Canonical SSO provider

  1. Bug #556680
  2. Comment #4

Comment 4 for bug 556680

Revision history for this message
Gary Poster (gary) wrote : Re: attempting to create a new account with an existing email address at login.ubuntu.com oopses after you follow the email link back to create the name/password

Yesterday, I spoke with Curtis Hovey about this, and in particular the parts of it that relate to Launchpad. Here's my understanding.

I largely agree with Anthony's comment (#2 above). To be precise:

1) CIP should not try to block any emails being assigned to SSO accounts.
2) Launchpad should be in charge of disallowing any SSO account from being associated with a team. As corollaries:
   * A new-to-LP SSO account that has an SSO preferred email address that is the same as a team's email address may not be associated with the team. (The workflow of this can be a separate discussion.)
   * An existing SSO account that is already associated with a (non-team) person but which has a SSO preferred email address that corresponds with a team (via changes in SSO or LP) will simply have its email address ignored: no errors or warnings should be raised.

Therefore, to address this bug, LP needs to verify that it enforces these constraints. CIP can definitely stop trying to block emails at that point. If the blocking is pointless now, maybe it can even be removed sooner, but that's more for ISD to determine, I think.