905984 - Internal server error on login into marketplace

Status: RESOLVED FIXED

(Marketplace Graveyard :: API, defect, P1)

Description

[Raivis Dejus]

When trying to log into Mozilla marketplace with my persona account [e-mail] I get error 500
"NetworkError: 500 INTERNAL SERVER ERROR - https://marketplace.firefox.com/users/browserid-login"

There was exactly the same error for my account a few months ago but I can't find that bug right now

Comment 1

[Matt Basta [:basta]]

Where are you seeing that error? Can you provide steps to reproduce?

Comment 2

[Raivis Dejus]

Error is visible in the Firebug console when I try to log into with my persona account.

Today got additional error messages
"NetworkError: 500 INTERNAL SERVER ERROR - https://marketplace.firefox.com/api/v1/account/login/?lang=en-US&pro=8a7dd4dc.32.1&region=worldwide"
[req] Request failed: POST 500
[req] Error message: 'NoneType' object has no attribute 'backend'
[login] Assertion verification failed! INTERNAL SERVER ERROR 500


Steps for the bug:
1. Click Sign in on https://marketplace.firefox.com/
2. Choose my persona [e-mail] and wait for the login to complete
3. Error "Persona login failed. A server error was encountered." appears after the persona window closes and i see the errors above in the developer console

Comment 3

[Matt Basta [:basta]]

Sounds like an API error. There should be a sentry traceback associated with this, I'd imagine.

Comment 4

[Allen Short [:ashort]]

Looking at this account in the database, I'm seeing a different email address in `users` for this account ID from the gmail address mentioned here, which shows up in `auth_user`.

Comment 5

[Allen Short [:ashort]]

So here's what's happening:

Changing your email address on AMO changes `users` only, not `auth_user`.
so if you have an AMO account created with `[e-mail]`, and then later change it to `[e-mail]`, then users will have the new address and auth_user will have the old one.

When login via Persona is done, the lookup is done in the users table. So if I try to log into Marketplace with `[e-mail]`, no account will be found. The Persona login process then creates a new users entry, and then attempts to create an auth_user entry. But since our auth_user table has a unique constraint on email address, this will fail. Subsequent logins will fail because the users entry exists with no corresponding auth_user entry.

The solution I propose, short term, is to hunt for auth_user entries by email address when encountering this situation and point the user entry at them. I don't foresee any security issues here because persona login disregards passwords, the only other personal information on the auth_user entry.

Long term, of course, we should upgrade to Django 1.5 and jettison auth_user entirely.

Comment 6

[Andrew Williamson [:eviljeff]]

(In reply to Allen Short [:ashort] from comment #4)
> Looking at this account in the database, I'm seeing a different email
> address in `users` for this account ID from the gmail address mentioned
> here, which shows up in `auth_user`.

bug 878867  (I know you're already cc'd on that one Allen, but for other people)

Comment 7

[Wil Clouser [:clouserw]]

Thanks for the investigation.  Hooking them up manually sounds good to me.  Any idea on how many there are?  If you cook up some SQL or python I can help spot check.

Comment 8

[Allen Short [:ashort]]

Working on a patch now to do this at login time so the problem won't recur.

Comment 9

[Andrew Williamson [:eviljeff]]

(In reply to Wil Clouser [:clouserw] from comment #7)
> Thanks for the investigation.  Hooking them up manually sounds good to me. 
> Any idea on how many there are?  If you cook up some SQL or python I can
> help spot check.

using the sql in https://bugzilla.mozilla.org/show_bug.cgi?id=878867#c0 - 9238 now

Comment 10

[Allen Short [:ashort]]

https://github.com/mozilla/zamboni/commit/091b296

Comment 12

[Raivis Dejus]

I still have this error. 
Is there some time until the patch goes to production?

Comment 13

[Allen Short [:ashort]]

Yes. Give it a try on https://marketplace-dev.allizom.org/ in the meantime.