When a user creates an account on the site that generates an automatic email message which mails them their login information, this user is then logged into their account via an intermediary screen with a "Login" link and is then presented with a message explaining that they should reset their password...
However, when navigating to the "Edit" menu within their profile, the form also requests their current password. These users have no current password that they hace access to, which is effectively breaking the process of signing up for the site for those individuals, as well as making password resets nearly impossible to make. For instance, here is the message our system currently sends.
user3,
A request to reset the password for your account has been made at
yourdomain.com.You may now log in by clicking this link or copying and pasting it to your
browser:https://yourdomain.com/user/reset/complicatedstringofrandomnumbersandlet...
This link can only be used once to log in and will lead you to a page where
you can set your password. It expires after one day and nothing will happen
if it's not used.
The frustrating part is, once they click that link they are asked, via another system message, to reset their password, but are brought to another screen asking for their current password...
What am I missing here in this loop? I know it's configuration error on my part...but I haven't found it yet.
Comments
The default email includes a
The default email includes a generated password
The problem is the password
The problem is the password comes through as "Password: Your Password" and that password is not working for anyone.
When a new user clicks the
When a new user clicks the link in the registration message they go to a screen with a link to log in.. The screen they arrive at has blank password fields where they enter their NEW password.
I agree that the message and instructions could be better - I have edited my registration message to read
"Password: The password you will create after using the above link."
The problem is, users aren't
The problem is, users aren't getting that screen. They're getting a login link and are simply brought to the front page and asked to set their password. Attempting to edit through the profile leads them to a form containing a field for a "Current Password." There's our stop gap. Something, somewhere, is getting derailed. For my part, I have not done anything to change the normal registration process. I added logintaboggan to try and clean this up, but this didn't help much either.
At a loss :(
So, I took this step by step
So, I took this step by step this morning.
I navigated to domain.com/user and requested a new password. I was told that further instructions would be emailed to me.
I checked my email and see this system response:
That link takes me to a screen which provides a login link, but no password boxes. I click "Login" and am returned to the front page with this message:
I navigate to the profile page to "edit" and change my password, there is a current password field which will not allow me to change my password, as that current password is obviously unknown.
I'm simply baffled by this...
Struggling with this one.
Struggling with this one. Anymore help would be greatly appreciated. As it stands right now, the user experience on this site is poor and the registration process is effectively broken.
After using a one-time login link on another site I just deployed in D7 I get right to the edit page with the password fields present, yet this one redirects me to the frontpage and gives no such option.
Not sure where or how this
Not sure where or how this was created, but I found a redirect rule which contained only one condition and dominated the login redirection process, effectively rendering any other redirections moot. Very strange and extremely problematic. I worry where this rule came from as I did not create it myself...
Logintoboggan?
Logintoboggan?
I haven't really used that
I haven't really used that module before this project, so I'm not familiar with it. It very well may have been the culprit...
Thanks for the help.
Re-direct rule was causing this problem for me
I had a redirect upon authenticated login, which was also causing this problem. Once redirect disabled, issue is resolved.
Now when someone login in they are greeted by their profile page, not exactly what I wanted to display.
Gary