sub domains and password reset about express-stormpath HOT 4 CLOSED

Hi @jmls

Password reset policies (which include the customizable Link Base URL for the password reset flow) are defined on a per-directory basis, so you could have a directory per sub-domain.

I'd also take a look at our multi-tenancy overview: http://docs.stormpath.com/guides/multi-tenant/

from express-stormpath.

Hey, robertjd. I did look at using directories, but have a couple of problem with this :

the first is that I need a group of users that are "admins" that can log into any subdomain. I did this by having an "admin" group and then checking the user membership ( stormpath.groupsRequired(['admins', )

if I went for multiple directories, I would have to create this group per directory, and then have the problems of account password maintenance (I don't think that groups can be shared across directories)

I may have thousands of sub domains for this application - so this mechanism is unmanageable

the second is that I can't see a way of specifying the callback urls for a directory - as I am creating sub domains on the fly it is not possible to log into the management console to set this option manually. All the directory properties need to be exposed to the rest API

from express-stormpath.

Hi @jmls

We do not have this level of granularity for the link that is generated by password reset. How other customers do multi tenancy with a single directory for password reset is to have a generic password reset page like demo.com/password-reset. This page will reset the password for the account who's token is generated for the original password reset request, it does not require the subdomain to work correctly. Another example of this is multi-tenant applications that have a generic login location of demo.com/login. The login page will take any valid username/password and could redirect once authentication is successful to the right subdomain.

Using this same technique for password reset, what you can do if you absolutely need to get the user to a subdomain for password reset (foo.demo.com/password-reset) is when the user clicks the link in the email:

demo.com/password-reset?sptoken=$TOKEN

You can use the token with application.verifyPasswordResetToken to verify the token and get the account. From here, you can check the account's groups to infer the subdomain and redirect them to foo.demo.com/password-reset?sptoken=$TOKEN

Let me know if this make sense.

You bought up the point where you could do this with directories, but you would need to create the directory and email templates correctly on the fly in code. Just FYI, this is something that we just put in the REST API, and we will be getting this functionality (ability to modify email workflows for directories) in the Stormpath SDK for Node soon.

Thanks!
Tom

from express-stormpath.

I think the end-solution for this is that when Stormpath adds the ability to update this on the fly, we can revisit modifying this functionality. But for now, @omgitstom 's suggestion is prolly the best way to handle things.

from express-stormpath.