Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add files via upload #2302

Closed
wants to merge 1 commit into from
Closed

Add files via upload #2302

wants to merge 1 commit into from

Conversation

mgrep
Copy link

@mgrep mgrep commented Apr 6, 2018

Changed user password verification as it does not work with 2-factor authentication it will break changing users password also changed the default time-out from 15 minutes to a day because typing your password and 2-factor code every 15 minutes feels insane, credit to the advice of Andreas Böhler on this.

Removed unused authentication schemes and added 2-factor authentication.
Changed user password verification as it does not work with 2-factor authentication it will break changing users password also changed the default time-out from 15 minutes to a day because typing your password and 2-factor code every 15 minutes feels insane, credit to the advice of Andreas Böhler on this.
@phy25
Copy link
Collaborator

phy25 commented Apr 6, 2018

What's the reason that this should be merged into core? This seems like a customization.

@mgrep
Copy link
Author

mgrep commented Apr 6, 2018

It is a customization indeed.

The default setting of time-out are 15 minutes which seems a little short when writing documentation.
To me it seems ridiculous that you have to change this after a fresh installation of Dokuwiki especially first timers would not know this.

They will learn this after they write documentation and learn that when they want to save after an hour of work they have to log on again with a change of loosing some of the text they wrote.

This also seems the case with 2-factor authentication.

Why not change the default values for these things it seems unnecessary to keep old default values.

So maybe we should set this values higher as default ?

If you think this is foolish or not needed than please close this than I will keep these changes only for myself.

@selfthinker
Copy link
Collaborator

Something else must be wrong with your setup as according to https://www.dokuwiki.org/config:auth_security_timeout:

this will not automatically log out users. It simply rechecks their authentication credentials in the background.

@mgrep
Copy link
Author

mgrep commented Apr 8, 2018

So it is about semantics in tech.
To me the user it is annoying to type password and 2-fa every freaking 15 minutes or else work will not be saved.
I understand now that the setting is even more annoying it is intended for slow connections which is impossible to have in my country and it even does not log you out but let you retype your password whole the time.
I guess we are now in a time that must users of dokuwiki do have access to fast internet so maybe this setting need some change this is in my opinion not a good default setting as how it is now.
Also I do not think something is wrong with my setup I think it is working as intended.

Why do you think there is something wrong with my setup ?
Please elaborate.

@selfthinker
Copy link
Collaborator

I don't know for sure how it works but according to the documentation which I've linked above, this setting does not mean that people have to log in every 15 minutes. If that is the case with your setup, it is not working as intended, so something else must be wrong.

15 minutes is the default, and that default is also what it is set to on dokuwiki.org. But I only need to log into dokuwiki.org maybe once a year (probably even less). I have other DokuWiki instances, never changed that setting and never need to log in for at least a couple of months.

@mgrep
Copy link
Author

mgrep commented Apr 8, 2018

Do you use 2-fa ?

I will check this issue as it is on all my setups on 4 different machines.
Leave your documentation untouched for 15 minutes and if you want to save it shows a log in prompt before continuing to save.

@mgrep
Copy link
Author

mgrep commented Apr 8, 2018

https://www.dokuwiki.org/plugin:authg2fa

The other problem is periodic rechecking of the user's credentials. By default, DokuWiki tries every 900 seconds to check the password. As there is no current 2FA secret available by that time, the check will fail and the user is logged out. You can increase the Timeout to, e.g. 24h, by settings:

@selfthinker
Copy link
Collaborator

So, it seems normal for that particular plugin, but still not normal for how DokuWiki intended that setting to be used. I wonder if it could be fixed within the plugin? Did you try the other 2FA plugins if they behave the same way?
If this is a behaviour which cannot be fixed within a plugin, I wonder if there is something more fundamental going wrong in DokuWiki's authentication.

@mgrep
Copy link
Author

mgrep commented Apr 8, 2018

Good suggestion.
Did already tried another 2-fa plugin but can not remember if that problem was there also.
Will try another 2-fa plugin again and this time I will make sure to test it thoroughly and see if it behaves the same as the plugin I'm using now.

@splitbrain
Copy link
Collaborator

The 2fa plugin should at least increase the setting for you. But ideally it would use some other mechanism to determine if 2fa credentials need to be reacquired (aka. remember this computer). I'm closing this because it's not a core issue and should be addressed in the plugin.

@splitbrain splitbrain closed this Apr 8, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants