The Launchpad user registration/login/reset has been broken for many months. As a subscriber to all launchpad bugs and questions, I can see there is a problem, but as a person who works with the Launchpad Registry team, I feel powerless to fix this. I think this sense of confusion is common for all the users and developers of Launchpad. Can the people with some knowledge take some time to elaborate and correct our common understanding of what is wrong and what can be done to fix it.
The crux of the problem is that Launchpad does not manage identity and
credentials. Launchpad does not know who you (the person reading this)
is, nor does it want to. Launchpad relies on Ubuntu's Single Sign On
service to tell it which Launchpad profile you are at the moment.
I think login.launchpad.net is part of the problem. It misleads users to
think Launchpad is managing user credentials. This site is really Ubuntu
SSO.
What Happens When You Login
---------------------------
Here is a summary of the 3 parts that are in play when you login:
Site: Ubuntu-SSO -> Lp-internals -> Lp-mainsite
Team: ISD-hackers Lp-foundations Lp-registry
Domain: user authentication person (profile)
Analogy: driver requisitioning car
Users register with SSO. User can login to many sites. When you login to
Lp, the site asks SSO who you are. Lp uses the identity information from
SSO to select 1 of the 1 million modeled persons be your profile. Your
profile's id and or your email address are used to select the profile
you will become.
Mismatched Identities
---------------------
This implies that SSO and Launchpad need the same email address
information to consistently select the profile to match the credentials
you provided, but that is not going to happen, *ever*.
While Launchpad discourages users from having multiple profiles, many
chose to. Many users do not know they many profiles because Lp created
them from imported email addresses. It can be a lot of work try to get
Launchpad to know all your email addresses belong to one profile. You
may also have many identities in Ubuntu SSO. The email addresses between
the SSO identities and Launchpad profile can be mismatched. Try drawing
the lines between the email addresses; it seems like a miracle when you
login and actually get the profile you expect!
One human being
/ \
SSO Lp
Identity_1 Profile_1
email_1 email_1
email_2 email_3
Identity_2 Profile_2
email_3 email_2
email_4
Profile_3
email_5 (in wrong state)
/me runs screaming from the room.
User Issues
-----------
* People report they have not receive a confirmation emails for
registration or reset. This is usually a spam filter or grey
list issue that is outside the control of Lp or SSO. But, users
start asking for help from Lp staff in email and IRC. We forward
the users to https://forms.canonical.com/lp-login-support/
eventually. Why eventually? because many engineers are not aware
that Launchpad is using Ubuntu SSO. I have been asked twice in
the last 8 weeks to look up logintoken information that cannot
possibly exist in a Launchpad DB.
* People report they do not have Lp profiles (Lp ids). Launchpad
does not know their name or their email address--the user has
clearly never been to Launchpad. Some users were direct to
register at login.launchpad.net/+new_account which is not
Lp...the user never visited Lp and started login.
* People have asked me to delete their account information. I
cannot delete Lp profile information, but that is not the real
issue. The person is not registered with Launchpad, so there is
nothing that could be deleted
! Clearly state that registration/login/reset is SSO
* I am appalled when I see a user login with a profile with a
mangled Launchpad Id. "-deactivatedaccount" and "-merged" were
by deactivation/merging to free the profile namespace and
provide a visual indication that no one can be this profile. Yet
that is not so any more. I am also dismayed to read oops reports
involving users without email addresses (because the address is
in the wrong state). Launchpad has sane rules to ensure Ids were
fixed and emails restores when a profile was reactivated via
login/reset.
! The act of authentication must guarantee sane ids and
preferred email address.
* User report their profile is wrong after they deleted an email
address in Lp. It have been suggest to never delete email
addresses, but hide them so that profile matching is not broken.
I do not want to do this *again*. I just fixed the bugs where
teams were not deleting email addresses. When I loose control of
an email addresses, I want it deleted. I do not want someone to
assume my identity. Maybe we can warn the user if the address
was used in authentication. Maybe we can add a rule to
disassociate the address from the profile and start a
confirmation process to restore it when the user first
authenticates with it.
* Users report their profile page is broken...we can see an broken
openid interaction in an oops. I have not idea what is broken or
how to fix it I believe some cases were fixed by direct SQL
manipulation of openid information and email addresses.
? Would this be a problem if Launchpad stopped being a proxy for
SSO? Could Lp removed the XRDS and RP supprt?
--
__Curtis C. Hovey_________
http://launchpad.net/
signature.asc
Description: This is a digitally signed message part
_______________________________________________ Mailing list: https://launchpad.net/~launchpad-dev Post to : launchpad-dev@lists.launchpad.net Unsubscribe : https://launchpad.net/~launchpad-dev More help : https://help.launchpad.net/ListHelp
