adapt-security / adapt-authoring-localauth Goto Github PK

See AdaptFrameworkModule for an example (it's recommended to add a separate file with API defs for non-trivial APIs to reduce clutter (see apidefs.js).

The email address on the login and password reset forms is case-sensitive (this is also the case in the old AT).

We get a number of support requests each month caused by users not expecting this and being unable to login.

In the past we said it was difficult to introduce this as there may already be some ATs set up with users whose email addresses would clash if we suddenly treated them as case insensitive (eg [email protected] and [email protected]).

As this is a clean slate I think this would be a really good opportunity to make the user email case insensitive.

We would need to modify:

• Login form
• Password reset form
• When creating a user check that case-insensitive email is unique
• When updating a user check that case-insensitive email is unique

Steps to recreate:

1. Select 'add new user'
2. Complete form with password that doesn't meet policy stipulations
3. Click save

Expected behaviour - an error message stating 'invalid password' is displayed

Actual behaviour - nothing happens - form still displayed and editable, no error

Additional notes. The password that failed contained a # - are we supporting the usual range of 'special character's in passwords?

Although technically correct, should be more descriptive to the specific case.

{
  "code":"UNAUTHENTICATED",
  "message":"You are not logged in"
}

This needs fixing so that the correct error message is displayed.

Error will be thrown by LocalAuthModule.