1232193 - switch from persona

Status: RESOLVED WONTFIX

(Input :: General, defect)

Description

[Will Kahn-Greene [:willkg] ET needinfo? me]

Input uses Persona for accounts on Input. We have the following requirements:

1. authentication
2. (nice-to-have) it's nice to not have to deal with storing passwords
3. some access levels of Input really require that access is revoked when said persons leave employment or other Input responsibilities

The third one was solved nicely by Persona with the LDAP bridge thing it had.

My understanding is that Persona is going away in the next year or two, possibly sooner or later. We should at least have a plan in place for how to redo authentication before then. Sooner is probably better.

Comment 1

[Ryan Kelly [:rfkelly]]

> Persona is going away in the next year or two, possibly sooner or later.

Specifically, we hope to decommission it come end of November 2016.  Can I be of any help in coming up with a migration plan here?

Comment 2

[Ryan Kelly [:rfkelly]]

Also FYI, I'm trying to collect information about migrating away from Persona on the following page: https://mana.mozilla.org/wiki/display/Identity/Persona+migration+guide+for+internal+sites

Comment 3

[Gene Wood [:gene]]

:Osmose,

In advance of the shutdown of Persona on November 30th[1], I was hoping to both find out what was planned, in regards to authentication, as well as offer up assistance and alternatives if needed.

Firstly, I'm hoping to communicate with either the developer/development team capable of modifying the authentication code for the site or the manager responsible for the site. If I've made this request to the wrong person, please let me know, and feel free to ignore the questions below. If you happen to know who the right person is and can share that with me even better.

If you'd prefer to just have a short discussion over Vidyo instead of writing a response, that's totally fine, either say so and I'll set it up or send a calendar invite to me to chat.

* Has an alternative authentication solution been selected for the site, if so what is the new planned auth solution?
* Is there a timetable and resources to complete the development of the change before November 30th?
* Would you like any help in coming up with an alternate auth solution? We have reference architectures for a handful of frameworks. If so, either schedule a Vidyo call with me or I will schedule one with you.
* How would you characterize your site's userbase? Do users that login currently consist only of people with Mozilla LDAP accounts? Do Mozilla contributors/community also currently log into the site? Does the general public log into the site?
* Since your currently using Persona for auth I'm assuming that your site doesn't have access to metadata about users stored in LDAP (e.g. first and last name) or access to LDAP group information of users (e.g. what Mozilla team they're in). Would your site benefit from this type of information if it were available in the new auth solution?
* Does your site accept other login methods beyond Persona currently (e.g. github, mozillians, google+) and if so which ones?
* Do you currently take advantage of the branding capabilities[2] of Persona which allow you to put your site's logo or site name in the Persona login popup? Do you have requirements for your replacement auth solution related to branding? A specific example around branding is the fact that the Firefox Accounts auth solution has "Firefox" branding associated with the login process which may or may not be acceptable to you for your site.


[1]: https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers
[2]: http://identity.mozilla.com/post/27122712140/new-feature-adding-your-websites-name-and-logo

Comment 4

[Osmose [:osmose, :mkelly]]

Keeping the NI on here, but just wanted to note that I am the correct person and I'll be thinking about this more post-London.

Comment 5

[Ryan Kelly [:rfkelly]]

Hi :Osmose, any further updates on the status of Persona here?

Comment 6

[Osmose [:osmose, :mkelly]]

Yes! We choose surprise option 3: Input is going to be decommissioned.

Comment 7

[Ryan Kelly [:rfkelly]]

Thanks :Osmose!  Is there a tracking bug for the decommission that I can put in our Persona-EOL bug tree in place of this one?

Comment 8

[Osmose [:osmose, :mkelly]]

There's bug 1315316.