lshift/diffa — Issue #21: Allow external only users to be configured
Author: paulj
Created: 2012-01-09 23:29:18+00:00
State: open

With the external user support added in #12, we'll frequently want to configure users that can't log in via the Diffa builtin authentication, but instead through some external mechanism. Currently, we'd suggest the password be set to something like "sha256:1234" which is an unachievable password (as it specifies a hash that can never be generated). This isn't particularly self documenting though.

Instead, it should be possible to configure a user without a password attribute, but with an external="true" attribute. This would result in no password being stored for the user, thus making external authentication the only avenue for them. Note that without external="true" on a user, then the password would still be required - setting this flag is essentially an acknowledgment that the password was deliberately omitted.