Provide a self-service tool for end users

Finally getting a chance to think about the self-service tool for usermerge.

One obstacle that might arise in the scenario painted above (providing both username and password for both accounts) is that someone may have lost one of their passwords, or might not be sure they remember it correctly. There might not be a way to verify that the password they think is correct actually is, as in the drupal.org/gdo merge where users can no longer login to gdo with their secondary username.

Rather than asking the user to enter the username and password for both ID's, the self service tool could just ask them to enter the username and password for their main username (the one they can login with, i.e., the drupal.org username/password), and just provide the secondary username, with no password for that username required. To confirm the merge request, an email would be sent to the email address associated with the secondary username. The user would have to click a link in the email to confirm that they indeed requested the merge, and that they want it to be completed. Then usermerge would go ahead and move the secondary username's subscriptions, memberships, etc. over to the main username. To make the tool site neutral (good for more than just drupal.org/gdo), it could use terminology like "primary username" and "secondary username".

The person submitting the form would have to know the password for the primary username and have access to the email address registered with the secondary username. That seems like a pretty good criteria for legitimacy (and the whole link-in-an-email confirmation process is familiar to most people from sites that send such emails to confirm subscriptions, registrations, etc).

Does that make sense? Anyone else want to help with this?

See #2201727: Call for testers: Self-Serve User Merge. (It's actually not in dev, but in a separate branch. Hoping to merge it to dev soon.)