Connection doesn't require username

[dleeward]

The "Requires Username" setting should be turned on when the database connection is created.

[dleeward]

Also, when a user enters an illegal username (containing a space), Lock highlights the field but does not give an error message indicating that you cannot use a space.

[dleeward]

Actually, spaces are not illegal in the WordPress username (login name) but the Lock widget seems to think so.

[glena]

hi @dleeward

The "Requires Username" setting should be turned on when the database connection is created.

if you complete the initial setup wizard, the database connection is created with requires username enabled.

Also, when a user enters an illegal username (containing a space), Lock highlights the field but does not give an error message indicating that you cannot use a space.

This is not handled by the plugin, this depends on Auth0 and Lock, I am checking with the team.

[glena]

About the username validation, it is in the backlog of the team working on the lock widget, I don't have an ETA tho. Can you submit an issue in this repo https://github.com/auth0/lock?

[dleeward]

if you complete the initial setup wizard, the database connection is created with requires username enabled.

It didn't for me, but maybe I did something wrong.

[dleeward]

In auth0/lock#375 (comment) @hzalaz says

@dleeward we are going to fix the missing message error soon (#374).
About allowing spaces in usernames, currently the Auth0 API has the following restrictions regarding usernames:

Username can only contain alphanumeric characters and '_'.
Username cannot have more than 15 characters.

So even if we allow spaces the server, the request to signup will fail because of this.

How are usernames with spaces imported into Auth0? Although the first 15 characters of the "nicename" might be legal in Auth0, we are still going to have issues with usernames being different between the WordPress database and the Auth0 database and the potential for duplicate usernames if only the first 15 characters are used. It appears that the native limit is 60 characters.

[dleeward]

I received an answer from @hzalaz at auth0/lock#375 regarding this. They will not be modifying the Auth0 API to allow spaces in the username. This will definitely break the migration functionality for a subset of users since the WP API doesn't allow changing the username (although we have done it in mySQL without any issues). Using a truncated version of nicename with the hyphens converted to underscores could be an option, but the usernames will be different in WP and Auth0 and will likely cause user confusion.

Maybe you need to add code to check for duplicate usernames and illegal characters (from Auth0 standpoint) in the username and allow us to display custom messages to the user on how to resolve the issue.

[dleeward]

I also just realized that all of the WP user accounts we have generated from importing users from Facebook will fail as well. Facebook uses a 16 digit GUID and we add FB to the beginning which totals 18 digits.

[glena]

You are right about how the usernames are imported into Auth0. Is not common to have spaced in the username so we never bump into this issue.

I will check it and see how I can make it work (probably I will need to convert it into a slug) but still the length should be cut off. As hzalaz said, the Auth0 API will not be changed since we need to assure backward compatibility to our customers.

The idea of this issue was to add an error message to lock to explain what is wrong with the username.

About your specific use case, I guess you might need to update the usernames on the database or move to use just emails for login.

[dleeward]

The problem with just using emails for login is that WordPress requires a username to signup. Is there an option for Lock to display the username field for signup but not ask for it at login?

[glena]

There is a setting for that in the appearance tab:

that changes this attribute in the lock config https://auth0.com/docs/libraries/lock/customization#usernamestyle-string-

[dleeward]

It is already set for email. The issue is that Lock allows a user to enter the username which won't work for users that have illegal usernames: