Installing apps impossible due to time skew causing invalid signatures for U1 account

[Julia Palandri]

In a phone with a U1 account configured and working, some users reported that about a week ago (i.e. before OTA-7) they started having problems to upgrade software or install new apps.

When they want to upgrade/install, they are asked for their U1 information as in no account was set up in the phone. If they add the account through Accounts in Settings, the phone apparently stores the information but when the user wants to use the store it disappears again.

[Julia Palandri (julia-palandri)]

Also: one of the users told me that the account works ok in her BQ phone and on desktop; it's her meizu she's having trouble with (ie apparently it's nothing about the account itself).

She's also tried removing the app from SSO account settings; this deleted the account in the BQ which she could readd, but in the meizu the problem persists.

[Julia Palandri (julia-palandri)]

One of the users just commented he 'fixed' it with a factory settings reset - so at least we have a workaround - though a harsh one.

[dobey (dobey)]

Seeing the ~/.cache/upstart/scope-registry.log when this issue happens would be useful.

[Alejandro J. Cura (alecu)]

The "fixed by factory reset" seems like a harsher way of the "fix by setting time to automatically sync" that worked for a different user.

[Julia Palandri (julia-palandri)]

I confirm at least one case was fixed by setting the clock to automatic time instead of manual. Apparently it could have something to do with the time change in some countries and the fact that the Oath Key that the store uses to authenticate lasts only 15 minutes.
Apparently the difference in timestamps in the server produced this awkward behaviour.

I still ned to check with the other users and see if this fixes the problem for them too to close the bug.

I wonder if it's worth to open a design bug - do we *really* want to allow users to set the time manually? I think that manually choosing the time zone (instead of letting the phone guess by position) makes sense, but in what case does a user want to set the time manually once the timezone has been chosen?

[Pat McGowan (pat-mcgowan)]

Theory is that the fix for bug #1483866 triggered the subsequent failures, perhaps the time had always been wrong, or it drifted.
Now for a real fix, perhaps to query the server for the time rather than using the value from the client, which was employed in other cases.

[Alejandro J. Cura (alecu)]

If the user sets the time manually for whatever reason, then our code should keep working.
The proposed solution is to fetch the server's time and use that as a base for the time used in signatures.
We need to apply this solution to every project using U1 tokens.

[Alejandro J. Cura (alecu)]

A related U1 bug was #692597.
The fix was to do a HEAD request to the right server, and to use that time as the base for oauth signatures in the client.
A sample MP is: https://code.launchpad.net/~alecu/ubuntuone-storage-protocol/timestamp-autofix/+merge/78505

[John McAleely (john.mcaleely)]

If your *time zone* is not set correctly, does some module 'correct to UTC' incorrectly, resulting in tokens several hours adrift?

See bug #1519359

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntuone-credentials - 15.11+16.04.20151207.1

---------------
ubuntuone-credentials (15.11+16.04.20151207.1) xenial; urgency=medium

  [ CI Train Bot ]
  * debian/libubuntuoneauth-2.0-0.symbols: update to released version.

  [ Rodney Dawes ]
  * Retrieve current timestamp from server to use in OAuth signatures.
    (LP: #1509118)

 -- Rodney Dawes <email address hidden> Mon, 07 Dec 2015 21:38:01 +0000