By joedom on

Friends,

I'm trying to find out the best way to allow authenticated users to have the same password that I will supply (hardcode into the system). They will have a low "read/only" privilege level, but I don't want them to share the same login name (so I can log them). The reason for the common password is to make it easy to remember and administer for them.

There will be three user classes:

anonymous - which will only see the home page
authenticated - which will have accounts, but share a password
admin - will manage the site and have all privileges

Example:

User wants to access the site and they've already been told what the common password is. They should be able to request an account, validate the email, and then login with the common password.

I was looking at the Password Policy module in the hopes it would allow me to set a RegEx restriction on the password and achieve the desired affect, but it doesn't work that way.

Any ideas on a module to use or where I should modify the code and/or database?

Thanks,

Joe

⋅ Categories: Drupal 6.x

Comments

nevets’s picture

nevets commented

Seems to be a large variation from how Drupal works with little gain, why not just use the standard registration process, those people would have low privilege levels (role = authenticated) and only assign the admin role to those who need it.

joedom’s picture

joedom commented

Agreed, but the customer wants all (role = authenticated) users to have the same generic password. We were already planning to "manually" promote users to admin on a need-only basis.

Do you know where in the code all of that is controlled - the generation of passwords, processing of it, etc?

Joe

nevets’s picture

nevets commented

There are in my opinion times to push back on the client, this is one where I would.

What do logged in people gain access to over people who are not logged in?

I would assume something or there's no reason to have people log in.

Using a common password is not at all secure and if you block/remove a user they can probably guess how to get back in.

If you look under download >> modules and search for password you should find something that would help you achieve this. Note you need to block them from entering the password in the first place, the ability to edit on the user edit page, disable 'Request new password' and have a way to change all passwords.