1130190 - How are mozilla-japan.org accounts authenticated by Persona?

Status: RESOLVED FIXED

(Cloud Services :: Server: Identity, defect)

Description

[Richard A Milewski[:richard]]

Some changes were made to Persona a while back to ensure that revoked mozilla.com LDAP accounts would no longer authenticate.

As a result of that we are able to use Persona to authenticate staff members for access to restricted content on Air Mozilla.

Is that also true for mozilla-japan.org accounts?

Are there any other domains for which the behavior mimics that of mozilla.com?

Comment 1

[Jared Hirsch [:jhirsch] (he/him) (Needinfo please)]

According to the repo, mozilla.com and mozillafoundation.org are the supported domains. Based on the contributors graph, I'd say mostlygeek is your person to needinfo with any followup questions.

https://github.com/mozilla/vinz-clortho
https://github.com/mozilla/vinz-clortho/graphs/contributors

Comment 2

[Richard A Milewski[:richard]]

Is it possible to have Persona handle mozilla-japan.org accounts the way mozilla.com and mozillafoundation.org accounts are handled, or are they outside the scope of mozilla's LDAP.

Comment 3

[Benson Wong [:mostlygeek]]

Does mozilla's LDAP handle authentication for [e-mail]?
If it does, then supporting it shouldn't be too difficult

Comment 4

[Richard A Milewski[:richard]]

Jabba,

Can you answer Benson's question?

Comment 5

[Justin Dow [:jabba]]

Yeah, they are in LDAP in the o=com OU, alongside the @mozilla.com accounts.

Comment 6

[Benson Wong [:mostlygeek]]

If they're in the LDAP we should be able to update mozilla-idp to search it. 

:jabba would the search base be(o=org, dc=mozilla-japan)?

Comment 7

[Justin Dow [:jabba]]

o=com,dc=mozilla

Comment 8

[Benson Wong [:mostlygeek]]

Thanks :jabba. 

:richard it should *just work* when this works: https://mozilla-japan.org/.well-known/browserid 

That URI should return this json: 

{
    "disabled": false,
    "authority": "login.mozilla.org"
}

Which is what https://mozilla.com/.well-known/browserid returns.

This will delegate Persona log in to the Mozilla-IDP service. Since @mozilla-japan.org domains in o=com,dc=mozilla the ldap search should find it and authenticate as expected.