112870 - No warning if visiting a client auth site without a cert

Status: RESOLVED WONTFIX

(Core Graveyard :: Security: UI, defect, P3)

Description

[John Unruh]

1.) With a new profile, visit the above in-house client auth site.
What happens: "Your client is not allowed to access the requested object.", or 
what ever the server you are trying reach tells you.

What is expected: PSM should show a dialog box stating, as in 4.79 "The site 
'pki.mcom.com' has requested client authentication, but you do not have a 
Personal Certificate to authenticate yourself. The site may choose not to give 
you access without one."

Comment 1

[Stephane Saux]

This is not a new things for Moz is it?

Comment 2

[John Unruh]

nsbeta1

Comment 3

[Kai Engert [:KaiE:]]

Attachment: Wording only patch

I don't know when this can land, but getting the wording in already can't hurt.


This patch only adds the wording as it was used in Communicator.

Comment 4

[Kai Engert [:KaiE:]]

Sean, can you please review?

Comment 5

[Sean Cotter]

+NoCertForClientAuth=The site '%S' has requested client authentication, but you
do not have a Personal Certificate to authenticate yourself. The site may choose
not to give you access without one.

Suggested changes:
"The site '%S' has requested client authentication, but you do not have a
personal certificate that it can use to identify you. The site may choose not to
give you access without one."

Comment 6

[Kai Engert [:KaiE:]]

Attachment: Wording only patch / v2

Uses Sean's suggested wording.

Comment 7

[Kai Engert [:KaiE:]]

Comment on attachment 85778 [details] [diff] [review]
Wording only patch / v2

has r=cotter

Comment 8

[Kai Engert [:KaiE:]]

*** Bug 136715 has been marked as a duplicate of this bug. ***

Comment 9

[Kai Engert [:KaiE:]]

Attachment: Patch v3

Comment 10

[Kai Engert [:KaiE:]]

Javi, can you please review?

I think it makes sense to also display the warning, if the user did not enter
the correct password, since in that case the user does also not have the
required certificate available.

Comment 11

[Javier Delgadillo]

we decided to take this dialog out after 4.x

It was decided that the web site should tell the user how to remedy the problem
of not having a cert.  Possibly with a page that tells the user where and how to
get a cert.  This was also done to create a better user experience for SSL/IMAP
since it was quite annoying to have the client tell the user it couldn't find a
cert after the user canceled a password request during SSL authentication.

Unless our philosophy on this has changed, I don't think we should fix this.

Comment 12

[Kai Engert [:KaiE:]]

Stephane, can you please decide, and if you agree with Javi, mark this bug as
wontfix?

Thanks.

Comment 13

[Stephane Saux]

What does IE do?

Comment 14

[Kai Engert [:KaiE:]]

IE 5.5 does not show a warning.

Comment 15

[Stephane Saux]

Ok, I wasn't aware of the history behind this. This is a P3 bug, and Javi thinks
we should do nothing. Hence let's not spend time on this until we've worked on
higher priority bugs. That said, I have the following comments:

Certainly I think that sometimes I'd like to be warned that the site has
requested a cert and that none was found (this could happen when the app tries
and finds a cert, but there are none suitable). I would also like to be warned
when a cert is presented to the server, and the server returns a SEC_*_ERROR
because the cert was not suitable (or at least I believe that it's the way it
happens).

Kai, when you have time to work on this, you may want to test a little with
various configuration of web sites and ssl/imap servers, and ssl/smtp.

Maybe we can come up with a solution that gives better feedback without becoming
annoying.
Maybe we can control this behavior with a pref.

Comment 16

[Javier Delgadillo]

I would be fine with a pref that was off by default.

Comment 17

[John G. Myers]

Can we not close this bug out as WONTFIX?

Comment 18

[Kai Engert [:KaiE:]]

Ok, marking wontfix.