Almost all parts of ReCodEx system is available only after authentication. For this purpose JWT tokens are used but in normal usage users do not have to worry about them, because web application does this. With this stated it is obvious that there has to be some registration mechanism and some web form in which users can fill their credentials and stay logged in for up-coming moments.
Registration into ReCodEx can be done two ways: using our own authentication service or pick some of the external ones. Currently there is only one external authentication mechanism which is CAS (Charles University Authentication Service). During registration user has to choose instance to which he/she wants to belong to (This is why registration using CAS has to be separated from simple login). This choice cannot be undone with current username and thus has to be done properly, based on instance user will see groups available in chosen instance.
In normal authentication using ReCodEx proper password has to be provided. There are certain checks if password is suitable and can be accepted otherwise user cannot register. Passwords are hashed, salted and stored in database, so nobody can see or decode them. This of course means that if user loose his/hers password it cannot be retrived and forgotten password mechanism has to be used.
Login form is like registration divided into ReCodEx authentication and external service authentication. User should use whatever mechanism was used during registration. All authentication forms should be simple and require only proper combination of username and password.
Works only for ReCodEx authentication mechanism for external authentication services please use their forgotten password mechanisms. After request for resetting password user should get email delivered to email address specified in user's profile. In mentioned email there should be link on change password form which can be used for password reset and setting of new one. Please note that access to change password link is time limitted for security sake and can be used only for couple of minutes.
