612746 - [tracker] Login and Logout

Status: VERIFIED FIXED

(support.mozilla.org :: Users and Groups, task, P1)

Description

[James Socol [:jsocol, :james]]

Users need to be able to log in and out through Kitsune. (We can also remove the Tiki session support.) This involves a few steps, so filing as a tracker for now.

* Logout (should be pretty self-contained).
* Wipe out any currently stored passwords in auth_user.password.
* Switch to using Fred's SHA-256 auth backend (we'll never have a better chance than right now).
* Remove Tiki session detection and models.
* Auth fallback (see below).
* A login page that does all this.
* The login page should robustly support a destination parameter.

We can look at django-registration for it's auth but can't use it because we don't use Django templates.


Auth Fallback:

Check the user's password normally, against the hashed data in auth_user.password.
  - Success? Win!
  - Failure? Check the user's password against the old tiki password.
    - Failure? Login fail!
    - Success?
      - Use the plaintext to populate auth_user.password with the SHA-256 hash and permanently erase the old, insecure hash.

Comment 1

[James Socol [:jsocol, :james]]

All blockers resolved!

Comment 2

[Rebecca Billings [:rbillings]]

Verified login/out with new users and also old tiki users.