Re: [Gnumed-devel] Managing staff (user accounts)

[Karsten Hilbert]

On Mon, May 30, 2011 at 07:14:44AM -0700, Jim Busser wrote:

> > MD5, yes. Actually, the password isn't really stored anywhere. Only
> > its (salted) hash.
> 
> so… an encrypted form of the salted hash?

I am not sure whether the hash is encrypted. The question
would be how to meaningfully do that.

> Also, any user should want to be able to alter their own password. Is it 
> possible for them to be able to do this through the
> 
>       Edit staff list
> 
> dialog? Maybe add a line with
> 
>       Password: < >   New password: < >       Re-enter new password: < >
> 
> and, if they cannot now alter it without knowing
> 
>       gm-dbo
> 
> then let them at least input the information and, if all was ok with the 
> three password fields above, then evoke the prompt for an administrator to 
> supply the gm-dbo password, with the instruction:
> 
>       Please get your database administrator to authorize this change:

That's a wishlist item.

Karsten
-- 
GPG key ID E4071346 @ gpg-keyserver.de
E167 67FD A291 2BEA 73BD  4537 78B9 A9F9 E407 1346