912481 - Persona login is not using LDAP bridge

Status: RESOLVED WORKSFORME

(Marketplace Graveyard :: Integration, defect)

Description

[Andrew Williamson [:eviljeff]]

If I try to login to Marketplace (on either Destkop, Android or FxOS) the login for my @mozilla.com email address is not using mozilla LDAP authentification, but is instead falling back on the old password I had previously.

Logging in to a private etherpad (not on the same profile) correctly uses LDAP during the persona login sequence.

Comment 1

[Christopher Van Wiemeersch [:cvan]]

A few days ago, we totally were. This was regressed with this commit, which went out yesterday:

    https://github.com/mozilla/fireplace/commit/cb53c2f#L0R66

Kumar, evidently setting an unverified issuer disallows us from using the Mozilla LDAP authentication. I don't know enough about Persona to know whether that's expected behaviour - but yeah that's what's happening here.

Comment 2

[Kumar McMillan [:kumar]]

This is not a regression. We removed the primary bridging capabilities because it is not possible for Firefox Marketplace to support it. Why not? Because we *also* support unverified accounts so that the user can unbox a phone and make a payment. We had to disable primaries because of this potential exploit: bug 910938

What this means for users is that they will always log in with the same username and password on both desktop and Firefox OS. As of 9/3, on desktop, users may be prompted to create a username/password if they have never used Firefox OS before.

Before we fixed this, certain users were locked out of Firefox OS entirely because their login did not work. See https://github.com/mozilla/browserid/issues/3842

Comment 3

[Kumar McMillan [:kumar]]

TLDR; as long as we support allowUnverified=true in at least one place we have to use forceIssuer *in all places*