[go: up one dir, main page]
Page MenuHomePhabricator
Create Task
Maniphest T365370

Password change form not easily discoverable on https://idm.wikimedia.org
Closed, ResolvedPublicBUG REPORT
Actions

Description

In T363125#9735700, @taavi wrote:

Password reset have been disabled for a few months now, email addresses since I deployed that patch last week, and I just sent https://gerrit.wikimedia.org/r/c/operations/mediawiki-config/+/1023432 to disable password changes while logged in.

The configuration patch disabling password changes mentioned by @taavi in T363125: sustainability of wikitech.wikimedia.org has been merged. A related problem now appears: what URL is a person expected to use to change their Developer account password?

The page I see as an authenticated user does not have an obvious link for changing my account password:

Screenshot 2024-05-20 at 09-37-41 My LDAP properties.png (1×2 px, 273 KB)

There is a https://idm.wikimedia.org/wikimedia/password/ route that can be found on https://idp.wikimedia.org/login where it is labeled "Forgot your password?". If you visit this URL while authenticated to Bitu you will not get the password recovery form; instead you will be told "You're already signed in.".

Is it currently only possible to change your Developer account password by logging out of Bitu and idp.wikimedia.org and then using the password recovery form at https://idm.wikimedia.org/wikimedia/password/?

Details

SubjectRepoBranchLines +/-
Password change form.operations/software/bitumaster+150 -6
Customize query in gerrit

Related Objects

Event Timeline

bd808 created this task.May 20 2024, 3:48 PM
Restricted Application added a project: Infrastructure-Foundations. · View Herald TranscriptMay 20 2024, 3:48 PM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
MoritzMuehlenhoff subscribed.May 27 2024, 2:27 PM
SLyngshede-WMF claimed this task.May 27 2024, 2:27 PM
SLyngshede-WMF triaged this task as Medium priority.
Physikerwelt subscribed.Jun 2 2024, 9:12 AM

This ticket was super helpful.

https://idm.wikimedia.org/wikimedia/password/ showed

You're already signed in.

I logged out and I could change my password.

It would be less confusing to use the old password to set a new one. Maybe we can document, that this is currently not possible for lay users?

jeremyb awarded a token.Sep 10 2024, 4:00 AM
jeremyb subscribed.
jeremyb added a comment.Sep 12 2024, 3:36 PM

I found this form. didn't try it yet. https://toolsadmin.wikimedia.org/profile/settings/change_password/

SLyngshede-WMF added a comment.Sep 13 2024, 6:45 AM

The password changing is rather confusing right now. We'll add an option of changing your password when signed in. It might be a take a little while, due to other tasks.

gerritbot added a comment.Sep 27 2024, 12:21 PM

Change #1076197 had a related patch set uploaded (by Slyngshede; author: Slyngshede):

[operations/software/bitu@master] Password change form.

https://gerrit.wikimedia.org/r/1076197

gerritbot added a project: Patch-For-Review.Sep 27 2024, 12:21 PM
gerritbot added a comment.Oct 8 2024, 8:24 AM

Change #1076197 merged by jenkins-bot:

[operations/software/bitu@master] Password change form.

https://gerrit.wikimedia.org/r/1076197

SLyngshede-WMF mentioned this in rOSBIdfbbb98dcbab: Password change form..Oct 8 2024, 8:24 AM
Maintenance_bot removed a project: Patch-For-Review.Oct 8 2024, 8:30 AM
SLyngshede-WMF mentioned this in rOSBIc6b3f7097ebb: New version, 0.1.0..Thu, Oct 24, 8:59 AM
SLyngshede-WMF closed this task as Resolved.Thu, Nov 7, 2:42 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits