As per title:
* user logs in with OpenID, which (in many cases) sets username and email address
* user edits their account to change their "local" password
* user logs out

User is now able to login in using their newly created "local" password.

Ideally, openid-created accounts would not be able to edit their local password.

Comments

walkah’s picture

walkah commented
Assigned: Unassigned » walkah
Category: bug » feature

This is likely better as an option ... and one of the things I want to look more closely at in the future. However, disabling user/password logging in does have some side effects like making it unable to recover your account if your OpenID goes away, etc. An OpenID is not an account..

Switching this to a feature.

moshe weitzman’s picture

moshe weitzman commented

Yeah, I think closing the door on the local account can be a bad idea. I know that the presence of this field can be confusing though.

pancho’s picture

pancho
Location UTC+2 🇪🇺 EU
commented
Version: 6.x-dev » 7.x-dev

Won't fix in D6, let's implement it in D7...

mchelen’s picture

mchelen
he/him
commented

Yes it should be optional, for some cases it would not be advisable, in others the benefits can outweigh the problems.

heine’s picture

heine commented

User is now able to login in using their newly created "local" password

I don't understand why this is an issue.

heine’s picture

heine commented
Status: Active » Closed (won't fix)

Summary: An OpenID is not an account.