SREG fields during login are confusing to average user

[Julien Funk]

This is a major usability issue from my perspective.

Most users will be confused by the current implementation of the SREG fields during login. At the moment, if I choose not to provide one o two of the SREG fields there will be portions of the website that will not work correctly after I log in - but there is no warning to the user that the site might not work properly if they disallow a field or two.

This is a classic case of giving the user too many choices. A basic user doesn't care to hand pick his SREG fields, he just wants to log into the site and get it over with.

One idea is to provide an expandable list of fields, with the option to say 'No'. But hand picking the SREG fields seems overkill as the site will likely rely on every field that it is requesting to function properly.

Finally, if we're still going ahead with the hand pick idea, a select/deselect all checkbox would be nice since 99.9% of the time a user will want to allow all the requested fields. Also there should be some helpful text that explains in simple terms what is happening and that refusing the fields may cause the site to function improperly.

[Michael Nelson (michael.nelson)]

Hi Julien - I'm guessing you're writing this bug in response to testing on a VPS, where those options are presented because the vps request isn't coming from a trusted source. I think I wrote a similar bug, or started discussing it, when I first saw it too, but stu/ricardo pointed out that it's only because of the untrusted request (from the VPS).

It is probably worth asking the SSO guys if the vps environment can also be setup to match staging/production somehow, to avoid the confusion - if possible (whether they can do that might depend whether you're authenticating with a vps SSO, or staging SSO).

[Julien Funk (jaboing)]

Michael, thanks for clarifying. That is certainly better that the prior case where it seemed to apply to all sites. However, some of the points are valid whether or not the site is trusted. Still request the following changes:

1) A note explaining that the site is not recognised by Canonical and should be approached with care
2) A select/deselect all checkbox button for the fields
3) A clear explanation that the site may not work properly if the fields are left unchecked