Login: Switch Auth method in existing bookmark

[jesmrec]

This is the scenario:

1. User adds a basic auth bookmark
2. Server admin enables OAuth2
3. User go to "Edit bookmark"

At this point, the user (whose credentials have not changed) does not know anything about the the availability of a new and more secure authentication method.

User have edited anything so, the Save and Cancel options keep the same status as before and the bookmark keeps the basic authentication instead of OAuth2.

Discussion started here:

#38 (comment)

So, this is an open forum to discuss

[jesmrec]

About @felix-schwarz thoughts:

as a user I feel I should be able to make a change to f.ex. the name without being forced to upgrade the authentication mechanism.

absolutely agreed. One step over (out of the topic)... changing the Server Name and changing the credentials/auth method could be performed over different actions. So, the user would be able to change the server name itself, forgetting credentials or auth.

I can see the clear security win for users to upgrade to a better mechanism if one is available, so the check could be made when hitting "Save", but only lead to a suggestion - and not be forced upon the user.

Users who don't edit their bookmarks wouldn't benefit from this, however, so… maybe we should periodically check available authentication methods in general and tell the user if something better is available.

Using the Save button to notify that other options are available is a good option. i think in another one, that is checking the URL at the time the Edit view is opened and notify in case OAuth2 is available (is it feasible?). Also, taking advantage of the Delete Authentication Data option to point the user to input credentials again.

In case we want to notify everywhere (not only in Edit mode), this would be an extra ball (option not available in current iOS app either). Periodically checks sounds to branding option (how often do you want i notify you that something new happened on the other side?)

This specific case will depend on how the core admin deals the change of auth method. In the worst case (core admin, who is a very lazy person, changes to OAuth2 and neither notify nor explain users how to proceed)

IMHO, the usual scenario would be

• Server with basic auth
• Admin enables OAuth2
• Admin notifies the change to all users by using internals (mail, phone, personally...), and points the users to Edit credentials, giving them the specific instructions to perform the change.

If we would assume this, the current issue could be closed. The point is... would we?

[michaelstingl]

Current state of all ownCloud platforms:

1. We don't actively migrate from basic auth to OAuth2 (yet)
2. We don't actively ask users to choose the login method (both basic auth and OAuth2 sound scary)
3. If I add a new account to a client and the server supports OAuth2, it is created with OAuth2