So our auth is handled by a third party service provider, so they handle the uniqueness of usernames etc and give us a cookie which we use with the session sharing plugin to create Nodebb accounts using that cookie which populates the Nodebb Username with the Auth Provider Username. I have a requirement for select groups e.g. internal staff to be able to change their visible username on Nodebb while having the Auth Provider Username still as their main username in their data. This is to prevent Bad Actors harassing users on the third party service. My initial thought was to create a plugin that hooks in and alters the display name attribute of the user data which would work but the users userslug would still be a slugified version of the Auth Provider Username which would defeat the point of the display name. Could do with a display userslug or a hook in the getDataFromUserSlug methods to convert display user slugs to actual user slugs from a data map in a plugin. Could be a feature request to add such a hook if its considered a good approach? Another thought was to allow Nodebb username editing but save the Auth Provider Username as a different piece of information on the user data record (for moderation visibility). The issue with this is if someone changes their username for example "A User 123", then a user on the Auth Provider Service joins our site with exactly the same username, then it would clash and cause errors or start adding an extra index to the name which isn't ideal. Is there anything I'm missing that could do what I'm looking for or does anyone have another approach I can try.

Yeah, it's Sørensen–Dice - though note that it wasn't really some well considered choice - I implemented it as part of an assignment earlier and just went with it because of that. I thought it might do a bit better than Levenshtein distance from my quick reading of a few articles related to discriminating identity based on username which suggested substring based algorithms are doing better for that task (LCS/GST for example). I'll probably add phonetic similarity to the mix in the future, and perhaps actually do some tests to see what makes most sense (and the future is most likely February...)

v3.10.3 Latest

Buy Hosting

Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you have been placed in read-only mode.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

Question about SSO and username/userslug uniqueness

Unsolved Technical Support

21 Posts 5 Posters 2.5k Views

U Offline
U Offline
uplift
replied to julian on last edited by

#21

@julian A quick (hacky) test seems to work. Ill have a deeper dive tomorrow and see if I encounter any issues. Thanks for the hook pointer.
1 Reply Last reply

0