822491 - Handle forced auth via Persona in webpay

Status: RESOLVED FIXED

(Marketplace Graveyard :: Payments/Refunds, defect, P1)

Description

[Kumar McMillan [:kumar]]

To reset PINs (bug 802646), webpay needs to use the upcoming forced authentication feature in Persona. When that is available, this bug is to configure webpay's Persona login with the right flags.

Comment 1

[Wil Clouser [:clouserw]]

(In reply to Kumar McMillan [:kumar] from comment #0)
> To reset PINs (bug 802646), webpay needs to use the upcoming forced
> authentication feature in Persona. When that is available, this bug is to
> configure webpay's Persona login with the right flags.

Any news on availability or a place to watch?

Comment 2

[Austin King [:ozten]]

The API forceAuthentication is ready for integration and can be tested from http://notoriousb2g.personatest.org/

Example usage: Bug#808831 Comment#3

https://github.com/mozilla/browserid/pull/2692
https://bugzilla.mozilla.org/show_bug.cgi?id=808831
https://bugzilla.mozilla.org/show_bug.cgi?id=811012

Comment 3

[Wil Clouser [:clouserw]]

-> andy, but cvan might be better if he's working in that area

Comment 4

[Kumar McMillan [:kumar]]

Note that the forced issuer settings are different than comment #2. See this commit for the working settings https://github.com/mozilla/zamboni/commit/837aa96c423b6a22754b474f4128b81df13c8528

Comment 5

[Andy McKay]

I'm flopping all around uselessly like a dead fish on this. We chatted on irc and you said something like this I think. But it's unclear to me: what I'm doing here, what is meant to happen under different conditions.

Here's the WIP: https://github.com/andymckay/webpay/commit/c16af7

Can we expand this bug a bit to list what is meant to happen?

Comment 6

[Kumar McMillan [:kumar]]

Fixed in https://github.com/mozilla/webpay/commit/15badacfb0ede3fbf94bd1fc3ad59f4315e00ed9

There is a security issue that needs to be addressed in bug 836060 and the enforce_sequence decorator needs to be re-enabled in bug 836049