Draft: dissallow amiv accounts to sign into the api.

vseth persona accounts are unique by having a - in the unsername. by not allowing any accounts containing a - in the username we can ensure that no persona is signing into the api. This has mainly become a problem with people blindly using password managers.

could this potentially cause problem with guest-accounts??

amivapi/auth/sessions.py

@@ -173,9 +173,12 @@ def process_login(items):
 
         # If the username matches an ethz email address, we just take the part
         # before the @ as the username for the authentication against LDAP.
-        if re.match(r"^[^@]+@([^@]+[.]{1}){0,1}ethz.ch$", username):
+        if re.match(r"^[^@\-]+@([^@]+[.]{1}){0,1}ethz.ch$", username):
             ldap_username = username.split('@', 2)[0]
 
+        if re.match(r"^.*[^\-].*", ldap_username):
+            raise ValueError("invalid username. please use a normal account, not a amiv account")
+        
         # LDAP
         if (app.config.get('ldap_connector') and
                 ldap.authenticate_user(ldap_username, password)):