Page MenuHomePhabricator

Allow login in with pre-rename username and password
Closed, ResolvedPublic

Description

As a user who has been renamed during SUL migration
I want to login with my old name and password
So I can continue to use the wiki

As a user who has been renamed during SUL migration
I want to know that I was renamed
So I can learn my new name and/or ask for a new name

Given that I authenticate with "username" and "password"
When "password" is not valid for "username"

AND "password" is valid for "username~<WIKI>"

Then I am logged in as "username~<WIKI>"

AND I am redirected to the SUL account renamed page

Given that I am logged in
When I am redirected to the SUL account renamed page
Then I am told my account was renamed to NEW_NAME

AND I am asked to log in using that name in the future
AND I am told how I can get my new account renamed
AND I am told why all this happened
AND I am given a link to the page I wanted to visit

Version: master
Severity: enhancement

Details

Reference
bz67995

Related Objects

View Standalone Graph
This task is connected to more than 200 other tasks. Only direct parents and subtasks are shown here. Use View Standalone Graph to show more of the graph.

Event Timeline

bzimport raised the priority of this task from to High.Nov 22 2014, 3:30 AM
bzimport set Reference to bz67995.
bd808 created this task.Jul 14 2014, 5:14 PM

Change 147020 had a related patch set uploaded by BryanDavis:
Allow login with pre-rename username and password

https://gerrit.wikimedia.org/r/147020

Change 148420 had a related patch set uploaded by BryanDavis:
[WIP] Interstitial notification page for renamed users

https://gerrit.wikimedia.org/r/148420

Change 156887 had a related patch set uploaded by CSteipp:
[WIP] Allow extensions to indicate rename during login

https://gerrit.wikimedia.org/r/156887

Change 156947 had a related patch set uploaded by CSteipp:
Check for renamed user on login

https://gerrit.wikimedia.org/r/156947

I added a few patchsets (gerrit 156887 and gerrit 156947) to add a hook to core and use that in CentralAuth to fix the remaining use case that Bryan's patch didn't cover. This feels ugly, but I'm not sure we have a better solution.

On a separate note, I wanted to document that this feature has slight security implications. Since we're automatically changing the username on login, there's a small (nearly impossible, but not entirely) chance we'll change it to the wrong username, if two users have the same password. This would be the same if pre-finalization, a local user came to a wiki and "accidentally" logged into another person's account who happened to have the same username and password.

Highly unlikely to have any real impact, but wanted to bring it up in case it bothers anyone.

(In reply to Chris Steipp from comment #5)

On a separate note, I wanted to document that this feature has slight
security implications. Since we're automatically changing the username on
login, there's a small (nearly impossible, but not entirely) chance we'll
change it to the wrong username, if two users have the same password. This
would be the same if pre-finalization, a local user came to a wiki and
"accidentally" logged into another person's account who happened to have the
same username and password.
Highly unlikely to have any real impact, but wanted to bring it up in case
it bothers anyone.

I think I pointed that out somewhere, but maybe it was only as discussion in a meeting. It is a fairly small new hole as the two users that are being confused must be USER and USER~wiki. Meaning the USER~wiki account is now exposed to brute force attacks on the USER account's password.

Change 156887 merged by jenkins-bot:
Allow extensions to indicate a username doesn't exist

https://gerrit.wikimedia.org/r/156887

Change 147020 merged by jenkins-bot:
Allow login with pre-rename username and password

https://gerrit.wikimedia.org/r/147020

Change 156947 merged by jenkins-bot:
Check for renamed user on login

https://gerrit.wikimedia.org/r/156947

Change 148420 merged by jenkins-bot:
Interstitial notification page for renamed users

https://gerrit.wikimedia.org/r/148420