The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.It would greatly enhance security if there was an option to force username even if the registration form is not disabled ie. it is shown to the end user after TUPAS authentication.
So, I propose this:
- In the TUPAS registration settings add an option to force username auto-generation
- When this is enabled, do not display username field to end user during registration
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | 2863747.patch | 10.18 KB | tuutti |
Comments
Comment #2
tuutti commentedI'm not opposed to this idea, but I'm not sure how this would enhance security. Could you clarify a bit?
Comment #3
softone commentedOK.
So, for a normal site this current behaviour is just right since the user can use TUPAS authentication to nicely login and choose whatever username they choose.
But for a site that wants to depend on users giving strongly verified identity on registration, the behaviour explained above would indeed enhance security.
(EDIT: On a side note, it would also be nice to be able to support assigning directly to different user roles for users using TUPAS authentication thus diffirentiating them from users not using TUPAS for registration)
Comment #4
softone commentedI've edited out the brain fart from the previous comment. Sorry for that. (And it seems the edits don't trigger an email notification.)
Comment #5
tuutti commentedI guess this makes some sense, especially if the service provider does not want to provide any way to identify the user.
Comment #7
tuutti commentedThis is fixed on the latest dev release. I'll push new alpha release once I have fixed the other issue you created about rules support.
Comment #8
softone commentedThank you for the fix.
However, this is now generating a random username. It would make more sense to generate an username from the information provided by the TUPAS authentication, just like when the registration form is disabled. Now just letting the user edit other user info, but not touch the username field.
Comment #9
tuutti commentedThat makes a lot more sense. I misunderstood what you originally meant.
Comment #10
softone commentedSorry, my bad. I should have mentioned the username provided by TUPAS authentication in the first place :-)
Comment #13
tuutti commentedThis should be fixed on the latest dev release.
Comment #14
softone commentedI can confirm that username forcing works correctly with the current dev.
Comment #15
tuutti commented