.rejectedsoftware.com/groups/rejectedsoftware.vibed/thread/21134/)

Let me know. Thx,

olivier

p.s: Moved to RedisUserManController and it works perfect.

Expanding UserMan to support REST

I'm currently working on adding a RESTful package to userman, to support user and group management, as well as authentication using different method (my current focus is on query authentication).
I want something as customizable as possible, so I'll go for full template + policy design.

It will be based on Vibe.d's REST module (ofc ;) ), with templated interfaces. Here's an example of where I plan it to go (warning: WIP): https://github.com/Geod24/userman/blob/7f90229f06c75eff8b86660a39755a067086ec5c/source/userman/rest/keys.d

Of course I want it to integrate with the other part of userman (controler). However, I see that it depends on the user / group structure ATM. Before I start to dive into this, I was wondering if you have any plans / insight to share.

redis usage is broken

The mistake was introduced here: acbe674#diff-3e3173a50db7d7cd7e3561efce0f0e8aR68

The problem is that for e.g. http://127.0.0.1:8765/1 InetPath produces path segments ["", "1"], so getting the first one and converting to long doesn't work.

I don't know whether this is a bug in InetPath or in userman, but it completely breaks userman w/ redis.

Registered E-Mails can be checked

userman/source/userman/web.d

Line 393 in 47bc915

// ignore errors, so that registered e-mails cannot be determined

it says here the it's supposed to ignore errors but if you access /reset_password?email=somemail&code=invalid_code and attempt to change the password the error is different between

There is no user account for the specified email address.

and

Error: Invalid request code, please request a new one.

It should always only show the second one.

Probably low priority but the comment there that it shouldn't be able to be determined, I think you might still be able to find out because the throw/catch takes more time so you will see a ms or more more on average, it should simulate some micro sleep.

Support for database other than mongodb

Are there any plans to support other databases? I'm writing an application using Redis and need to add user management. Now I would like to implement Redis support for userman but want to discuss the approach. The most straightforward option would be to turn the UserManController into an interface and then implement various concrete classes for each supported db. The UserManSettings would need to be extended with some additional properties (e.g. databaseIndex for Redis).

Add authentication support for REST interface