Let users use their username OR password as credential to log in #15725

peterpeter · 2017-05-01T19:36:29Z

Pull Request for Issue #15712 .
With this patch it is possible for users to use their email instead of the username (plus the password), as it is more and more a common behaviour on most other websites, -systems, -shops.
First approach

Summary of Changes

Added Parameter and changed sql query in joomla authenticate plugin.
Added check and language strings for the form labels of mod_login and com_users

Testing Instructions

Add this patch, go in administration to plugins - authentication - joomla, open it and set the param ' Login with email allowed?' to yes and save your choice.

Expected result

With patch added, the form labels for the fields 'username' changed from 'Username' to 'Username or email' in both, mod_login and com_users on frontend.
And it should be possible to login with your email and passwort.

With setting the param 'Login with email allowed?' to 'No' log in with email should be no more possible, and the form labels should change back to 'Username'.

Follow ups

The behaviour changes in both, front- and backend. Would be maybe not that bad to have an additional choice wether to add this feature just in frontend or in both, front- and backend. Any thoughts?

…ential to log in through the joomal authenticate plugin

brianteeman · 2017-05-01T20:00:48Z

I am not in favour of this change for security reasons. If a site owner wants to do this there are several extensions available. We should be increasing security not reducing it.

Bakual · 2017-05-02T07:15:26Z

Is there an issue we try to solve here which can't already be done using 3rd party extensions?
If it can be solved with an extension already, I don't see the need for us to include it into core. Looks like quite a situational usecase to me.

peterpeter · 2017-05-02T07:36:07Z

There are individual uses cases to solve and there are common web standards/behaviour to be included. In my opinion this patch is more for the latter. Again, I think Joomla should behave the same as other applications out of the box, after the installation, and not with additional extensions.

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15725.}

Bakual · 2017-05-02T07:48:20Z

components/com_users/views/login/tmpl/default_login.php

@@ -11,6 +11,21 @@

 JHtml::_('behavior.keepalive');
 JHtml::_('behavior.formvalidator');
+
+$isJoomlaAuthenticationEnabled = JPluginHelper::isEnabled('authentication' , 'joomla');


Please remove any conditional which check for a specific plugin implementation. The module should be unaware of the active plugin(s) and its parameters.
Another authentication plugin should be able to provide the same features.

Bakual · 2017-05-02T07:49:05Z

modules/mod_login/tmpl/default.php

+$isJoomlaAuthenticationEnabled = JPluginHelper::isEnabled('authentication' , 'joomla');
+$usernameTextToken             = 'MOD_LOGIN_VALUE_USERNAME';
+
+if($isJoomlaAuthenticationEnabled)


Same here, no checking for a specific plugin.

Ok, agree, that was about to change the form label language token. Will remove that later this evening (now @work ;) )

C-Lodder · 2017-05-02T09:20:19Z

plugins/authentication/joomla/joomla.php

@@ -47,6 +47,12 @@ public function onUserAuthenticate($credentials, $options, &$response)
 			->from('#__users')
 			->where('username=' . $db->quote($credentials['username']));

+		// should we check the email too=
+		if((bool)$this->params->get('login_with_email_allowed', 0))


If the default value for login_with_email_allowed is 0, how can this be cast to a boolean?

brianteeman · 2017-05-02T09:29:49Z

The correct way to do this is with a NEW authentication plugin specifically to allow login by email. That is why we have authentication plugins.

(Then we end up with exactly what the available extensions can already do - so there is no point ijn adding this to the core)

… as credential to log in through the joomal authenticate plugin" This reverts commit e84a5d7.

… mod_login and com_users

peterpeter · 2017-05-05T20:41:01Z

Again: I made this PR because I think that common standards should be in the core and available out of the box, as SEO, Microdata, RSS, Tags....too. The security impact is not that bad and as it is off by default at least the site-admins decision. Every different authentication method should be implemented as own plugin, true. But this is just an addition to a existing one - and not a new or different one.

If this PR not get merged is not a big thing to me. But I think it's a chance to get more even with other web-applications. Just my 2 cents.

brianteeman · 2017-05-23T11:36:51Z

I have tested this item ✅ successfully on f6612ba

I have tested this and it works as described - still not personally convinced its an improvement though

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15725.}

ghost · 2017-05-23T11:44:17Z

I have tested this item ✅ successfully on f6612ba

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15725.}

ghost · 2017-05-23T11:44:36Z

RTC after two successful tests.

brianteeman · 2017-05-23T11:58:31Z

This is a new feature so I have added the new feature option

@franz-wohlkoenig please remove the RTC - just because a new feature is tested as working doesnt mean it is a good thing and can be merged - as you can see both @Bakual and myself expressed our doubts about the usefullness of this

ghost · 2017-05-23T12:04:53Z

@brianteeman RTC removed. My Thought was that Maintainers can decide independent from Status & 2 sucessfully Tests didn't get lost.

idefax · 2017-05-23T13:54:37Z

I have tested this item ✅ successfully on f6612ba

Works perfect.

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15725.}

idefax · 2017-05-23T13:58:37Z

This is a very functional and great feature for the users, since it's very common to login with email address.

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/15725.}

rdeutz · 2017-05-23T14:04:34Z

we have not merged better solution to solve the problem, see #10347

infograf768 · 2017-05-27T10:00:43Z

Some thought:
I disagree with the statement that this would degrade security. The password and 2FA do the job OK imho.
I disagree also with the statement that because some 3rd party extensions exist, we should not include this in core. Remember my plugins Unicode slugs and Registration approval for 1.5, and many others.
I also disagree with the solution that was proposed in #10347 as it was not BC.

I will reset this as RTC as it was tested and works fine.
The final decision is indeed the choice of the release leader and PLT as rightfully posted by @franz-wohlkoenig

mbabker · 2017-05-27T13:54:32Z

By adding an additional WHERE clause, and because the username and email columns are only unique within themselves, it is possible now for this query to return a non-unique result set (as in 2 records versus one if somehow user A has a username of [email protected] and user B has an email address of [email protected]). This scenario needs to be addressed.

zero-24 · 2017-05-27T17:10:58Z

Please also check com_joomlaupdate login form iirc thy check on username only too.

josephsimony · 2017-06-08T03:58:31Z

The subject doesn't sound right (it was strange to read of a feature like that).
I guess the starter meant: Let users use their username OR email as credential to log in

uglyeoin · 2017-07-14T17:29:32Z

I like this PR and think it would be useful. I think it is a UX thing. Users expect certain behaviour and if they cannot remember their username they will likely try their email address. I would argue that the email address is unique and thus could replace the username option. In that situation it would solve the problem this PR solves and I think it overcomes the security issue @brianteeman mentioned. It would break b/c though by doing it that way though. In any case I think users would try to use their email address in some cases.

mbabker · 2017-07-14T17:37:15Z

A system should only have one identifier for a user. Either a username or a password. A username can be any unique value identifying that user, be it an email address, a customized username, or a system generated identifier; we don't impose a restriction that says the username has to be a value that is not used in one of the other columns in the users table.

A site can use language overrides to change the labels if they want to steer users toward using their email address as their usernames. There are also plugins which can accomplish the same.

The long and short is I still don't see something that requires us to make a core change to allow an email address to be a username as you can already do it, it is just stored as a separate field in the database. If we were to add such an option, it would introduce site management issues as we would have to force that the username AND email columns be unique (a username and email can only be the same if it is the same record, a username cannot be duplicated as an email address in another record (and vice-versa) as that would mean the system would potentially try to log into 2 different accounts). This patch does not address the data integrity issue, as I pointed it out nearly 2 months ago.

rdeutz · 2017-07-14T17:50:01Z

the "problem" is solved else where, closing

Let users use their username OR password (among the password) as cred…

e84a5d7

…ential to log in through the joomal authenticate plugin

joomla-cms-bot added Language Change This is for Translators PR-staging labels May 1, 2017

ghost mentioned this pull request May 2, 2017

Possibiltity to login with username OR email #15712

Closed

Bakual reviewed May 2, 2017

View reviewed changes

C-Lodder reviewed May 2, 2017

View reviewed changes

peterpeter added 4 commits May 5, 2017 20:58

Revert "Let users use their username OR password (among the password)…

526b2ba

… as credential to log in through the joomal authenticate plugin" This reverts commit e84a5d7.

Same functionality but now without authentication method depencies in…

4beda6d

… mod_login and com_users

Code formating - making CS happy

dd48c23

...another CS...

f6612ba

joomla-cms-bot added the RTC This Pull Request is Ready To Commit label May 23, 2017

brianteeman added the Feature label May 23, 2017

joomla-cms-bot removed Feature RTC This Pull Request is Ready To Commit labels May 23, 2017

infograf768 added the RTC This Pull Request is Ready To Commit label May 27, 2017

infograf768 added the Feature label May 27, 2017

Merge branch 'staging' into login_with_email

8eeda7a

joomla-cms-bot removed the RTC This Pull Request is Ready To Commit label May 27, 2017

rdeutz closed this Jul 14, 2017

peterpeter deleted the login_with_email branch July 17, 2017 06:00

PixedBo mentioned this pull request Jun 8, 2020

[4.0][RFC] Email as username on registration/login #29471

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Let users use their username OR password as credential to log in #15725

Let users use their username OR password as credential to log in #15725

peterpeter commented May 1, 2017 •

edited by joomla-cms-bot

Loading

brianteeman commented May 1, 2017

Bakual commented May 2, 2017

peterpeter commented May 2, 2017

Bakual May 2, 2017

Bakual May 2, 2017

peterpeter May 2, 2017

C-Lodder May 2, 2017

brianteeman commented May 2, 2017

peterpeter commented May 5, 2017 •

edited

Loading

brianteeman commented May 23, 2017

ghost commented May 23, 2017

ghost commented May 23, 2017

brianteeman commented May 23, 2017

ghost commented May 23, 2017 •

edited by ghost

Loading

idefax commented May 23, 2017

idefax commented May 23, 2017

rdeutz commented May 23, 2017

infograf768 commented May 27, 2017

mbabker commented May 27, 2017

zero-24 commented May 27, 2017

josephsimony commented Jun 8, 2017

uglyeoin commented Jul 14, 2017

mbabker commented Jul 14, 2017

rdeutz commented Jul 14, 2017

Let users use their username OR password as credential to log in #15725

Let users use their username OR password as credential to log in #15725

Conversation

peterpeter commented May 1, 2017 • edited by joomla-cms-bot Loading

Summary of Changes

Testing Instructions

Expected result

Follow ups

brianteeman commented May 1, 2017

Bakual commented May 2, 2017

peterpeter commented May 2, 2017

Bakual May 2, 2017

Choose a reason for hiding this comment

Bakual May 2, 2017

Choose a reason for hiding this comment

peterpeter May 2, 2017

Choose a reason for hiding this comment

C-Lodder May 2, 2017

Choose a reason for hiding this comment

brianteeman commented May 2, 2017

peterpeter commented May 5, 2017 • edited Loading

brianteeman commented May 23, 2017

ghost commented May 23, 2017

ghost commented May 23, 2017

brianteeman commented May 23, 2017

ghost commented May 23, 2017 • edited by ghost Loading

idefax commented May 23, 2017

idefax commented May 23, 2017

rdeutz commented May 23, 2017

infograf768 commented May 27, 2017

mbabker commented May 27, 2017

zero-24 commented May 27, 2017

josephsimony commented Jun 8, 2017

uglyeoin commented Jul 14, 2017

mbabker commented Jul 14, 2017

rdeutz commented Jul 14, 2017

peterpeter commented May 1, 2017 •

edited by joomla-cms-bot

Loading

peterpeter commented May 5, 2017 •

edited

Loading

ghost commented May 23, 2017 •

edited by ghost

Loading