#4738 google auth broken
Closed: Fixed None Opened 6 years ago by kevin.

The old google auth is no longer offered by google, so people trying to use google to login to ask are unable to do so.

Patrick has followed this and has a plan to fix it.


Background: Google has switched off their OpenID provider and now only allows OpenID Connect-based authentication.

OpenID uses entirely different identities than OpenID Connect does.

While it would be easy enough to enable the OpenID Connect client for askbot, that would confuse people a lot: because of the different identities, the new (OpenID Connect) user would not be tied to the old (OpenID URL) user.

A little time ago, we (OpenID Foundation) standardized a migration specification, which should allow askbot to fix this.
Because the OpenID identities Google issues are anonymous, we are unable to tie together OpenIDC and OpenID identities without this specification.

I am currently working on implementing this migration specification for Askbot, so that we can switch to OpenIDC without having people loose access to their current account.

The current ETA for getting this in prod is at the end of this week.

For the time being, users can use another identity provider for askbot, and afterwards tie their Google OpenID Connect identity to their account.

Sorry for the inconvenience.

Actually, this only works if you'd connected that other OpenID identity to your account before this happened. I have a Fedora ID, and it doesn't work for ask.fedoraproject.org. (I'd never had a reason to use it there before this.) I've created an OpenID account through Symantic and it doesn't work there or at askbot. Currently, there doesn't seem to be a way to link a new OpenID to either account if you're not already logged in, and you can't log in without it. Catch 22 strikes again.

Replying to [comment:2 sideburns]:

Actually, this only works if you'd connected that other OpenID identity to your account before this happened.

...or we run a script, such as the one Patrick is working on to tie the old google openid to new google oauth.

I have a Fedora ID, and it doesn't work for ask.fedoraproject.org. (I'd never had a reason to use it there before this.)

By "doesn't work" you mean it doesn't connect you to your old account based on a google openid? then yes, askbot has no way to know those are the same accounts. It should "work" fine to login and get access to an account with that connected to it (or a new one if there's none it can see connected to it).

I've created an OpenID account through Symantic and it doesn't work there or at askbot. Currently, there doesn't seem to be a way to link a new OpenID to either account if you're not already logged in, and you can't log in without it. Catch 22 strikes again.

Sure, which is why we are working on a way to tie those google openid's to the new google oauth so we can allow people to login to their existing accounts.

Yes. Exactly. Unless you'd linked the identity to your account earlier, it won't work right now. I didn't really expect that it would, but I wanted to document it so that less experienced users wouldn't feel that they were misled when they find out that it doesn't. I've done enough tech support over the years to know that there are many things that people like you and me find obvious that are complete mysteries to the average user and wanted to add a warning to any of them that made it this far.

Thanx for doing so much to get it back up and spending so much of your Copious Free Time on it.

More than a week cut off from the service and no updates whatsoever about what is going on. Are we serious about this service?

This is important to us and we are working on it.

Patrick has run into a number of corner cases to the migration code he is working through. If you like I can update this ticket every day to say "we are working on it", but thats not likely very helpfull.

In short: we are working on it. Hopefully we will have some good news soon. Sorry for the delay.

This should now be fixed.

You should be able to login via the new g+ oauth and get connected to your existing account.

Please let us know if you see any issues with it.

Login to comment on this ticket.

Metadata