gerrit openid login: osmocom.org vs. projects.osmocom.org

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/OpenBSC@lists.osmocom.org/.

Neels Hofmeyr nhofmeyr at sysmocom.de
Mon Mar 20 04:30:52 UTC 2017


Has someone made osmocom.org login redirect to projects.osmocom.org?
Because since recently I observe this:


I go to osmocom.org, click on "Sign in".
It *redirects* me to projects.osmocom.org/login.
I log in.

I go to gerrit, enter, as always

  https://osmocom.org/openid

I get another login screen, this time on osmocom.org without 'projects.'
Interesting, there seem to be two realms, maybe from cookie rules.

Ok then, I add projects to the openid, for gerrit login:

  https://projects.osmocom.org/openid

and it works, nice.

However, now I seem to be logged in as a kind of ghost of my user. I'm logged
in as 'nhofmeyr at sysmocom.de', but no patches are on my page and I don't have
the voting nor admin permissions I normally have.

When instead of clicking on "Sign in" on osmocom.org redmine, I *manually* enter
  https://osmocom.org/login
(omitting projects.), I can login on osmocom.org and my gerrit user works out.

I notice that with projects.osmocom.org I am user ID 1000073,
while with osmocom.org I am 1000005.

In the gerrit user database, I see distinct user IDs:

▶ ssh go 'gerrit gsql -c "select * from account_external_ids where account_id = 1000073 or account_id = 1000005"'
 ACCOUNT_ID | EMAIL_ADDRESS         | EXTERNAL_ID
 -----------+-----------------------+--------------------------------------------
 1000005    | nhofmeyr at sysmocom.de  | https://osmocom.org/openid/user/91
 1000005    | NULL                  | username:neels
 1000073    | nhofmeyr at sysmocom.de  | https://projects.osmocom.org/openid/user/91

When I manually patch up the 1000073 to 1000005 in the last row, both openid
URLs work out to the correct user.


So gerrit potentially gets confused by one and the same user, fails to match
the email addresses rather than the openid provider.

Looking at the other registered users, most use the osmocom.org and not
projects.osmocom.org, so you all may be susceptible to the same issue.

I also see that four have entered http:// as openid, without SSL, which seems
to me is something we should rather not allow.

For example, laforge's user is shadowed in the same way just because of the non-https:

 1000004    | laforge at gnumonks.org  | https://osmocom.org/openid/user/7
 1000021    | laforge at gnumonks.org  | http://osmocom.org/openid/user/7

If redirecting to projects.o.o is intentional and the way to go (TM), I should
probably pre-empt problems for existing users by creating external ids with
'projects' in the openid url, pointing at the proper existing users.

Otherwise we should avoid magical forwarding of osmocom.org logins to
projects.osmocom.org.

~N
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.osmocom.org/pipermail/openbsc/attachments/20170320/8b677aea/attachment.bin>


More information about the OpenBSC mailing list