1161585 - Add mozilla-japan.org LDAP account support to login.mozilla.org

Status: RESOLVED FIXED

(Infrastructure & Operations :: Infrastructure: LDAP, task)

Description

[Makoto Kato [:m_kato]]

See bug 1130190 comment #8

Although I create https://mozilla-japan.org/.well-known/browserid to use persona via mozilla-japan.org LDPA acount, login.mozilla.org doesn't support mozilla-japan.org LDAP account.

LDAP admin, could you add support of mozilla-japan.org LDAP account to login.mozilla.org??

Comment 1

[Justin Dow [:jabba]]

:mostlygeek: Is this something on the persona side that needs updated? I don't think there is anything on the LDAP side distinguishing these accounts from @mozilla.com accounts.

Comment 2

[Benson Wong [:mostlygeek]]

We search for users under two bases[1] for a match on mail or zimbraAlias [2]. We need a few attributes [3] which we later use to determine if we should sign them in or not. 

My guess is that the employeeType [4] attribute isn't right for mozilla-japan.org users. Though it could be something else in the checking logic [5].

[1] https://github.com/mozilla/vinz-clortho/blob/master/server/lib/configuration.js#L63-L64
[2] https://github.com/mozilla/vinz-clortho/blob/master/server/lib/auth.js#L138
[3] https://github.com/mozilla/vinz-clortho/blob/master/server/lib/auth.js#L139
[4] https://github.com/mozilla/vinz-clortho/blob/master/server/lib/auth.js#L318
[5] https://github.com/mozilla/vinz-clortho/blob/master/server/lib/auth.js#L314-L326

Take a peek at the code above maybe you can see something in the LDAP data that I can't.

Comment 3

[Justin Dow [:jabba]]

It looks like Japan employees have employeeType=JE in LDAP. That's probably the issue here?

Comment 4

[Benson Wong [:mostlygeek]]

Oh I see the issue. It's been a while since I worked on the code. I need to add a configuration to support mozilla-japan.org in the configuration.

Comment 5

[Makoto Kato [:m_kato]]

Benson, when does you fix this issue?

Comment 6

[Benson Wong [:mostlygeek]]

I was told that legal is involved. I'm currently blocked on that.

Comment 7

[Mika]

Hello, 

This is Mika from the legal team.  The reason this was blocked was because an NDA is required to have access to certain confidential information shared across Mozilla certain channels, for example information shared during the monthly internal MoCo meetings broadcast on Air Mozilla.  If there are mozilla-japan.org email account holders who have signed NDAs, then these individuals should have access to the restricted sites.  Otherwise, an NDA is required before access is granted.

Please let me know if you have any questions.  I'm based in our Mountain View office and happy to have a call to talk about this more.
Thank you,
Mika

Comment 8

[Makoto Kato [:m_kato]]

Mika doesn't reply our mail for our question.  set ni? flags

Comment 9

[Mika]

Hi, apologies for missing the email.  I just responded there.

Comment 10

[Mika]

Hi, updating this bug.  The Mozilla Japan employees finished signing the NDAs, so they can now get the requested access.  My understanding is that it might take a few weeks for the technical changes to happen.

Comment 11

[Noriatsu Kudo]

Mika,
Thank you very much!

Benson,
Please let me know, when I need to change server setting.

Comment 12

[Benson Wong [:mostlygeek]]

Mozidp will be updated next week to include mozilla-japan.org.

Comment 13

[Benson Wong [:mostlygeek]]

Support for mozilla-japan.org is now in Mozilla's IdP. 

However, https://mozilla-japan.org/.well-known/browserid must have "disabled" set to "false" for everything to work.

Comment 14

[:Atoll]

Reopening so we can have M-J set that to false and verify that this works for them.

Comment 15

[Noriatsu Kudo]

I've changed https://mozilla-japan.org/.well-known/browserid to "false" this morning and confirm that it is working fine now.

Thank you everyone!