Seqr will allow for the creation of two users with the same email, and then will allow neither to sign in

[rsolano1-uw]

Description Using the documented docker-compose exec seqr python manage.py createsuperuser command, two users can be created that share the same email address. Two users cannot be created that share the same username because the script will throw an error if you try to do that. Once two users are created with the same email address, neither user can sign in.

Steps to replicate Create two users with createsuperuser. User 1:

• Username: example@example.com
• Email: example@example.com
• Password: example1

User 2:

• Username: example
• Email: example@example.com
• Password: example2

Now neither user can sign in. Attempting to sign in results in a 'invalid credentials (401)' error on the login page.

Steps to resolve Sign in to the postgres database and \connect seqrdb, then select * from auth_user; and get the row ID of the second user, then run delete from auth_user where id = X, with X being the row ID. Now user 1 can sign in.

Link to page(s) where bug is occurring seqr login page, local setup

[bw2]

Thanks for pointing this out. I think the way to make docker-compose installations more secure is to only expose the seqr container (port 80/8000) outside docker-compose, and keep the container ports (like elasticsearch:9200) hidden inside the default bridge network created by docker-compose - by making the changes here: https://github.com/macarthur-lab/seqr/compare/dev...local_install_updates This way redis (and other services) won't be accessible except from within the seqr container or other containers.

[rsolano1-uw]

Hey bw2,

Thanks for the response. I'm not sure what that has to do with user creation.

[bw2]

Oops I meant to make that comment on issue #1179

[GeorginaAmbriz]

Hello I also had problems with the creation of two users with the same email. How do I Sign in to the postgres database?

[hanars]

docker-compose exec postgres psql -U postgres seqrdb should connect you to the database. From there you can delete a user account you accidentally created