Devise Admin View password

[Saravanan P]

Hi Everyone

i am using devise for authentication for my app.

Is there any way, Admin user can view other users password as normal string.

Without storing there password as string in database?

Please advise.

[Jérémie Horhant]

Hi,

With Devise vanilla config it's not possible. You should look to custom
encryptor
(https://github.com/plataformatec/devise/wiki/How-To:-Create-a-custom-encryptor)
with reversible encryption. But you should really don't
do that, it's a security breach and client private life violation. As a
sysadmin for many years now I've never seen a good reason to keep
password readable.

> --
> You received this message because you are subscribed to the Google
> Groups "Ruby on Rails: Talk" group.
> To post to this group, send email to rubyonra...@googlegroups.com.
> To unsubscribe from this group, send email to
> rubyonrails-ta...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msg/rubyonrails-talk/-/_YLbCKXtQbEJ.
> For more options, visit https://groups.google.com/groups/opt_out.
>
>

[Saravanan P]

Ok  thanks Jérémie Horhant :)

--

Regards by

Saravanan.P

[Colin Law]

On 7 January 2013 06:39, Saravanan P <sarav...@shriramits.com> wrote:
> Hi Everyone
>
> i am using devise for authentication for my app.
> Is there any way, Admin user can view other users password as normal string.

Why would you want to do that?

Colin

[Saravanan P]

In my case, Admin user can create many different sub-users. And he can view their password too.. :(

--
You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group.
To post to this group, send email to rubyonra...@googlegroups.com.
To unsubscribe from this group, send email to rubyonrails-ta...@googlegroups.com.

For more options, visit https://groups.google.com/groups/opt_out.

--

Regards by

Saravanan.P

[Colin Law]

On 7 January 2013 07:59, Saravanan P <sarav...@shriramits.com> wrote:
> In my case, Admin user can create many different sub-users. And he can view
> their password too.. :(

That does not explain /why/ he needs to be able to view the passwords.

Colin

[Saravanan P]

As a admin he can create many sub user and he will email user detail to the person who going to use that with application.

[Jérémie Horhant]

Here it is, the huge security hole... Mails are sent in clear text and virtually anyone can read it.

I suggest you to generate a random password when an admin create a sub user. Then in the same time send it by mail with obligation to
change it when the user login

Or the simplest solution, generate a random password and don't send it. So the password is "lost" and when the user will want to login he can use
the "Forgottent password" link. Simple (all is ready in Devise) and secure

[Walter Lee Davis]

I recommend you never set a password for a user. Instead, use the very flexible Devise Invitable module to create a user without any password set, and the requirement that s/he create a password before logging in. The only thing sent to the new user is a cryptic token link (and these time-bomb out after a definable time). As an admin, I do not want to be in the business of knowing (or having to remind my users of) their passwords -- that's what the "I forgot..." link is for!

Walter

> <jeremie_horhant.vcf>

[Saravanan P]

Ok Thank you walter.