Account Manager Setup

Accounts: Configuration

Step ${str(active + 1)}: ${steps[active].label}

Objective for setting Common Options

Trac sessions are authenticated per request based on browser cookies. Therefor a number of options control some critical browser cookie properties.

Authentication provider-agnostic options

Required if this Trac instance is only accessible through HTTPS.

Potentially troublesome for users with dynamic IP adress, but disregarded for persistant sessions.

Authentication front-end

You can still manage some password stores with AccountManagerPlugin, if you configure them in the next section.

AccountManagerPlugin provides a form-based login page, even integrating links to related actions:

  • Lost password/Password reset
  • Registration for new users

accompanied by its own, custom version of LoginModule.

If you enable this feature, you'll want to review and adjust some Trac options related to session authentication. Note, that AccountManagerPlugin's LoginModule changes the default value for auth_cookie_lifetime to 30 days.

AccountManagerPlugin authentication options

This is, user checks a "Remember Me" checkbox in the AccountManagerPlugin login form and, next time he visits the site within 30 days, he'll be remembered and authenticated automatically.

Step ${str(active + 1)}: ${steps[active].label} Password store icon

Objective for configuring a Password Store

AccountManagerPlugin manages user credentials in a modular back-end providing access to at least one password store. While store chaining works flawlessly, this advanced configuration scenario is not supported by the configuration wizard yet.

Authentication back-end

[x] Use a password store embedded into Trac db.

AccountManagerPlugin's SessionStore implements password storage in db table 'session_attributes'. Its the default choice mainly for avoiding additional dependencies like directory and file permissions. While great to resolve some concurrent access issues too, this password store has some shortcomings as well. Notably it does not support seamless hash type migration yet, and its no candidate for shared use by multiple Trac instances or even by applications beyond Trac.

Details
  • account-manager:hash_method [HtDigestHashMethod__]
    • account-manager:db_htdigest_realm [______________]
    • account-manager:db_htpasswd_hash_type [md5___________]
[_] Use a writable file-based password store.

AccountManagerPlugin includes native support for common Apache file formats 'htpasswd' and 'htdigest'. Note that setting appropriate directory and file permissions is cruicial for this password store, but not covered by this configuration wizard.

Details
  • [_] 'htpasswd' format

    HtDigestStore

    • account-manager:htdigest_file [trac.htdigest_]
    • account-manager:htdigest_realm [______________]
  • [_] 'htdigest' format

    HtPasswdStore

    • account-manager:htpasswd_file [trac.htpasswd_]
    • account-manager:htpasswd_hash_type [md5___________]
[_] Use a read-only file-based password store.

SvnServePasswordStore includes support for reading svnserve's password file format. This is another way to enable shared use of authentication data, but relies on independed management of the password file.

Details
  • account-manager:password_file [______________]

    Path to the users file, leave blank to locate the users file by reading svnserve.conf

[_] Delegate authentication using HTTP authentication.

AccountManagerPlugin enables use of standard HTTP authentication by its HttpAuthStore component. Both Basic and Digest authentication callenges are supported. Apart from being read-only this password store does even not support listing users for obvious reasons.

Details
  • account-manager:auth_url [______________]

    URL of the HTTP authentication service

[_] Use a different password store (requires manual configuration).

AccountManagerPlugin's modular password store concept encourages creation of even more ways to provide user credential beyond the natively supported stores. Setup assistance for these 3rd-party authentication providers is not implemented yet.

[_] Chain password stores (requires manual configuration).

Select the desired password stores and related options to enable concurrent use of multiple password stores. Order matters. This is merely a placeholder to skip further configuration details in this section if checked, or if a multi-store setup is detected in current configuration.

Details
  • account-manager:password_store [______________]

    Ordered list of password stores, queried in turn

Step ${str(active + 1)}: ${steps[active].label} Password refresh icon

Objective for Password Policy rules

While AccountManagerPlugin does not enforce password rules in general, there are some other ways to alter password handling.

account-manager:reset_password [_]

Enable the password reset procedure, that relies on a working email sender for Trac, supporting both TracAnnouncer and TracNotification

account-manager:generated_password_length [_8]

Length of the randomly-generated passwords created when resetting the password for an account

account-manager:force_passwd_change [_]

Force the user to change password after a successful reset

Step ${str(active + 1)}: ${steps[active].label} Account approval icon

Objective for Account Registration and Verification rules

You may require administrative approval of new accounts for the user registration process. The ability to immediately ban existing accounts is another, related but independed feature.

[_] Allow users to register for a new account. account-manager:register_check [BasicCheck, EmailCheck, BotTrapCheck, RegExpCheck, UsernamePermCheck]

Ordered list of checks to use for validating registration requests

All checks provided by AccountManagerPlugin are enabled per default, but some are configurable on their own, and checks like BotTrapCheck don't work at all without additional configuration

account-manager:require_approval [_]

Whether account registration requires administrative approval to enable the account or not

account-manager:verify_email [x]

Enable the email verification procedure, that relies on a working email sender for Trac, supporting both TracAnnouncer and TracNotification

Step ${str(active + 1)}: ${steps[active].label} Account guard icon

Objective for Account Protection rules

AccountGuard component provides additional protection. It is an add-on to AccountManagerPlugin's own LoginModule discouraging brute-force login attempts.

Step ${str(active + 1)}: ${steps[active].label}

Review your Configuration

Setup Initialization

Save the configuration and create one admin and one regular user account.