search

mozilla / persona

Persona is a secure, distributed, and easy to use identification system.
https://login.persona.org
Other
1.83k stars 265 forks source link

Add support for IdP dynamic identifiers #2156

Closed ozten closed 12 years ago

ozten commented 12 years ago

Using Spec change 18 as a guide, implement all the pieces to support dynamic identifiers.

callahad commented 12 years ago

This is also important for https://github.com/mozilla/browserid-bigtent/issues/66

lloyd commented 12 years ago

things have changed? when is this required by now and what's the driver?

callahad commented 12 years ago

We have a really easy failure mode for users with multiple Gmail/Hotmail/Yahoo addresses:

  1. User types foo@gmail.com into the Persona dialog.
  2. BigTent redicts the user to Google for OpenID authentication.
  3. User actually authenticates as bar@gmail.com, since that's what they were signed into Google as at the time.

We can't prevent this, so our only option right now is to throw up a hard failure in the user's face: "You authenticated as the wrong address."

With dynamic identifiers, we could give the user the option of continuing as bar@gmail.com, so it's a soft failure rather than a hard failure.

callahad commented 12 years ago

As for priority, this is an enhancement for BigTent, but not a blocker.

As I understand it, this is a blocker for BlueVia.

ozten commented 12 years ago

Spec proposal is won't fix.

This should be re-visited from scratch for Bigtent.

Won't fix.