Problem/Motivation

I use this module in my current job, so I would like to have it well maintained. In particular, when we are ready to upgrade to Drupal 11, I would like to have a stable release on the 3.x branch.

I am happy to help as a contributor: issue triage, code review, fixing bugs, etc. But I notice that there are 11 RTBC issues on the 3.x branch, two of which have not been updated in more than a year. If it would help to add me as a co-maintainer to help with release management, then I an happy to do that as well.

I have experience with code review, automated testing, release management, and security. I am a member of the Drupal Security Team and a co-maintainer of the migration system (Migrate API) in Drupal core.

Steps to reproduce

Proposed resolution

My own priorities are to start with

so that automated tests are passing. After that, #3359789: Problems upgrading openid_connect 8.x-1.4 to 3.x looks like an issue that will affect me at work, and #3439448: Roadmap for a 3.x production release is the roadmap to a stable release. If there are other issues that the existing maintainers want to prioritize, then I will start there.

Remaining tasks

User interface changes

N/A

API changes

N/A

Data model changes

N/A

Comments

benjifisher created an issue. See original summary.

jcnventura’s picture

jcnventura
Primary language English
commented

Hi benjifisher,

I'm a former maintainer of this project, but mostly away from Drupal for 3 years now. Can you ask pfrilling to comment on this issue. I can grant you maintainer rights or he can. He's been maintaining it for a while, and I'd like to get his views on this.

This being said, the 3 years of being away from Drupal have led me to a very simple conclusion: the login system is mostly broken and forgotten in Drupal.. And by this I mean the fact that Joomla and just about any other piece of software out there support 2FA and passkeys out of the box, while Drupal only supports username and password, and anything that wants to do something more has to actively fight against core to workaround it. Most of the security bugs in all these packages arise from not doing a good job at the workarounds.

dpi’s picture

dpi
Location Perth, Australia
commented

the login system is mostly broken and forgotten in Drupal.. And by this I mean the fact that Joomla and just about any other piece of software out there support 2FA and passkeys out of the box,

Agree with the sentiment, core auth, user.module, needs a gutting.

benjifisher’s picture

benjifisher
he/him or they/them
Primary language English
Location Boston area
commented

I agree, too.

I am in a better position than most to do something about it, but I do not have time and energy for such a project.

A quick search turns up a few related core issues:

Each of those links to additional related issues.

Getting back to the scope of this issue, I will see whether @pfrilling notices this issue and comments on it. If not, then I will send a nudge on Slack or some other channel.

pfrilling’s picture

pfrilling
Location Minster, OH
commented
Status: Active » Fixed

I will happily take any help I can get @benjifisher! Thank you for offering. I agree with your sentiment that 3.x needs a stable release. Unfortunately, time is my biggest constraint, hence the lack of progress.

I've added you as a maintainer. Let's work together to get 3.x to the finish line!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.