Will create a feature to capture Small Q1 2019 updates.

mod-login in its current form does two things:

• It serves as a CRUD endpoint to manage credentials for user ids

• It serves as an endpoint to request and return a JWT given a submitted username/password, which is checked against stored credentials.

Things like password reset could be managed by any service that has the appropriate permissions to write to the credentials store. Things like contact email and the like could be referenced from the user module. What we don't currently implement is any kind of "security question" information associated with credentials.

We're also not currently implementing anything to track password re-use. This would require an additional field to store past salt/hash pairs to check against new input.

As to whether SSO could completely replace username/password auth, I think theoretically yes. The main job of the login process is to return a usable token based on some kind of auth challenge. Whether that be password or SSO, it really should not matter.