OpenID 2.0 for Google Accounts is going away

[Christian Berendt]

I logged in with my Google account on ask.openstack.org and got the following warning:

OpenID 2.0 for Google Accounts is going away

More details at https://support.google.com/accounts/answer/6135882?authuser=0.

Starting April 20, 2015, OpenID 2.0 will no longer work for Google Accounts.

[Stefano Maffulli (smaffulli)]

The short term solution for you, Christian, is to add Launchpad ID to your account on Ask OpenStack.

In the near future we want to migrate all users to https://OpenStackID.org

For Evgeny: we need to talk about a migration plan for all users that are *not* using Launchpad. This task will need to be tackled *after* askbot is fully migrated to infra.

[Peter-Christian Quint (pcq)]

OpenID 2.0 is still not supported any more :(

[Stefano Maffulli (smaffulli)]

We have setup a -dev environment and it's ready for testing. If you have a couple of minutes, could you please follow the instructions below to test if it works for you too?

Modify /etc/hosts adding this line:

    15.125.72.80 askbot-dev.openstack.org

Then head to http://askbot-dev.openstack.org and sign in. Choose G+ option: you should be able to seamlessly login into your google account and your profile on Askbot-dev will start using it even if it was using Google OpenID before.

If you find issues please take screenshots and report them here. We'll keep testing things on our side and get ready to upgrade the production instance in a few days.

[Boris Derzhavets (bderzhavets)]

Staying at page http://askbot-dev.openstack.org/en/account/signin/?next=/en/ select "g+" , regardless my account exist
at dev.openstack.org and I previously logged into <email address hidden> , selecting "g+" doesn't log me in, on next page it suggests new registration.

[Salvo Davide Rapisarda (sdrapisarda)]

Same issue of Boris...

[Stefano Maffulli (smaffulli)]

Thanks for testing. Boris and Salvo. We found another issue that prevented full installation of askbot with some difficulty this week. We're now going to focus on solving the google auth issue. I appreciate your patience, I hope to have news for you in the next couple of days.

[Evgeny Fadeev (evgeny-fadeev)]

In the development version Google OpenID recovery now attempts two things: (1) try to recover account via openid URL record, if that fails - (2) try to recover by matching email address with that provided by the g+ API.

If the above methods fail, the only option is to recover by entering email address by hand and clicking the account recovery link.

[Boris Derzhavets (bderzhavets)]

Attempt to launch to http://askbot-dev.openstack.org results launch to production https://ask.openstack.org/en/questions/.
Neither one of suggested options works.

[Boris Derzhavets (bderzhavets)]

Also production https://ask.openstack.org/en/questions/ doesn't have "g+' button as it didn't have it before.
Sending recovery link doesn't send anything as well.

[Boris Derzhavets (bderzhavets)]

Now I get another message via Launchpad OpenID attempt

[Márton Kiss (marton-kiss)]

Hi Boris,

So the situation that you get this ask.openstack.org redirection was caused by an internal test configuration, now I've restored to original settings, so askbot-dev.openstack.org will redirect you properly.

Basically what you see here, just a temporary staging site, we are working on to move the staging properly into official OpenStack infrastructure, and it is in progress, requires the collaboration of several teams here. When the staging works well, and properly tested, we can move the changes to production.

Actually, we always welcome reviewers, and we are now waiting for approval from infra team for the following related patches:
  https://review.openstack.org/172880 - Initial commit of ask-staging.o.o site
  https://review.openstack.org/181873 - Askbot module refactor
  https://review.openstack.org/181894 - Disable puppet-askbot resources temporarily

We identified some changes between the previous stable release and the actual head of askbot-devel repo, and needed to find the solutions there, and also we had a change in the deployment model, because instead of pip we'll rely entirely on git and a stable/dev branching model. I know about one open issue regarding this auth process, that pairing your previous askbot account with the new Google plus is not solved yet, and as I know Evgeny is working on the solution, but this can go parallel with infra changes.

So we are working on the permanent solution, and I'll share the improvements here to ensure better communication and make the work more visible.

[Evgeny Fadeev (evgeny-fadeev)]

@Marton actually the item you've mentioned above is completed.
Right now migration from Google OpenID to G+ works via OpenID url
and via email address as fallback.

Still - if email and OpenID url of the previous account do not match,
the only option to recover the account will be via email.
Probably this exhausts the possibilities to achieve the migration.

[Márton Kiss (marton-kiss)]

Evgeny: this patch: https://github.com/ASKBOT/askbot-devel/commit/2bb4366972fe723118c88c15dbf15f5f2afd9a3b ?

M.

[Tom Fifield (fifieldt)]

Did that patch get applied to ask.openstack.org ?

[Márton Kiss (marton-kiss)]

Tom,

Not yet, this patch still sits in the queue:
https://review.openstack.org/#/c/172880/
It spent so much time there, that meanwhile the solr package got deprecated, so I needed to upgrade to staging patch yesterday. So if this staging thing launched properly, we can start to upgrade the prod ask.o.o and resolve this google plus issue.

M.

[Tom Fifield (fifieldt)]

I think there's a pretty major problem with this we're seeing the results of recently:

Askbot keeps the email addresses of people who logged in with Google before, and keeps emailing them whenever their questions are updated/commented on, in addition to at least once a week with an update of unanswered questions.

Only, they can't login to do anything about it.

I think we urgently need to turn off email to people who only logged in with google and can't login now :)

[Stefano Maffulli (smaffulli)]

I think upgrading this would be faster and a better solution. The
staging system is up now, only it requires a database dump to test the
upgraded version. Jeremy told me on IRC he's going to do it early next week.

[Tom Fifield (fifieldt)]

we continue to get angry emails from people asking to unsubscribe

[Stefano Maffulli (smaffulli)]

I have tested the G+ auth on https://ask-staging.openstack.org/en/questions/ and it works fine. We're ready to upgrade in production.

[Stefano Maffulli (smaffulli)]

The production site has been upgraded and G+ logins are now available again. Users with old google openid accounts should be able to migrate to the new ones transparently. Please try and let us know if there are new issues.