User:Clouserw/AMO/Auth
Current flow and challenges
User is given a single button for login/register and a link underneath for admins/editors. Regular users click the "log in/register" button, go through browserid flow, and are logged in. Privileged users click the link, are prompted with the local authentication form, and are logged in after that. This is a potentially confusing split for the end users and also leads to two code paths which I'd like to avoid. Security has made it a requirement that privileged users must give an additional token (with more requirements) before they are authenticated to AMO so browserid is not good enough.
Proposed Solution
- User is shown a login/register button that launches browserid
- User authenticates (regular users are done at this point)
- If User is privileged they are shown a second form with a single password field[1]
- User must authenticate here before they are allowed to continue. Failure to authenticate results in no session created.
This provides us with a single branch out of the "normal" flow but fulfills the additional requirements Security has requested.
[1] The single password field is for legacy reasons only. It would be possible to use other forms of verifying a users identity here also.