Page MenuHomePhabricator

Warn users when they get redirected from a logged-in local page to a logged-out auth.wikimedia.org page
Closed, ResolvedPublic

Description

Previously, login/signup happened on the same domain so if you were logged in when clicking the login link, you were logged in on the login form as well. (There is no login link on the UI when you are logged in, but there are help pages etc. with links. Both the login and signup page are meaningful while logged in - for switching to another account, and for creating an account for another user, respectively.) With SUL3 this is not the case anymore, and this is causing confusion, e.g.:
T391862: 'change password' link does not allow user to find the password reset page
T391324: Missing "send temporary password through email" option in Wikimedia SUL account creation

We should let the central domain know (probably via a URL parameter) that the user is expected to be logged in; when that is the case, there should be some warning message (and we should probably add an extra login redirection, ie. send them to the login page and set returnto / returntoquery to the login or signup page, and make sure RedirectingLoginHookHandler doesn't redirect them back).

See also:
T392359: Visiting Special:UserLogin to switch accounts doesn't work in SUL3
T389064: Notify WebAuthn users about SUL3 changes (T389064#10960666)

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change #1189618 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/CentralAuth@master] SUL3: Show warning upon redirect when logged-in locally but logged-out centrally

https://gerrit.wikimedia.org/r/1189618

Change #1189618 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] SUL3: Show warning upon redirect when logged-in locally but logged-out centrally

https://gerrit.wikimedia.org/r/1189618

Change #1215531 had a related patch set uploaded (by D3r1ck01; author: Derick Alangi):

[mediawiki/extensions/CentralAuth@master] Do not show central session expiry if it hasn't expired

https://gerrit.wikimedia.org/r/1215531

Change #1215531 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] SUL3: Show expiry message only if user isn't logged-in centrally

https://gerrit.wikimedia.org/r/1215531