Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add "reset team passcodes" button to admin page #98

Open
skandix opened this issue Oct 26, 2021 · 2 comments
Open

Add "reset team passcodes" button to admin page #98

skandix opened this issue Oct 26, 2021 · 2 comments

Comments

@skandix
Copy link
Contributor

skandix commented Oct 26, 2021

It would be nice if the token for a team on multi-juicer, could be stored in the metadata regarding the pod. So if everyone in the team forgot their team pincode, they could ask admins of the cluster to recover it by checking the metadata for the team pod.

Like one can for the admin password, as seen in the attached picture.
But have the option to attach team pincode to its pod.

image

@J12934
Copy link
Member

J12934 commented Oct 26, 2021

Hi 👋

I understand the problem, I don't really like the proposed solution.
Passcodes are currently hashed (bcrypt and stored in the annoations of the teams deployments), also storing them in plain text would make the hashing worthless and would be something I try to avoid in a plattform used to teach security best practices 😅 (yes the admin passcode is currently also stored in the cluster unhashed, we might also want to at least provide the option to pass in a bcrypt hash of the password instead of the plain text value)

As alternative solutions to the problem I'd sugegst:

  1. Add a "Reset Passcode" button to the admin page, to generate a new passcode for a team. Passcode resetting already exist but is only available to the teams themself (which requires at least one logged in team member)
  2. Automatically store the passcodes of the teams in their browsers local / session storage and automatically allow them to join teams where they have the tokens stored.

Would these alternatives also solve your problem?

@skandix
Copy link
Contributor Author

skandix commented Oct 26, 2021

  1. Would probably be the best solution

@J12934 J12934 changed the title Displaying team token as an environment variable in k8s. Add "reset team passcodes" button to admin page May 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants