Cannot log in to OSIO; getting stuck on fabric8 login

[rkratky]

Upon opening tab with OSIO, I got automatically logged out (happened same way in both Chrome and Firefox). When attempting to log back in (and after entering my log in credentials), I get redirected to:

Clicking on Review profile shows:

Clicking on Submit returns me to previous screen. On the previous screen, clicking on Add to existing account opens:

When trying to log in with my OSIO creds, I get:

Clicking on the Red Hat Developers button shows the first screen again.

[sbose78]

I've investigated that this is happening for some accounts after the RHD keycloak's upgrade.
I personally couldn't get in using my real @redhat.com account, but worked for one of my test osio accounts.

I've investigated the issue and found out that the impacted users' RHD UUID has changed. We need to check with the RHD keycloak team about this.

What that means is that RHD is sending a different user uuid now after the upgrade!

[sbose78]

I can confirm that logging in using the username works
Example, if my email address is [email protected] , i can login using abcd

[sbose78]

@rkratky can you check if you are able to login using your username and not email address?

[rkratky]

@sbose78, that doesn't work for me. When I click on LOG IN on OSIO homepage, I get directly to the ACCOUNT ALREADY EXISTS page (see 1st screenshot above).

[rkratky]

Explicitly logging out of RHD and then relogging (on RHD) with username only works for me, too.

[joshuawilson]

Is this still a SEV1?

[sbose78]

Bumped it down.

[sbose78]

Closing because having to log in using the 'username' is a feature.

[rkratky]

Closing

@sbose78 The behaviour is super-confusing. User getting redirected to the fabric8 pages, "account already exists", etc. -- is that all expected behaviour? I think users shouldn't see those pages at all, IMO.

having to log in using the 'username' is a feature.

That's a weird feature because other Red Hat websites have no problems with using e-mail addresses as usernames. I mean, we can document this, but I believe it would be a mistake to disallow e-mails for logging in.

[sbose78]

@rkratky I understand the inconvenience. However, I doubt there's something that can be done to avoid this user experience - since this is a RHD side change that triggered this. :)

[alexeykazakov]

I put Sev1 back until we fully understand what is happening and what we can do about this.
Current behavior doesn't seem to be acceptable to me atm.

[sbose78]

Agreed Alexey. Seems pretty weird to me, too.

[sbose78]

Based on the update from the RHD team, it is unclear how many people are affected. I already know that a some redhatters have not been affected, while some have. However, the assumption is that the number of folks affected are small.

"this is mainly problem for RedHat employees as redhat automatically creates multiple accounts with same email in customer portal for employee, and even account where email is used as username is created for employee."

I would like to test out the following scenarios

• Check if an existing non-redhat user is able to login smoothly.
• check if a new non-redhat user is able to login smoothly.
• Check if a new red hat user is able to login smoothly.

( red hat user = users with a @redhat.com account )

We can re-adjust severity based on the above, I think.

[cmoulliard]

If I use my "rh-gs-cmoullia" username, then I can log to "openshift.io" but
then it tells me that I'm still waiting approval

https://www.dropbox.com/s/b9kzq5282puldzh/Screenshot%202018-02-23%2019.04.50.png?dl=0

Can somebody approve my request please ?

[maxandersen]

If I use my "rh-gs-cmoullia" username, then I can log to "openshift.io" but
then it tells me that I'm still waiting approval

afaics your user account is [email protected] and that user was provisioned many months back. Was that account ever working ?

rh-gs-cmoullia looks like a complete new account ?

[cmoulliard]

I can access to openshift.io using as account [email protected]. Thanks

[alexeykazakov]

More details about this issue - https://gitlab.cee.redhat.com/dtsd/housekeeping/issues/1402

[sbose78]

This impacts OSO too .

[sbose78]

@pbergene @alexeykazakov now that we are not blocked with onboarding of users, should we re-consider the severity here?

We are in touch with Vlastimil regarding his code changes - which would take at least a week.

[pbergene]

Ack, I'll leave that to Alexey - I think it would be useful to keep it as a point on the triage call regardless (if not only to satisfy my curiosity ;))

[alexeykazakov]

@rkratky RHD has been updated with a fix for this issue. Can you please verify if it now works for you when you login using your email?

[alexeykazakov]

Login should now work for majority of affected users. We still can have issues with password reset for affected users and RHD team is working on the fix for the reset password thing. I de-escalated it to Sev-2. We are not blocked anymore.

[rkratky]

@alexeykazakov It works right away in Chrome. In Firefox, I first got the following:

But when I go directly to RHD and log in through there, then head back to OSIO and click on LOG IN, it goes through.

[sbose78]

Robert, that might be because of an existing session which conflicted. For a clean test, I would suggest you to close all incognito sessions, and then open only one incognito window - please try out the OpenShift.io login there.

…

On Sat, Mar 3, 2018, 00:04 Robert Kratky ***@***.***> wrote: @alexeykazakov <https://github.com/alexeykazakov> It works right away in Chrome. In Firefox, I first got the following: [image: weresorry] <https://user-images.githubusercontent.com/6623103/36915261-5af92b32-1e50-11e8-9cc5-cceda1425baf.png> But when I go directly to RHD and log in through there, then head back to OSIO and click on LOG IN, it goes through. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2332 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAhSAGFrgC1Nip1jfhwYej3HhBrEdgSuks5taZCGgaJpZM4SPIub> .

[rkratky]

@sbose78 It now works even without an incognito window. Thanks.

[kishansagathiya]

I am facing this issue on prod. Blocked on this.

[ldimaggi]

Just to confirm - you are seeing this issue TODAY? on https://openshift.io?

Was this working for you recently?

[sbose78]

Nope, this has been happening for a long long time ( since the RHD keycloak upgrade in March ). Fix was to:

• change the password
• login using the username

[sbose78]

should be fixed as part of fabric8-services/fabric8-auth#350

[mvulavak]

@sbose78 Is this still an issue?

[sbose78]

@mvulavak , No, once we have this merged fabric8-services/fabric8-auth#689 - other bits will fall in place easily.

[sbose78]

I mean - yes, still an issue :)

[sbose78]

@xcoulon / @sbryzak I think the token management ( native logout support ) were the only things remaining before keycloak could be pulled out, right? fabric8-services/fabric8-auth#350

[alexeykazakov]

@sbose78 here is the list of what left - #2772 (comment)