Bug 1436943 - Login fails with "Unrecognized identity" when using Google authentication #3210
Conversation
Presently, when you login with google you are prompted with a screen that tells you to login using another provider. However, if you try to login with google using an LDAP email "@mozilla.com", then there is a blank page saying Unrecognized identity.
helfi92
changed the title
| @@ -73,6 +73,8 @@ def _get_username_from_userinfo(self, user_info): | |||
| return "email/" + email | |||
| elif "github" in subject: | |||
| return "github/" + email | |||
| elif "google" in subject: | |||
There was a problem hiding this comment.
Should we be using .startswith() rather than checking if it's just a substring? Can there be user provided input at the end of the string?
There was a problem hiding this comment.
When you login with LDAP, the subject will be of the form: ad|Mozilla-LDAP|haali. In this case, startswith would fail here since Mozilla-LDAP is in the middle of the string.
There was a problem hiding this comment.
(This is pre-existing, so needn't block this PR)
There was a problem hiding this comment.
Yeah but we could either:
- use
.startswith('ad|Mozilla-LDAP|') - only use
startswith()on the others - not use
startswith(), but adjust the substrings used to include the pipe operator (which would make it harder to fake since not valid email character etc)
Anyway perhaps there is no risk here, just wanted to check given I don't know what possible user provided values can end up in subject :-)
CC @djmitche
There was a problem hiding this comment.
This is a good point. There's not a security concern here -- login uses a better approach -- but startsWith will be more effective against e.g., ad|Mozilla-LDAP|github@mozilla.com.
Presently, when you login with google you are prompted with a screen
that tells you to login using a different provider. However, if you try to
login with google using a "@mozilla.com", then there is a
blank page saying Unrecognized identity.
This commit will allow a user to login with Google when he tries to login with a
mozilla.comemail.