Redundant 'Unauthorised' message on login page

[Julie Pichon]

The messages-on-login-screen blueprint added an "Unauthorised" message when hitting an error 401. However it seems to be redundant in many cases as a more useful error message about permissions is also displayed. Unless we can provide additional information, it
should probably be removed for this particular use case, or at least we should avoid displaying both messages.

[Kun Huang (academicgareth)]

In your example, there're two things to users:

one is the reason of error, "Unauthorized"
another is the message to user, telling them blablabla ...

Those look same but act as different roles. Maybe we could show "Unauthorized" before the message which looks like "I'm telling why you should do this", or use different css on both things, or remove one of them. Keeping consistent is ok

[Julie Pichon (jpichon)]

I like your suggestion, thanks!

[Liz Blanchard (lblanchard)]

I completely agree with Kun. I think these two messages can be combined and formatted to say something very clear like "This user doesn't have permissions to access the Administration section. Please log in as another user or go back to the <link>Project Dashboard</link>."

[Julie Pichon (jpichon)]

I'm not sure about combining them into one since they come from different places -- the URL in the screenshot is just an example and could be anything. I will swap both messages around for now, though if removing the redundant 'Unauthorized' for the time being is the preferred solution, that works for me too.

Additionally, as suggested here what it could look like if we use CSS to highlight the messages differently. Here reusing the colour scheme from the 'info' messages. Thoughts?

[Kun Huang (academicgareth)]

It seems good to me :-)
I'm not good at imagining; we could wait for some more ideas.

[Julie Pichon (jpichon)]

After thinking about it further, I will propose a patch to remove 'Unauthorized' completely. It's too general, and not overridable (actually due to its location it would override a more specific message that may have been previously set). Unless we can have it provide more information it's not very useful.

Other unwanted places it shows up: I am not logged in and try to hit a direct URL. I get redirected to /auth/login/?next=/project/ correctly but am greeted with an 'Unauthorized' message. I think it's better to simply remove it from the general path for now, and keep the add_logout_reason() mechanism for more specific explanations.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/46035

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/46035
Committed: http://github.com/openstack/horizon/commit/202427c1d82106b21789d611b43f85a8c1a13730
Submitter: Jenkins
Branch: master

commit 202427c1d82106b21789d611b43f85a8c1a13730
Author: Julie Pichon <email address hidden>
Date: Wed Sep 11 10:25:15 2013 +0100

    Remove general 'unauthorized' message from middleware

    The message is too general to be useful, and at this late stage it
    could override a more useful message that may have been provided
    earlier.

    Change-Id: If819748f765ce30a71206a15f9874727e459dce8
    Closes-Bug: #1221716