Canonical SSO provider

Make auth tokens shorter so they can be entered manually

Bug #589335 reported by Stuart Metcalfe
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Canonical SSO provider
Fix Released
High
David Owen
Canonical SSO provider 2.7.0

Bug Description

Auth tokens are currently long and only able to be claimed by following a link from an email in a web browser. We need to remove both of these things as hard requirements to enable more complete desktop integration. The first step is to use much shorter tokens (4 characters is an initial suggestion) which are easier to re-type or read from more limited devices and provide a field on the 'sent' notification page to enter the token. The same system should be used in all places where auth tokens are required. We also need to remove the dependency on the same browser session being used to claim the token.

Testcase added to ISD_143

See original description

Related branches

lp://staging/~canonical-isd-hackers/canonical-identity-provider/bug_589335_auth_tokens
Canonical ISD hackers: Pending requested
Diff: 1395 lines (+506/-196)
22 files modified
doctests/stories/openid/per-version/sso-workflow-complete.txt (+2/-2)
doctests/stories/openid/per-version/sso-workflow-register.txt (+1/-1)
doctests/stories/openid/per-version/sso-workflow-reset-password.txt (+1/-1)
doctests/stories/sso-server/standalone-login.txt (+172/-46)
identityprovider/forms.py (+20/-1)
identityprovider/models/authtoken.py (+40/-4)
identityprovider/templates/enter_token.html (+37/-0)
identityprovider/templates/launchpad/email/forgottenpassword.txt (+4/-0)
identityprovider/templates/launchpad/email/newuser.txt (+4/-0)
identityprovider/templates/launchpad/email/validate-email.txt (+4/-0)
identityprovider/templates/registration/confirm_new_account.html (+1/-1)
identityprovider/templates/registration/email_sent.html (+16/-6)
identityprovider/templates/registration/reset_password.html (+1/-1)
identityprovider/templates/ubuntu/email/forgottenpassword.txt (+4/-0)
identityprovider/templates/ubuntu/email/newuser.txt (+4/-0)
identityprovider/templates/ubuntu/email/validate-email.txt (+4/-0)
identityprovider/tests/test_views_ui.py (+79/-93)
identityprovider/tests/utils.py (+2/-0)
identityprovider/urls.py (+9/-4)
identityprovider/views/account.py (+11/-5)
identityprovider/views/ui.py (+79/-31)
identityprovider/views/utils.py (+11/-0)
lp://staging/~canonical-isd-hackers/canonical-identity-provider/token_tweaks
Anthony Lenton (community): Approve
Diff: 308 lines (+52/-49)
15 files modified
identityprovider/forms.py (+1/-1)
identityprovider/templates/enter_token.html (+4/-4)
identityprovider/templates/launchpad/email/email-validation-token.txt (+1/-1)
identityprovider/templates/launchpad/email/forgottenpassword.txt (+5/-5)
identityprovider/templates/launchpad/email/newuser.txt (+5/-5)
identityprovider/templates/launchpad/email/validate-email.txt (+5/-5)
identityprovider/templates/registration/bad_token.html (+3/-3)
identityprovider/templates/registration/email_sent.html (+3/-3)
identityprovider/templates/registration/logout_to_confirm.html (+2/-2)
identityprovider/templates/ubuntu/email/email-validation-token.txt (+1/-1)
identityprovider/templates/ubuntu/email/forgottenpassword.txt (+5/-5)
identityprovider/templates/ubuntu/email/newuser.txt (+5/-5)
identityprovider/templates/ubuntu/email/validate-email.txt (+5/-5)
identityprovider/tests/test_views_ui.py (+1/-1)
identityprovider/views/ui.py (+6/-3)
lp://staging/~canonical-isd-hackers/canonical-identity-provider/hyphenation
Ricardo Kirkner (community): Approve
Diff: 247 lines (+25/-25)
15 files modified
identityprovider/forms.py (+1/-1)
identityprovider/models/authtoken.py (+1/-1)
identityprovider/templates/enter_token.html (+5/-5)
identityprovider/templates/launchpad/email/email-validation-token.txt (+1/-1)
identityprovider/templates/launchpad/email/forgottenpassword.txt (+1/-1)
identityprovider/templates/launchpad/email/newuser.txt (+1/-1)
identityprovider/templates/registration/bad_token.html (+3/-3)
identityprovider/templates/registration/email_sent.html (+2/-2)
identityprovider/templates/registration/logout_to_confirm.html (+2/-2)
identityprovider/templates/ubuntu/email/email-validation-token.txt (+1/-1)
identityprovider/templates/ubuntu/email/forgottenpassword.txt (+1/-1)
identityprovider/templates/ubuntu/email/newuser.txt (+1/-1)
identityprovider/tests/test_views_ui.py (+1/-1)
identityprovider/views/account.py (+3/-3)
identityprovider/views/ui.py (+1/-1)
Stuart Metcalfe (stuartmetcalfe)
description: updated
Łukasz Czyżykowski (lukasz-czyzykowski)
Changed in canonical-identity-provider:
assignee: nobody → Łukasz Czyżykowski (lukasz-czyzykowski)
Revision history for this message
Julien Funk (jaboing) wrote :

Note to QA: will need a test case associated and pssible refactoring of old testcases

Changed in canonical-isd-qa:
assignee: nobody → Dave Morley (davmor2)
Łukasz Czyżykowski (lukasz-czyzykowski)
Changed in canonical-identity-provider:
assignee: Łukasz Czyżykowski (lukasz-czyzykowski) → David Owen (dsowen)
David Owen (dsowen)
Changed in canonical-identity-provider:
status: Confirmed → In Progress
Revision history for this message
David Owen (dsowen) wrote :

When we upgrade production for this, there will be older, long tokens which are still active. What should be our strategy for dealing with those? Some ideas:

 1. Keep two tables for the two types of tokens, and permanently retire the old ones after another upgrade cycle.

 2. Invalidate & remove the old tokens, forcing users to re-register, re-validate, &c.

 3. Keep old tokens, but put new tokens in the same table.

Revision history for this message
Łukasz Czyżykowski (lukasz-czyzykowski) wrote :

I would go with putting them in the same table. Just stopping creating long ones.

Łukasz Czyżykowski (lukasz-czyzykowski)
Changed in canonical-identity-provider:
milestone: 2.6.0 → 2.7.0
Revision history for this message
David Owen (dsowen) wrote :

Agreed with using the same table.

We currently select from 50 characters to generate tokens. A 4-character token would give ~6M possibilities. Even with a slightly longer token, we might want some additional security.

Łukasz and I discussed adjustments to the workflows to maintain good security with the shorter tokens. For new accounts and password resets, we settled on requiring the e-mail address that the token was sent to along with the token itself. This would significantly increase the amount of work required to guess or brute-force a token and capture an account. API-based clients could cache the e-mail submitted when requesting a new account or password reset, and re-submit it once the user has the token in hand.

For new e-mail addresses on existing accounts, we agree that the user must log in (or already be logged in) as the account owner to use the token. We are undecided whether the target e-mail address must also be entered.

David Owen (dsowen)
Changed in canonical-identity-provider:
status: In Progress → Fix Committed
Revision history for this message
Stuart Metcalfe (stuartmetcalfe) wrote :

Small comment from ec2 testing: "6-digit" and "confirmation-code" shouldn't have hyphens. Would be good, but not critical to get this fixed before staging.

David Owen (dsowen)
Changed in canonical-identity-provider:
status: Fix Committed → In Progress
Revision history for this message
Dave Morley (davmor2) wrote :

Now a 6 digit code that is plain text and therefore copy pasteable.

passes on ec2

Changed in canonical-isd-qa:
status: New → Confirmed
David Owen (dsowen)
Changed in canonical-identity-provider:
status: In Progress → Fix Committed
Dave Morley (davmor2)
description: updated
Revision history for this message
Julien Funk (jaboing) wrote :

Passes on staging.

Changed in canonical-isd-qa:
status: Confirmed → Fix Committed
Dave Morley (davmor2)
description: updated
Revision history for this message
Dave Morley (davmor2) wrote :

Passes on Production

Changed in canonical-isd-qa:
status: Fix Committed → Fix Released
Julien Funk (jaboing)
Changed in canonical-isd-qa:
milestone: none → canonical-identity-provider+2.7.0
Danny Tamez (zematynnad)
Changed in canonical-isd-qa:
milestone: canonical-identity-provider+2.7.0 → 2.7.0
Danny Tamez (zematynnad)
Changed in canonical-isd-qa:
milestone: 2.7.0 → canonical-identity-provider+2.7.0
Ricardo Kirkner (ricardokirkner)
Changed in canonical-identity-provider:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.