openwisp / openwisp/openwisp-users

[feature] Allow expired-password users with social login to remove their Django password

Open
#546 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
179
Forks
96
Avg merge
13h 40m
Merged PRs (30d)
16

Description

⚠️ Not suitable for beginners

Is your feature request related to a problem? Please describe.
An admin user can have both a local Django password and a connected social account. When password expiration is enabled and the local password expires, the user is forced into the password-change flow even if they intend to use social login only.

Describe the solution you'd like
When an authenticated admin user reaches the expired-password flow and already has at least one connected social account, show an additional option to remove the Django password entirely.

If the user chooses this option:

  • the local Django password should be cleared or replaced with an unusable password,
  • the account should remain connected to the existing social account(s),
  • future logins should rely only on social authentication,
  • the user should not be prompted again to update a password for password-based authentication.

This would be especially useful for admins who initially signed up with email/password and later migrated to SSO-only access.

Additional context
Relevant behavior already exists for password expiration redirect and password update flows in the admin and account views, so this feature would extend the current expired-password handling rather than replace it.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Trace the existing expired-password redirect and password-update flows in the admin and account views. Add an option for authenticated users with connected social accounts to remove the Django password while preserving social connections, then verify that future logins use social authentication without another password-update prompt.

Written by the indexing model from the issue text.

Assessment

Tech stack
django, python
Domain
authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.