New issue
Advanced search Search tips

Issue 630317 link

Starred by 9 users

Issue metadata

Status: Fixed
Owner: ----
Closed: Aug 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 3
Type: Bug

Blocking:
issue 347825



Sign in to add a comment

Chrome should reauthenticate the user with the correct username if alternate UPN is used

Project Member Reported by vabr@chromium.org, Jul 21 2016

Issue description

OS: Windows

What steps will reproduce the problem?
(1) Use a User Principal Name (UPN) different from the one used with AD Domain Name.
(2) Save a random password on https://rsolomakhin.github.io/autofill/
(3) Open chrome://settings/passwords, locate the password, click the password field and the Show button.

What is the expected output?
Chrome should ask you to reauthenticate with your OS password and should show you the stored password upon you entering the correct OS password.

What do you see instead?
Some reports on  bug 347825  indicate that Chrome might be asking for the username associated with AD Domain Name, which prevents the user to successfully meet the challenge.

This bug needs to gather some reproduction steps, more detailed than above. If you have this issue, please share the information about your set-up.
 

Comment 1 by vabr@chromium.org, Jul 21 2016

More info: This issue has been addressed in the past: https://codereview.chromium.org/34393007. We might be looking for corner cases or not straightforward instances of the above described set-up.
Hi.

I came here from  issue 347825 , it's impossible for me to see my saved passwords.

I'm using a corporate account which uses a LDAP server to provide authentication. My domain requires a userid and a password, so when I  want to look at my Chrome password (i.e. I click on the Show button) I expect to receive a query for my credentials (uid and password).

Instead, Chrome shows me my first and last name (which I can't change, I guess it's the displayName field in LDAP) and asks for my password. This way it's not possible to authenticate, so I can never see my stored passwords.

Comment 3 by jmun...@gmail.com, Jul 25 2016

Same issue.  When attempting to "Show" my passwords in "Manage Passwords", Google first asks for my Windows login but the user name in the dialog box is my display name, not my user id.  So it doesn't matter what password I type in; it doesn't work.  Please fix!  I've been storing passwords here for years and I know very few of them myself.

Comment 4 by reueli...@gmail.com, Jul 28 2016

Same issue. Enterprise environment. Get prompted to enter credentials for lastname, firstname. However, we do not use any such arrangement for user names and have no passwords to authenticate with this prompt. The fact that you cannot disable the extra authentication step to show your passwords is ridiculous.

Comment 5 by ps.an...@gmail.com, Aug 4 2016

Hi, /flags/#password-manager-reauthentication flag is missing on my chrome. I wanted to disable it so that i can look up the passwords 
Chrome ver:
OS Version Windows 10
I think the issue is in the way the user credentials are passed. It should be the domain/username and just not the "username" (see the snapshot) and this is the reason the password every time returns back as "Logon Invalid"
password_issue.jpg
70.3 KB View Download
password_issue2.jpg
51.4 KB View Download
Project Member

Comment 6 by bugdroid1@chromium.org, Aug 5 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/17b08b10ca345c198389f062ef0f24b7b9a2a6ab

commit 17b08b10ca345c198389f062ef0f24b7b9a2a6ab
Author: metaflow <metaflow@yandex-team.ru>
Date: Fri Aug 05 07:04:26 2016

Fix browser not revealing user password in some cases.

LOGON32_LOGON_NETWORK mode requires user account to have
"Access this computer from the network" privilege which could be revoked
for several reasons.
LOGON32_LOGON_INTERACTIVE makes more sense for our case as it requires
"Log on Locally" privilege.
The code is invoked only occasionally and there will be no performance hit
of switching from network to interactive logon.

References:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa378184(v=vs.85).aspx
http://www.codeproject.com/Articles/21050/Security-User-Impersonation
https://www.bitvise.com/wug-logontype

BUG= 506862 , 630317 

Review-Url: https://codereview.chromium.org/2196613002
Cr-Commit-Position: refs/heads/master@{#410009}

[modify] https://crrev.com/17b08b10ca345c198389f062ef0f24b7b9a2a6ab/chrome/browser/password_manager/password_manager_util_win.cc

Comment 7 by vabr@chromium.org, Aug 5 2016

Status: Fixed (was: Unconfirmed)
Thanks to metaflow@yandex-team.ru, who could also reproduce the issue, the fix just landed as #6 here. It should be in Canary in about 2 days, it will take longer to reach the other Chrome channels (dev, beta, stable).

I will mark this issue as fixed, meaning that the code change deemed necessary was made. If you still spot the issue on Canary on 7 August 2016 or later, please comment here, stating the version information (from about:version) and what exactly do you see. If the issue turns up to exist after the fix, I'll reopen the bug.

I will also reopen the bug if any performance issues come up, as the trade-off mentioned in the fix is using a slower API.

Sign in to add a comment