After signing in incorrectly, signing in correctly goes to the wrong place
Bug #1257303 reported by
Ratnadeep Bhattacharjee
This bug affects 6 people
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Canonical SSO provider |
New
|
Undecided
|
Unassigned | ||
Bug Description
If while connecting to my Canonical Gmail account I enter the wrong password on login.ubuntu.com and then enter the correct password I am not redirected back to GMail. I have to type gmail.com on the URL bar, enter my canonical userid and hit enter..
Similar to bug 1083145, about the diversion to setting up a backup device.
| description: | updated |
| summary: |
- Identity provider should remember redirect URL + After signing in incorrectly, signing in correctly goes to the wrong + place |
| Changed in canonical-identity-provider: | |
| status: | New → Confirmed |
Revision history for this message
| Colin Watson (cjwatson) wrote | #1 |
| Changed in canonical-identity-provider: | |
| status: | Confirmed → Incomplete |
Revision history for this message
| Michał Sawicz (saviq) wrote | #2 |
Revision history for this message
| Matthew Paul Thomas (mpt) wrote | #3 |
| Changed in canonical-identity-provider: | |
| status: | Incomplete → New |
To post a comment you must log in.
In the process of working on some other related bugs, I tried to reproduce this (admittedly with a different OpenID consumer, since I don't use the Canonical Gmail service) but found that it all seemed to work: the first form was /:token/+decide (where :token was the OpenID request token assigned by SSO to identify the exchange); entering an incorrect password there sent me to /:token/+login; and entering a correct password there eventually sent me back to the originating site.
I think that this bug has probably been fixed along the way, although I've been unable to identify a relevant code change that happened after it was filed. Please could anyone who experienced this bug in the past check whether you still see it? (Note that for these purposes I'm only interested in problems with this specific flow; I know that there are other ways you can end up having the OpenID request token forgotten along the way, and I have a merge proposal up that fixes quite a number of these.)