🐛 [BUG]: [PAVICS] Password UI issues

[Zeitsperre]

Summary

This has come up a few times in the past year.

It's come up several times that a user with an existing account will create a new one in the event that they forget their password. When this happens, our survey of users needs to be cleaned up to remove the duplicate entries (which is really annoying, and I never actually do this; caveat emptor when using those statistics).

This could be fixed by either providing a means for someone to reset the password on their own via request to email (does Magpie support this?) or by suggest that they contact the PAVICS administrators.

It's also far too easy for users to miss the "To change your password" message found in the box at the top of the login page. It would be better if that message were found in the "Sign in" box instead. (The "password must be at least 12 characters long" comment should only be mentioned in Magpie when users don't provide a long enough password)

Details

Bug: Lots of request emails from people wishing to change their password or users thinking they need to fill out surveys to create accounts when they already have them.

Desired behaviour: Users can help themselves more.

Concerned Organizations

@tlvu @fmigneault

[github-actions]

Thanks for submitting an issue.
Please make sure to provide enough details for us to be able to replicate your issue or understand your question.

[fmigneault]

The "To change your password" message seems to be a custom login header that shows on the JupyterHub endpoint (ie: extra overrides applied in https://github.com/bird-house/birdhouse-deploy/blob/10128e58d51ca3e4b9e4022972944bfdd1f87556/birdhouse/components/jupyterhub/custom_templates/login.html.template). The current configuration cannot be placed in the "Sign in" box, but HTML/CSS could at least be improved in that header to make the login note more obvious. That would need to be done in the relevant override, though, which I do not have access to.

For the reset part, Magpie does not have an option for this currently since users must be logged-in in order for them to edit their own profile/password. A dedicated page would have to be created to add this feature. The temporary-token code used for the user-registration/validation feature could be reused to add this. In the meantime, admins can always replace the password of any user profile. Therefore, a password reset procedure could be provided in the login header to indicate how to email the system admin to reset with a temporary password.