Skip to content

fix(signup): domain provisioning on cloud #9515

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Apr 26, 2022
Merged

Conversation

mariusandra
Copy link
Collaborator

@mariusandra mariusandra commented Apr 25, 2022

Problem

JIT provisioning into organisations for users with emails that belong to verified domains.... is broken.

Changes

  • Adds instrumentation to help debug why this is going wrong.
  • Fix bug, where we were treating HttpResponse as a user, probably leftover of some refactoring
  • Connect to verified JIT organisations not only on account creation (only via SSO), but also on subsequent logins (only via SSO). Otherwise, if you log in before your admin sets up a verified domain, you will not get connected to the org unless someone sends you an invite. This can help even if the first login fails because of some bug, and will help all the clients who now have users that don't belong to any organization.

How did you test this code?

  • Tested that the instrumentation didn't break anything.
  • Verified manually that
  • Made a test for the third point.

@mariusandra
Copy link
Collaborator Author

Still had to manually verify one thing. My expectation is that when you get an invite on bla@domain.com to join , open the link, click "login" -> "google", and join with your me@gmail.com account, it should not connect you to the organisation with this verified domain. So you can't just MITM a link and log in with your own unverified domain email.

I verified that it works correctly: it won't connect you to the organization. However the UX is bad. It doesn't show the thrown errors from signup.py anywhere, and it drops you in an environment like this:

image

However I'll take advantage of the green checkmark, and merge this in, as it hopefully fixes an important customer issue. The error can be improved later.

@mariusandra mariusandra merged commit 8a52ade into master Apr 26, 2022
@mariusandra mariusandra deleted the fix-domain-provisioning branch April 26, 2022 18:51
fuziontech added a commit that referenced this pull request Apr 28, 2022
* master: (137 commits)
  feat(cohorts): add cohort filter grammars (#9540)
  feat(cohorts): Backwards compatibility of groups and properties (#9462)
  perf(ingestion): unsubscribe from buffer topic while no events are produced to it (#9556)
  fix: Fix `Loading` positioning and `LemonButton` disabled state (#9554)
  test: Speed up backend tests (#9289)
  fix: LemonSpacer -> LemonDivider (#9549)
  feat(funnels): Highlight significant deviations in new funnel viz (#9536)
  docs(storybook): Lemon UI (#9426)
  feat: add support for list of teams to enable the conversion buffer for (#9542)
  chore(onboarding): cleanup framework grid experiment (#9527)
  fix(signup): domain provisioning on cloud (#9515)
  chore: split out async migrations ci (#9539)
  feat(ingestion): enable json ingestion for self-hosted by default (#9448)
  feat(cohort): add all cohort filter selectors to Storybook (#9492)
  feat(ingestion): conversion events buffer consumer (#9432)
  ci(run-backend-tests): remove CH version default (#9532)
  feat: Add person info to events (#9404)
  feat(ingestion): produce to buffer partitioned by team_id:distinct_id (#9518)
  fix: bring latest_migrations.manifest up to date (#9525)
  chore: removes unused feature flag (#9529)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants