Just a heads up that Trac (our bug tracker @ dev.haiku-os.org) has been connected with our Single Sign-On portal. It should (hopefully) just work like magic. If it doesn’t, here is a handy flow chart.
We have around 20 years of poorly groomed accounts in Trac, and y’all like to change emails and usernames a lot. Some users could lose the connection between Trac identities and their SSO logins (especially if your username AND email don’t match between Trac and sso.haiku-os.org.
If you have any major issues, feel free to reach out. We can hand-fix issues as they pop up.
Accounts i’m dropping since the usernames have spaces : 18
Accounts I created in SSO because they only existed in Trac: 308 (you’ll need to verify your email and reset your password)
Accounts with weird control characters, no email set, or never created comments or tickets: ~2k
If your account didn’t have an email set in trac, we may be able to hand-reattach it as long as you can verify your identity. No you cannot take-over other user’s accounts and the system won’t let you.
One case is not in the flow chart: mail matches, username doesn’t. Login seems to just work with the SSO username. I haven’t tried adding a ticket or comment.
Hm. I can say you’re showing up as a healthy account in my report: OK: 412 user with username madmax already exists in keycloak with the correct email!
Does the report only check email? Username in keycloak (and now in Trac when I login) is lonemadmax, retrieved from github at the beginning when it was the only way to sign in.
Anyway, the only “problem” so far is the different name. I can login without issues. Will shout if I can’t post when I need to :-).
I seem to have lost the ability to look at the spam logs, not that I particularily needed that, but it may indicate some mismatch of permissions. (edit: the “vote ticket” also seems to be gone, not sure if this is related to this change)
Other than that though, it works nicely. Thanks for working on this kallisti5!
I get this error (without having entered any login, just clicking the login button, I guess I have my account in cookies or something):
The account you are logging into has a misaligned email address between what is known to Trac, and what is configurd within our OIDC provider. Please contact an administrator for assistance
I have no idea which emails I use in either side, but they are all of the form pulkomandy@something. I hope you can find them and fix it up for me. Thanks!
My email on Haiku SSO and trac match but my username on Trac is uppercase (Zardshard) whereas my Haiku SSO username is lowercase (zardshard)
That means I seem to get a different trac account. I am the owner of new Icon-O-Matic tickets with my upper case username but not my lowercase username.
This has been addressed. If you login again it should work as expected.
I’ve added several new checks to our OIDC plugin:
if your SSO username has a case-insensitive match within the trac database, it will halt and warn you to contact an admin. We can rename your trac user fixing the case misalignment.
If your SSO user has an email which matches another account within trac (but the username differs), it will halt and warn you to contact an admin. We can weed out duplicate identities and re-align things.
We can now delete accounts in trac. Posts and comments will be made anonymous (changing the user to “nobody” before erasing the account.) This helps us fix mis-alignments (like the duplicate account created above) and better allows us to take GDPR actions like account removal.
There are probably ways we could automate some of this, but given the trac usernames and emails are the wild west… the manual realignment process feels safer
if your SSO username has a case-insensitive match within the trac database, it will halt and warn you to contact an admin. We can rename your trac user fixing the case misalignment.
I am in this boat. My SSO is all lowercase (autumnmeowmeow), but Trac is mixed-case (AutumnMeowMeow). My preference is mixed-case: can the SSO be changed?
Unfortunately not. Most sso systems are case-insensitive (and default to lowercase) to prevent + address these exact issues. I did however rename your trac AutumnMeowMeow to autumnmeowmeow to fix the misalignment
My Trac account is volodroid, my SSO is volo. They use different emails. Would it possible to rename my Trac account and change its email to the SSO one?
I would like to keep the KitsunePrefecture version in all my Haiku service account cases.
I’m still actually logged in that way, at least TRAC shows that way..
I used SSO login recently and againts what happened earlier, now I had got in some ‘Keycloak’ service – that was new for me.
There I saw the ‘kitsuneprefecture’ account name. Then is this the same type that account duplication or whatever that Zardshard mentioned above ?
It’s interesting, as I have SSO account name KitsunePrefecture and when it was used to get CGIT it was no problem.
Why different the login account handeling for using SSO and user accounts handled by SSO ?
Not rather this Keycloak something cannot handle them case sensitevely ?
: 18
)