My site forces users to log in with a specific OAuth provider for some reasons. Users should not be able to log in using their username and password pairs. Only the site managers can have accounts independent of OAuth.
When first creating an account with OAuth, the 'pass' field is set to an empty string ''. My first question is whether it is the right and most secure way to prevent logging in using password.
The second question is about requesting new password via email. I implemented hook_menu_alter to customize
user/login and to unset
user/password. Now users cannot access
user/password, I wonder if there is a bypass for it. This question is less important since almost all users would never bother with or even know the possibility of requesting new password.