DOCS: Document logging out of CILogon #974

GeorgianaElena · 2022-02-03T13:05:13Z

Does @2i2c-org/tech-team agree that adding this note to the docs is acceptable for fixing #957?

Note this comment in the original issue that gives more details about it.

sgibson91 · 2022-02-03T13:13:19Z

Can we maybe rephrase this along the lines of "If a user mistakenly provides an incorrect email when logging in, they will need to... before doing...". Or maybe "If a user wishes to change which email address they login with,...". I'm having trouble keeping track between the "first" and "second" attempts.

GeorgianaElena · 2022-02-03T13:33:37Z

Can we maybe rephrase this along the lines of "If a user mistakenly provides an incorrect email when logging in, they will need to... before doing...". Or maybe "If a user wishes to change which email address they login with,...". I'm having trouble keeping track between the "first" and "second" attempts.

Sure! There's a bit of a mess in my head right now 🤯

Two thoughts:

I'm a bit reserved using email address to refer to the user account.

So, with CILogon, the login process looks like this:

Hub login page ➡️ Auth0 Login screen presenting the CILogon option ➡️ CILogon IDP selection page ➡️ IDP login page ➡️ hub access

If on the screen in bold (IDP login page), the same identity provider is used, let's say Google, then a logout must happen before using another email account. But if one chooses the berkeley Identity Provider, then they will be able to login with their berkeley email address without logging out.

If this phrase If a user mistakenly provides an incorrect email when logging in means that the incorrect email resolved to a 403 error then this is what happens Should a 403 on login clear oauth state? #973 and a CILogon logout won't solve things.

Hope I didn't create more confusion 😓

sgibson91 · 2022-02-03T13:37:23Z

I'm a bit reserved using email address to refer to the user account.

Ok, let's definitely say something general like "account information"

If this phrase If a user mistakenly provides an incorrect email when logging in means that the incorrect email resolved to a 403 error then this is what happens #973 and a CILogon logout won't solve things.

Ah, so do we have to do something in the hub at this point? (I will check the issue in case you've answered it there) Most likely wait til the cookie expires or scrub the cookie ourselves from within the hub

sgibson91

I like this, I feel it's much easier to follow. Thank you! 🙌🏻

GeorgianaElena · 2022-02-03T13:41:11Z

Thanks @sgibson91! I tried to rephrase the note a bit. LTMK if I managed to be more clear and shorter than in the novel above 😅

GeorgianaElena · 2022-02-03T13:42:01Z

You already answered ❤️ Thank you!!!!

choldgraf · 2022-02-03T18:46:18Z

So just to make sure I understand, there are two "things to log out of":

If a user logs into the hub with CILogon, but they use the wrong institutional address. Then they'll need to log out of two things:

First, log out of JupyterHub so that they don't keep hitting 403 errors. To do this, go to https://{hub-name}/hub/logout
Second, log out of CILogon so that they're asked to select a new institution. To do this, go to https://cilogon.org/logout

When that is done, they will be able to "start fresh" and choose a new CILogon provider and/or account name.

Is that right? If so, I think we should also document this in our user docs as well, since I suspect this will happen to people.

damianavila · 2022-02-03T19:10:50Z

Is that right? If so, I think we should also document this in our user docs as well, since I suspect this will happen to people.

I agree with this thought.

GeorgianaElena · 2022-02-04T11:46:10Z

If a user logs into the hub with CILogon, but they use the wrong institutional address. Then they'll need to log out of two things:
First, log out of JupyterHub so that they don't keep hitting 403 errors. To do this, go to https://{hub-name}/hub/logout

Yep. Checkout 2i2c-org/default-hub-homepage#8 for a possible "documentation" of this step

Second, log out of CILogon so that they're asked to select a new institution. To do this, go to https://cilogon.org/logout

Almost. So, they're asked to select an institution regardless of they go to https://cilogon.org/logout. But if they want to use the same institution, but just another address, then in order to be asked which institutional address to use, they will need to go to https://cilogon.org/logout.

Is that right? If so, I think we should also document this in our user docs as well, since I suspect this will happen to people.

What do you think if we go with the button in 2i2c-org/default-hub-homepage#8 for the first one and the note in this PR for the second one? Do you think we need to add more details in other places of the docs?

choldgraf · 2022-02-04T19:31:04Z

I took a pass at the language to try and clarify things a little bit in these docs - however I think we will need to iterate a little bit because the instructions didn't quite work for me, so I likely got something wrong :-)

Could you take a look at my latest commit and let me know what I messed up? I think that your strategy sounds good to me as long as we can document the full "how to log out" process here as a start. In the future if the button isn't enough and people are still confused, we can make an addition to the user docs

GeorgianaElena

Thanks for clarifying the docs @choldgraf. I left a couple of comments with my thoughts, but also added a commit to modify things a bit again. Sorry for not providing suggestions directly, but I wanted to add images too to make things more clear. LTMK what you think and if they work

GeorgianaElena · 2022-02-07T17:59:01Z

docs/howto/configure/auth-management.md

+
+There are two details for CILogon accounts worth mentioning:
+
+- **Institutional connection**. This is the direct connection with CILogon, negotiated by each institution. When a user logs in via CILogon, they first may choose from a variety of institutions (e.g. `UC Berkeley` or `Australia National University`). There is also a fall-back for "Google OAuth".


I've seen CILogon docs referencing these as IdentityProviders, so I suggest we use the same language as they do, so that if someone checks out the CILogon docs directly it's clear we're talking about the same thing. What do you think>

GeorgianaElena · 2022-02-07T18:00:42Z

docs/howto/configure/auth-management.md

+**To switch user accounts**, a user can go to the URL endpoing `https://{hub-name}/hub/logout`.
+The next time they go to the hub's landing page, they'll be asked to re-authenticate.
+
+**To switch CILogon institutions**, a user must go to the [CILogon logout page](https://cilogon.org/logout) and click the button to log out of their institutional account. When they try to log back in they should be directed to a page to select institutions once again.


I believe these are actually the other way around. In practice I've havn't seen switching institution require logging out of CILogon.

choldgraf · 2022-02-07T19:25:12Z

Ah thanks for those updates @GeorgianaElena - I think they are good! I pushed a commit with some minor cleanups and clarifications as well. What do you think?

However, following the instructions didn't quite work for me. Here are the steps I followed and what happened. Can you help me debug?

Logged-in to demo.pilot.2i2c.cloud with Berkeley credentials
403 page
Tap button to log out
Take me back to Auth0 login page
Choose CILogon
Straight to Berkeley log-in, cannot choose Identity Provider
Tried going to https://cilogon.org/logout/ and logging out
Same thing happened again

I would have expected that step 4 would have then asked me to choose an identity provider, but this didn't happen. Can you clarify?

GeorgianaElena · 2022-02-08T11:37:32Z

Straight to Berkeley log-in, cannot choose Identity Provider

I was able to reproduce your workflow if I check the remember box. Did you checked the remember box here?

If so, then probably you need to clear the cookies. It doesn't have to do with the logout process, but it's probably worth mentioning in the docs here.

! I pushed a commit with some minor cleanups and clarifications as well. What do you think?

I don't see any new commit from you @choldgraf 👀 Maybe you forgot to push it?
https://github.com/2i2c-org/infrastructure/pull/974/commits

GeorgianaElena · 2022-02-08T12:19:07Z

I clarified the docs a bit more and mentioned this scenario when clearing the cookies is required

choldgraf · 2022-02-09T05:26:36Z

@GeorgianaElena the cookie fix worked! Thanks for clarifying, and sorry that I forgot to push my commit before! I've just pushed another commit to clean up the language a bit. I added sphinx-copybutton while I was at it :-)

GeorgianaElena · 2022-02-09T09:43:09Z

docs/howto/configure/auth-management.md


-   When a user logs in via CILogon, they are first presented with a list of various institutions and organization that they may choose from (e.g. `UC Berkeley` or `Australia National University`).
+Identity Provider
+: The authentication service available through the CILogon connection.


Had no idea about this syntax, but super cool 👍

GeorgianaElena · 2022-02-09T09:57:27Z

Thanks @choldgraf 🎉

choldgraf

This looks good to me now!

choldgraf · 2022-02-09T19:46:22Z

OK I am merging this one in! I think these are nice changes and we can continue updating them as we use CILogon more and learn!

Add note about logging out of CILogon

37f637e

Rephrase the logout processs

c562d67

sgibson91 reviewed Feb 3, 2022

View reviewed changes

GeorgianaElena requested a review from a team February 3, 2022 13:42

Add the missing org from link

49e53f3

GeorgianaElena mentioned this pull request Feb 4, 2022

Enable authentication via CILogon #315

Closed

8 tasks

Clarify logout instructions

e983c6d

GeorgianaElena added 2 commits February 7, 2022 19:54

More details about logging out

7d48028

Add the login screenshots

2ef8089

GeorgianaElena commented Feb 7, 2022

View reviewed changes

Get the figure syntex correctly

f965287

GeorgianaElena changed the title ~~Add note about logging out of CILogon~~ Document logging out of CILogon Feb 7, 2022

GeorgianaElena added 🏷️ authentication Enhancement An improvement to something or creating something new. labels Feb 7, 2022

Get list indentation right

436effc

GeorgianaElena added 2 commits February 8, 2022 13:53

Cleanup

96405ba

Add note about clearing cookies

bd6eb48

GeorgianaElena and others added 2 commits February 8, 2022 15:30

Got the figure syntex wrong again

2fa82c1

A few comments and updates from Chris

0f553b7

GeorgianaElena commented Feb 9, 2022

View reviewed changes

choldgraf approved these changes Feb 9, 2022

View reviewed changes

choldgraf changed the title ~~Document logging out of CILogon~~ DOCS: Document logging out of CILogon Feb 9, 2022

choldgraf merged commit 994ce06 into 2i2c-org:master Feb 9, 2022

GeorgianaElena mentioned this pull request Feb 11, 2022

Logging out of 2i2c demo hub does not actually log you out #957

Closed

GeorgianaElena deleted the cilogon-logout-note branch February 11, 2022 14:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DOCS: Document logging out of CILogon #974

DOCS: Document logging out of CILogon #974

GeorgianaElena commented Feb 3, 2022

sgibson91 commented Feb 3, 2022

GeorgianaElena commented Feb 3, 2022 •

edited

Loading

sgibson91 commented Feb 3, 2022 •

edited

Loading

sgibson91 left a comment •

edited

Loading

GeorgianaElena commented Feb 3, 2022 •

edited

Loading

GeorgianaElena commented Feb 3, 2022

choldgraf commented Feb 3, 2022

damianavila commented Feb 3, 2022

GeorgianaElena commented Feb 4, 2022

choldgraf commented Feb 4, 2022

GeorgianaElena left a comment •

edited

Loading

GeorgianaElena Feb 7, 2022

GeorgianaElena Feb 7, 2022

choldgraf commented Feb 7, 2022

GeorgianaElena commented Feb 8, 2022

GeorgianaElena commented Feb 8, 2022

choldgraf commented Feb 9, 2022

GeorgianaElena Feb 9, 2022

GeorgianaElena commented Feb 9, 2022

choldgraf left a comment

choldgraf commented Feb 9, 2022


		There are two details for CILogon accounts worth mentioning:

		- Institutional connection. This is the direct connection with CILogon, negotiated by each institution. When a user logs in via CILogon, they first may choose from a variety of institutions (e.g. `UC Berkeley` or `Australia National University`). There is also a fall-back for "Google OAuth".

DOCS: Document logging out of CILogon #974

DOCS: Document logging out of CILogon #974

Conversation

GeorgianaElena commented Feb 3, 2022

sgibson91 commented Feb 3, 2022

GeorgianaElena commented Feb 3, 2022 • edited Loading

sgibson91 commented Feb 3, 2022 • edited Loading

sgibson91 left a comment • edited Loading

Choose a reason for hiding this comment

GeorgianaElena commented Feb 3, 2022 • edited Loading

GeorgianaElena commented Feb 3, 2022

choldgraf commented Feb 3, 2022

damianavila commented Feb 3, 2022

GeorgianaElena commented Feb 4, 2022

choldgraf commented Feb 4, 2022

GeorgianaElena left a comment • edited Loading

Choose a reason for hiding this comment

GeorgianaElena Feb 7, 2022

Choose a reason for hiding this comment

GeorgianaElena Feb 7, 2022

Choose a reason for hiding this comment

choldgraf commented Feb 7, 2022

GeorgianaElena commented Feb 8, 2022

GeorgianaElena commented Feb 8, 2022

choldgraf commented Feb 9, 2022

GeorgianaElena Feb 9, 2022

Choose a reason for hiding this comment

GeorgianaElena commented Feb 9, 2022

choldgraf left a comment

Choose a reason for hiding this comment

choldgraf commented Feb 9, 2022

GeorgianaElena commented Feb 3, 2022 •

edited

Loading

sgibson91 commented Feb 3, 2022 •

edited

Loading

sgibson91 left a comment •

edited

Loading

GeorgianaElena commented Feb 3, 2022 •

edited

Loading

GeorgianaElena left a comment •

edited

Loading