SSO: set option when someone sees a JITM helping them to discover SSO.

[jeherve]

Fixes #10692

Changes proposed in this Pull Request:

• At first SSO login, set an option
• If that option is true, display an SSO JITM.
• Once the SSO JITM has been displayed, set the option to false so it can never be displayed again

Testing instructions:

• Enable SSO on your site.
• Log out.
• Log back in, using SSO.
• See the banner in the screenshot above.
• Never see it again if you refresh / log out and log back in.

Note that for the CTA link to work, we still need to add the link on WordPress.com (see discussion in D22220-code)

Proposed changelog entry for your changes:

• SSO: offer message introducing the feature to new users.

[jetpackbot]

Thank you for the great PR description!

When this PR is ready for review, please apply the [Status] Needs Review label. If you are an a11n, please have someone from your team review the code if possible. The Jetpack team will also review this PR and merge it to be included in the next Jetpack release.

Scheduled Jetpack release: January 10, 2019.
Scheduled code freeze: January 3, 2019

Generated by 🚫 dangerJS against 3753e33

[matticbot]

D22373-code. (newly created revision)

[keoshi]

JITM shows up correctly, but I have some notes:

• The copy in the banner feels very weird to me. We mention “signed in”, “sign on”, “Logging in”, “log-in”, and “sign in” in just two sentences — this could use some simplification. @michelleweber Could you give us a hand with this copy, please?

You've successfully signed in with WordPress.com Secure Sign On!
Logging in with the same log-in credentials you use for WordPress.com ensures you always sign in to self-hosted WordPress.org sites quickly and securely.

• The Learn more button redirects to https://wordpress.com/plans/[site_url].

[michelleweber]

You've successfully signed in with WordPress.com Secure Sign On!
With Secure Sign On, you use your WordPress.com username and password to access self-hosted WordPress sites quickly and securely.

A question, though -- I don't understand why we need the second line of text here. If they see this after they log in using SSO, that means that they have enabled SSO. So why do we need to sell them on its benefits if they're already using it?

[keoshi]

Thanks @michelleweber!! I think the goal is to reinforce the benefit, highlighting the provided value.

[jeherve]

With Secure Sign On, you use your WordPress.com username and password to access self-hosted WordPress sites quickly and securely.

A question, though -- I don't understand why we need the second line of text here. If they see this after they log in using SSO, that means that they have enabled SSO. So why do we need to sell them on its benefits if they're already using it?

I think the goal is to reinforce the benefit, highlighting the provided value.

With that in mind, I almost preferred the original copy for that second sentence, since it was doing a bit more than just describing the feature; it was listing an additional advantage you would get since you turned that function on.

[keoshi]

I don't disagree, @jeherve — the copy just feels very dense and technical to me in addition to very inconsistent with the “sign in/on, log in/-in” language.

[michelleweber]

Honestly, I'd delete the line entirely and just have the success message. The quasi-promotional tone feels off to me here since the feature is already enabled. At most, I'd do a second line along the lines of "Interested in learning more about how Secure Sign on keeps your site safer?" and linking to the details to make it educational.

If it's important to you to keep it, I'd still use the rewritten line, which says the same thing as the original: you get to use the same credentials, it's fast, it's safe. If you prefer the original, that's fine; I'd just shorten the first part of the sentence to the simpler "Signing on with your WP.com credentials..." And be consistent re: sign on vs. sign in.

[jeherve]

Thank you! I've updated the notice accordingly:

[brbrr]

Tests well! 🐑

[jeherve]

I deployed D22220-code to add the link to the SSO support page.

[rickybanister]

A jitm wasn't exactly what came to mind to address @annezazu's original concern here. I don't fully recall the original concern, but I kind of feel like the right place to reassure someone in using SSO is when they turn on the setting. If they managed to finally login using it, there seems no value in showing them a message linking them to a support document that explains something they presumably already know.

Can we remove this jitm?

[joanrho]

@rickybanister your notes from your original P2 post (p6TEKc-2m8-p2, item 5.17):

WordPress.com login—more reassurance that it’s a safer way to login would be good once you’ve successfully logged in.

You can view @annezazu's original suggestion about this in her demo video at 13:26.

[rickybanister]

Yes, I reread my note from the thread.

I'm not sure that the feedback from @annezazu and the root problem are solved by a just-in-time-message after login has happened. When I reviewed this PR (albeit very late) I noticed that the experience is sort of like:

1. Enable SSO presumably because you understood what it means and how it works (obviously we can't take this for granted)
2. End your WordPress session
3. Start a new session and see the SSO screen (or wpcom login if not logged in) instead of the wp-admin login
4. Authenticate
5. See a message at the top of the screen telling you what you presumably know (you've successfully logged in) and if you'd like you can now read a support document explaining how it worked

Upon thinking about this further I don't find that flow to be more reassuring. Perhaps there is work we can do in settings to better explain SSO and also on the SSO auth screen (a big lock icon perhaps). We also don't do much of anything to make it easy to activate 2fa, even though we make it easy to require it. Those are areas I feel we could provide more impact and reassurance. I'm reminded of Google's approach to security audits—every six months or so they log you out and after you log back in your session is hijacked and you're forced to reconfirm your personal information and verify certain details to keep your account safe. It feels like a lot, but I feel like they have my back as far as security goes.

[jeherve]

Enable SSO presumably because you understood what it means and how it works (obviously we can't take this for granted)

I would assume that most site owners actually enable SSO as part of Jumpstart. They consequently don't really know they are enabling it, they are just clicking a button to enable all our recommended features.