<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Hi Nyall</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Wow, these are really great improvements! Thanks to you and Ale for taking care of this!</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Regards</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Tim</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Fri, Feb 7, 2025 at 4:56 AM Nyall Dawson via QGIS-PSC <<a href="mailto:qgis-psc@lists.osgeo.org">qgis-psc@lists.osgeo.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">PSC,<br>
<br>
I'm writing to provide an update on the grant for QEP 289 --<br>
Authentication system revision (v1.1)<br>
<br>
This work is now complete. After in-depth review and discussions<br>
between Alessandro Passotti and myself, and in-depth peer-reviews of<br>
the submitted changesets, the entirety of the proposal from<br>
<a href="https://github.com/qgis/QGIS-Enhancement-Proposals/issues/278" rel="noreferrer" target="_blank">https://github.com/qgis/QGIS-Enhancement-Proposals/issues/278</a> was<br>
deemed acceptable and has been now been merged into QGIS for 3.42.<br>
<br>
This grant resulted in the following changes to the authentication framework:<br>
- Passwords are now automatically synchronized with the system<br>
keychain whenever a user changes their master password within QGIS.<br>
Previously, this was a manual step which the user was required to do<br>
themselves, and failure to do this step would result in an unreadable<br>
authentication store. (see <a href="https://github.com/qgis/QGIS/pull/55227" rel="noreferrer" target="_blank">https://github.com/qgis/QGIS/pull/55227</a>)<br>
- On systems with keychain support (i.e. Windows, Linux) we now<br>
automatically create a cryptographically secure random master<br>
authentication password and store it in the keychain for all new user<br>
profiles. This means that an out-of-the-box new QGIS install will<br>
immediately have a usable authentication store ready to go, with no<br>
manual user setup required. (see<br>
<a href="https://github.com/qgis/QGIS/pull/55144" rel="noreferrer" target="_blank">https://github.com/qgis/QGIS/pull/55144</a>). Note that this is not<br>
functional on Mac OS builds due to lack of notarization (see<br>
<a href="https://github.com/qgis/QGIS/issues/46175" rel="noreferrer" target="_blank">https://github.com/qgis/QGIS/issues/46175</a>), Note that this logic can<br>
be disabled for enterprise installs via settings ini configuration.<br>
- When a QGIS user opts to change their master password and they are<br>
using the default randomly generated keychain password, we no longer<br>
prompt them for the existing password. This makes password change<br>
operations more user-friendly, as the user will not know what this<br>
random password was (unless they are knowledgeable enough to retrieve<br>
it from the system keychain!). See<br>
<a href="https://github.com/qgis/QGIS/pull/55228" rel="noreferrer" target="_blank">https://github.com/qgis/QGIS/pull/55228</a>)<br>
<br>
There was also an additional work item completed as part of this grant<br>
which was not in the original proposal -- a round of UI tweaks were<br>
made around password handling, including:<br>
<br>
- Avoiding use of hardcoded English strings for the password wallet/keychain<br>
- We don't confusingly offer to backup the authentication database if<br>
non-sqlite storage in use<br>
- We now require the new password to be confirmed in the Reset<br>
Password dialog, so that users who make a typo in the new password<br>
aren't permanently locked out of the db!<br>
(see <a href="https://github.com/qgis/QGIS/pull/60441" rel="noreferrer" target="_blank">https://github.com/qgis/QGIS/pull/60441</a>)<br>
<br>
Overall, this grant has resulted in a better out-of-the-box experience<br>
for both users and QGIS plugin developers who require secure storage<br>
of credentials within QGIS.<br>
<br>
Thanks again for the opportunity to work on this!<br>
Nyall<br>
_______________________________________________<br>
QGIS-PSC mailing list<br>
<a href="mailto:QGIS-PSC@lists.osgeo.org" target="_blank">QGIS-PSC@lists.osgeo.org</a><br>
<a href="https://lists.osgeo.org/mailman/listinfo/qgis-psc" rel="noreferrer" target="_blank">https://lists.osgeo.org/mailman/listinfo/qgis-psc</a><br>
</blockquote></div><div><br clear="all"></div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div style="color:rgb(34,34,34)"><img src="https://kartoza.com/files/tim_ai_mugshot.jpg" width="96" height="96"><br></div><div style="color:rgb(34,34,34)">Tim Sutton</div><div style="color:rgb(34,34,34)"><b>Kartoza Cofounder<br></b><span style="color:rgb(32,33,36);text-align:center">Tim is a member of the QGIS Project Steering Committee</span><b><br></b></div><div style="color:rgb(34,34,34)"><b><br></b></div><div style="color:rgb(34,34,34)"><b>T </b>: +27(0) 87 809 2702 <b>E </b>:<b> </b><a href="mailto:tim@kartoza.com" style="color:rgb(17,85,204)" target="_blank">tim@kartoza.com</a> <b>W</b> : <a href="http://kartoza.com/" style="color:rgb(17,85,204)" target="_blank">kartoza.com</a><br></div><div style="color:rgb(34,34,34)"><br></div><div style="color:rgb(34,34,34)"><div><img src="https://ci3.googleusercontent.com/mail-sig/AIorK4wjeTRcj_LuA-mCKKqWOvHMPBgOOW2yAJl0VmVp633nbuz-9CB_jVZDCPLCovRQAuGIGQyHe3xLHI1H"><br></div><div><br></div><i>This email and any attachments are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you </i><div><i>have received this email in error, please notify the sender immediately and delete it from your system. Unauthorised use, disclosure, or copying</i></div><div><i>of the contents is prohibited.</i></div></div></div></div>