Re: Password changing

[Aaron Turner <aturner@linuxkb.org>]

On Sun, 23 Jan 2000, Micah K Yoder wrote:

> First of all, CVS checkins seem to be broken...

<sarcasm>
And of course you didn't give us any debugging info so we can fix it.
Do you mind telling us what is wrong or do I get to play 20 questions?
</sarcasm>

> Password changing now works, but...
> 
> After they change it, it will bring up an HTTP auth box next time they
> try to go someplace else.  First, that's kinda annoying, they shouldn't
> have to do that.  

There is no way around this since we're using http auth.  The browser
keeps sending the old password with each request and since the password on
the server has changed the user is SOL unless you want to track two
passwords which I wouldn't if I were you/jason.

> Second, logging in with the new info doesn't seem to

What "new info"?  The new password?

> work for me right away.  I get an auth failed - retry type message.  But

Is this like the current password problem where if you misstype the user
or password the first time you can't login?

> if I go to the server root (localhost:81) and work my way in from there
> to log in again, it works.

What are the exact errors?  Can you recreate it and look in the apache
error/log files to see if there's an error there too?  

As long as you have the same DB dump and CVS tree dev and localhost should
act EXACTLY THE SAME.  9/10 times when they act different it is because
you have either different code or a different DB.  I have spent a great
deal of time making sure of that, so if you find a case where the same cvs
image and the same DB produce different results I need to know about it in
as much detail as you can provide.

> So does anyone know a way to avoid the HTTP auth prompt after a password
> change?  I know it's possible because my broker uses HTTP auth and I can
> change my password there without a login message...

Since there is no way to get the client browser to send the correct
(new) password with the request without prompting the user to enter a
password, the broker is probably using cookies to track you once you
login.  I'm only guessing of course.  The other option would to accept
multiple passwords or any password for a given length of time or for the
session.  The other possibility is that their webserver is caching
password information in the webserver process so it doesn't always hit the
DB for each request.  The modperl Authen module we were using did that.

> I also fixed the left sidebar so that it will now link to the edit page,
> with the current user's object ID.  Sweetness.  Now if it will just
> check in...

Is the problem cvs commit or webupdate related?  What is the error
message?

> I actually didn't get as much done today as I had hoped.  I am pretty
> stinking tired after being awake most of last night.  Now that I'm
> somewhat on a roll I do plan to get to the rest of my stuff
> (signup.php3) within the next couple days.

Well you only have about a couple of days.  No pressure though. :) 

--
Aaron Turner, Core Developer       http://vodka.linuxkb.org/~aturner/
Linux Knowledge Base Organization  http://www.linuxkb.org/
Because world domination requires quality open documentation.
aka: aturner@vicinity.com, aturner@pobox.com, ion_beam_head@ashtech.net
The difference between `Unstable' and `Usable' is only two characters: NT