1466635 - LDAP error logging in to Mozillians

Status: RESOLVED FIXED

(Participation Infrastructure :: Phonebook, defect)

Description

[Todd J. Troxell]

Attachment: Mozillians Mozilla Community Directory.png

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36

Steps to reproduce:

1) Recieve slack access invite and click link to join https://mozillians.org/group/slack-access/

2) Asked to log in to mozillians by receiving an email

3) Click log in link in recieved email and am presented with strange LDAP error - see screenshot.  

"Please use one of the following authentication methods: LDAP Provider"

My account is [e-mail].


Actual results:

Unable to log in


Expected results:

Log me in :)

Comment 1

[Todd J. Troxell]

Update: I've tried to use 'log in with google' (same email address [e-mail]) and I think now things are further messed  up- I can get into this new [e-mail] via google but I can not use my old nickname "xtat" so presumably I now have two accounts.  One of these is inaccessible and the "new" one doesn't have my old data.

Also when I try now to log in to my old account via email address, it says I can only use the "more secure" google method to access this account.

I think I have exhausted options on my end- just for clarity, I just want to get in to my original account (the one with the strange LDAP error) I do not need a second one.  Thanks.

Comment 2

[Henrik Mitsch [:hmitsch]]

Hi Todd,

sorry for the long delay.

The LDAP account we refer to is [e-mail]

Did you recently leave Mozilla? If yes, please let us know in this ticket. We will then:

* Clean out that LDAP identity from Mozilla IAM.
* Then we swap your login email from [e-mail] to [e-mail]
* Lastly you need to login with either Github+2FA or Firefox Accounts+2FA to be able to join the slack-access group. Is that possible for the [e-mail] email?


PS: I deleted the Mozillians profile you created using the [e-mail] address via a Google authentication provider.

Best regards,
   Henrik

Comment 3

[Todd J. Troxell]

Hello Heinrik - no worries, and yes I departed Mozilla 2018-05-01.

All of that sounds good. Let me know when I should try it and thank you for digging into this.

-Todd

Comment 4

[Henrik Mitsch [:hmitsch]]

Hi kang and jabba,

we have a Pocket Staff member who left Mozilla and wants to continue to login to Mozilla IAM.

Can you please remove/deactivate the Auth0 identity [e-mail]?
This way Todd will hopefully be able to login using [e-mail].

Best regards,
   Henrik

Comment 5

[Guillaume Destuynder [:kang] [this account is no longer active]]

@hmitsch it sounds like mozillian.org is doing an account matching internally which prevents the login. I've opened https://github.com/mozilla/mozillians/issues/2403 to look at this.


In the mean time i've removed the entry [e-mail] from auth0 which i believe should make mozillians.org not block anymore (though, this is just a guess)

@todd please let me know if this works for you

Comment 6

[Todd J. Troxell]

Hi folks -- had a min to test and here's what happens now:

Chrome: 
1) login at [e-mail] by email
2) system says it needs to send me an email
3) click link in email
4) Sorry, you may not login using passwordless email. We require login to be performed using the most secure method available for your account, which is Google.

FF60:
1) Click login link
2) No choices - just "Attempting auto-login with google-oauth2"
3) " Please use LDAP Provider as the login method to authenticate "

Comment 7

[Henrik Mitsch [:hmitsch]]

Hi Todd,

please accept my sincere apologies for letting this drop. 
Thank you VERY MUCH to Syam who is a super-active Mozilla volunteer and chased me down on this!

Todd, I removed your former LDAP identity from the Mozillians.org IdP profiles.
This means you should now be able to login using Google as identity provider.

Could you please try this.

And unfortunately there's one more thing: You are part of the NDA Group. We require you to use either Firefox Accounts (with 2FA) or Github (with 2FA) to allow you membership of the NDA group.

Could you be so kind and add one of these identities providers to your profile?

Best regards,
   Henrik

Comment 8

[Henrik Mitsch [:hmitsch]]

Closing bug.