Produits Entr'ouvert » Authentic 2

Currently there is an automatic redirect to the next parameter or the LOGIN_REDIRECT_URL setting when user is already logged and is accessing the login page. It has two unfortunate consequences:

• when you are already logged but are redirected to the login page for missing a permission, it creates a redirection loop
• it's impossible to require an higher level of authentication (for example to request SSL authentication in a login/password opened session)

So the login page should always be shown but when coming from views requiring some specific permissions, there should be an error message shown explaining the missing permission. It should also be possible to restrict the used frontend for authentication.