New issue
Advanced search Search tips

Issue 914366 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Dec 20
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 3
Type: Bug



Sign in to add a comment

[GCPW] possibly update Windows OS username to match changed email of a google account

Project Member Reported by tienmai@google.com, Dec 12

Issue description

When a new user is created using GCPW the email and gaia id for the GCPW created user is added to the registry. Afterwards when the user signs in with the same email we can find the corresponding username to sign in. However if the user changes their email address this association will no longer be valid and the user will lose access to their username. 

We should instead do all user associations via the gaia id which is persistent across all emails instead. 
 
Summary: [GCPW] possibly update Windows OS username to match changed email of a google account (was: [GCPW] support a change in e-mail associated with a particular username)
The credential provider already supports changing email addresses of the Google account.  The following scenario is supported:

1/ Person signs in with the credential provider with google account: gaiaid="12345" and email="foo@gmail.com".
2/ This creates a new Windows OS user with username="foo" and SID="S-1-5-xxx-1001".
3/ Person changes their email address to "bar@gmail.com".  The Google account will retain its gaiaid="12345".
4/ Person signs in again with the credential provider with the same Google account, but this time the person types "bar@gmail.com" as the email during sign in.

The function WaitForLoginUIAndGetResult() returns the information retrieved from the sign in at step 4 as a json object: {gaiaid:"12345", email:"bar@gmail.com",...}.  Note this is the same gaiaid as step 1.

The json object is validated with a call to ValidateAndFixResult(), which in turn calls MakeUsernameForAccount() to map this to an OS user.  MakeUsernameForAccount() notices that there is already a Windows OS user with SID="S-1-5-xxx-1001" mapped to gaiaid="12345" and reuses it.  This SID is used to map to the username="foo".

The credential provider then signs the person to Windows OS user "foo".

We *may* want to change this to rename the Windows OS user to "bar".  ACLs will likely remain OK since the SID won't change.  But there might be other parts of the system that key off the username.

Also, we would need to decide if we also rename the %HOME% directory.  Doing so might make things more consistent but is also likely to break scripts, shortcuts, registry entry and possibly other things keyed off the path.

So all in all I'm not sure renaming the Windows OS user is a good idea.  This is also a very rare use case.  I'll leave this bug open for now with a title that more closely reflects any outstanding work we might want to do.

Adding a note: 

After investigation, the function that maps the gaia ID to SID (GetSidFromId in https://cs.chromium.org/chromium/src/chrome/credential_provider/gaiacp/reg_utils.cc?type=cs&q=getsidfromid&g=0&l=184) does not check the correct registry key to do the mapping so we will need to fix that.

Also we should add a unit test to test the change of email as well. 
Labels: Enterprise-Triaged
Owner: tienmai@chromium.org
Project Member

Comment 5 by bugdroid1@chromium.org, Dec 18

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bbd4d84191c4cc07bab1d4f2ff071f083e65a82b

commit bbd4d84191c4cc07bab1d4f2ff071f083e65a82b
Author: Tien Mai <tienmai@chromium.org>
Date: Tue Dec 18 21:37:34 2018

Fix bug when trying to find a user associated with a given Gaia ID.

Bug:  914366 
Change-Id: Ie7e962e7cb4e095c5994c14dfe47090da72e8f95
Reviewed-on: https://chromium-review.googlesource.com/c/1383199
Reviewed-by: Roger Tawa <rogerta@chromium.org>
Commit-Queue: Tien Mai <tienmai@chromium.org>
Cr-Commit-Position: refs/heads/master@{#617632}
[modify] https://crrev.com/bbd4d84191c4cc07bab1d4f2ff071f083e65a82b/chrome/credential_provider/gaiacp/reg_utils.cc

Status: Started (was: Untriaged)
Project Member

Comment 7 by bugdroid1@chromium.org, Dec 20

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/42eeddf519f351a129ddad1237f92a73a6a6b9a6

commit 42eeddf519f351a129ddad1237f92a73a6a6b9a6
Author: Tien Mai <tienmai@chromium.org>
Date: Thu Dec 20 15:17:37 2018

Add verification of e-mails being signed in using GCPW.

- Remove use of 'ep' registry for e-mail patterns and instead use 'ed' to
specify valid e-mail domains.
- Allow multiple valid e-mail domains
- Check Gaia signed in user has a valid e-mail / gaia id

Bug:  914366 ,  913977 
Change-Id: Icb2a3281f2381d5c64200cafbfb2f452f5d0aecf
Reviewed-on: https://chromium-review.googlesource.com/c/1381726
Commit-Queue: Tien Mai <tienmai@chromium.org>
Reviewed-by: Roger Tawa <rogerta@chromium.org>
Reviewed-by: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#618215}
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/browser/ui/startup/credential_provider_signin_dialog_win.cc
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/browser/ui/startup/credential_provider_signin_dialog_win.h
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/browser/ui/startup/credential_provider_signin_dialog_win_browsertest.cc
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/common/gcp_strings.cc
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/common/gcp_strings.h
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/BUILD.gn
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/gaia_credential_base.cc
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/gaia_credential_base.h
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/gaia_credential_provider.cc
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/gaia_credential_provider_idl.templ
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/gaia_resources.grd
[add] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/gaia_resources_grd/IDS_ACCOUNT_IN_USE.png.sha1
[add] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/gaia_resources_grd/IDS_ACCOUNT_LOCKED.png.sha1
[add] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/gaia_resources_grd/IDS_INVALID_EMAIL_DOMAIN.png.sha1
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/gcp_utils.h
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/os_user_manager.cc
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/reauth_credential.cc
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/reauth_credential.h
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/reauth_credential_unittests.cc
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/reg_utils.cc
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/gaiacp/reg_utils.h
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/test/fake_gls_run_helper.cc
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/test/fake_gls_run_helper.h
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/chrome/credential_provider/test/test_credential.h
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/third_party/win_build_output/midl/chrome/credential_provider/gaiacp/x64/gaia_credential_provider_i.h
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/third_party/win_build_output/midl/chrome/credential_provider/gaiacp/x64/gaia_credential_provider_p.c
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/third_party/win_build_output/midl/chrome/credential_provider/gaiacp/x86/gaia_credential_provider_i.h
[modify] https://crrev.com/42eeddf519f351a129ddad1237f92a73a6a6b9a6/third_party/win_build_output/midl/chrome/credential_provider/gaiacp/x86/gaia_credential_provider_p.c

Status: Fixed (was: Started)
I don't think we will change the windows username. There does not seem to be a programmatic way to migrate the user's profile from one user name to another and it will probably very complicated to do. 
Project Member

Comment 9 by bugdroid1@chromium.org, Dec 20

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b5126abd72308c9760a1f9622d061c33d58ecb6e

commit b5126abd72308c9760a1f9622d061c33d58ecb6e
Author: CJ DiMeglio <lethalantidote@chromium.org>
Date: Thu Dec 20 23:13:01 2018

Revert "Add verification of e-mails being signed in using GCPW."

This reverts commit 42eeddf519f351a129ddad1237f92a73a6a6b9a6.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> Add verification of e-mails being signed in using GCPW.
> 
> - Remove use of 'ep' registry for e-mail patterns and instead use 'ed' to
> specify valid e-mail domains.
> - Allow multiple valid e-mail domains
> - Check Gaia signed in user has a valid e-mail / gaia id
> 
> Bug:  914366 ,  913977 
> Change-Id: Icb2a3281f2381d5c64200cafbfb2f452f5d0aecf
> Reviewed-on: https://chromium-review.googlesource.com/c/1381726
> Commit-Queue: Tien Mai <tienmai@chromium.org>
> Reviewed-by: Roger Tawa <rogerta@chromium.org>
> Reviewed-by: Nico Weber <thakis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#618215}

TBR=rogerta@chromium.org,thakis@chromium.org,tienmai@chromium.org

Change-Id: I82bfd838901dd7cd2730c4a0a1c8d0a4886b4c83
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  914366 ,  913977 
Reviewed-on: https://chromium-review.googlesource.com/c/1387961
Reviewed-by: CJ DiMeglio <lethalantidote@chromium.org>
Commit-Queue: CJ DiMeglio <lethalantidote@chromium.org>
Cr-Commit-Position: refs/heads/master@{#618371}
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/browser/ui/startup/credential_provider_signin_dialog_win.cc
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/browser/ui/startup/credential_provider_signin_dialog_win.h
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/browser/ui/startup/credential_provider_signin_dialog_win_browsertest.cc
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/common/gcp_strings.cc
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/common/gcp_strings.h
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/BUILD.gn
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/gaia_credential_base.cc
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/gaia_credential_base.h
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/gaia_credential_provider.cc
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/gaia_credential_provider_idl.templ
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/gaia_resources.grd
[delete] https://crrev.com/226244e4219e4d1047879025a30aa54ca5b9d590/chrome/credential_provider/gaiacp/gaia_resources_grd/IDS_ACCOUNT_IN_USE.png.sha1
[delete] https://crrev.com/226244e4219e4d1047879025a30aa54ca5b9d590/chrome/credential_provider/gaiacp/gaia_resources_grd/IDS_ACCOUNT_LOCKED.png.sha1
[delete] https://crrev.com/226244e4219e4d1047879025a30aa54ca5b9d590/chrome/credential_provider/gaiacp/gaia_resources_grd/IDS_INVALID_EMAIL_DOMAIN.png.sha1
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/gcp_utils.h
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/os_user_manager.cc
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/reauth_credential.cc
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/reauth_credential.h
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/reauth_credential_unittests.cc
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/reg_utils.cc
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/gaiacp/reg_utils.h
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/test/fake_gls_run_helper.cc
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/test/fake_gls_run_helper.h
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/chrome/credential_provider/test/test_credential.h
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/third_party/win_build_output/midl/chrome/credential_provider/gaiacp/x64/gaia_credential_provider_i.h
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/third_party/win_build_output/midl/chrome/credential_provider/gaiacp/x64/gaia_credential_provider_p.c
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/third_party/win_build_output/midl/chrome/credential_provider/gaiacp/x86/gaia_credential_provider_i.h
[modify] https://crrev.com/b5126abd72308c9760a1f9622d061c33d58ecb6e/third_party/win_build_output/midl/chrome/credential_provider/gaiacp/x86/gaia_credential_provider_p.c

Project Member

Comment 10 by bugdroid1@chromium.org, Dec 20

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/45c88323269838c60dd910cc843949b46601e40f

commit 45c88323269838c60dd910cc843949b46601e40f
Author: CJ DiMeglio <lethalantidote@chromium.org>
Date: Thu Dec 20 23:35:19 2018

Reland "Add verification of e-mails being signed in using GCPW."

This reverts commit b5126abd72308c9760a1f9622d061c33d58ecb6e.

Reason for revert: Breaks build

Original change's description:
> Revert "Add verification of e-mails being signed in using GCPW."
> 
> This reverts commit 42eeddf519f351a129ddad1237f92a73a6a6b9a6.
> 
> Reason for revert: <INSERT REASONING HERE>
> 
> Original change's description:
> > Add verification of e-mails being signed in using GCPW.
> > 
> > - Remove use of 'ep' registry for e-mail patterns and instead use 'ed' to
> > specify valid e-mail domains.
> > - Allow multiple valid e-mail domains
> > - Check Gaia signed in user has a valid e-mail / gaia id
> > 
> > Bug:  914366 ,  913977 
> > Change-Id: Icb2a3281f2381d5c64200cafbfb2f452f5d0aecf
> > Reviewed-on: https://chromium-review.googlesource.com/c/1381726
> > Commit-Queue: Tien Mai <tienmai@chromium.org>
> > Reviewed-by: Roger Tawa <rogerta@chromium.org>
> > Reviewed-by: Nico Weber <thakis@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#618215}
> 
> TBR=rogerta@chromium.org,thakis@chromium.org,tienmai@chromium.org
> 
> Change-Id: I82bfd838901dd7cd2730c4a0a1c8d0a4886b4c83
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug:  914366 ,  913977 
> Reviewed-on: https://chromium-review.googlesource.com/c/1387961
> Reviewed-by: CJ DiMeglio <lethalantidote@chromium.org>
> Commit-Queue: CJ DiMeglio <lethalantidote@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#618371}

TBR=rogerta@chromium.org,thakis@chromium.org,lethalantidote@chromium.org,tienmai@chromium.org

Change-Id: I8888a63d3d14387a954b45cdbc306292ba97059c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  914366 ,  913977 
Reviewed-on: https://chromium-review.googlesource.com/c/1388028
Reviewed-by: CJ DiMeglio <lethalantidote@chromium.org>
Commit-Queue: CJ DiMeglio <lethalantidote@chromium.org>
Cr-Commit-Position: refs/heads/master@{#618374}
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/browser/ui/startup/credential_provider_signin_dialog_win.cc
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/browser/ui/startup/credential_provider_signin_dialog_win.h
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/browser/ui/startup/credential_provider_signin_dialog_win_browsertest.cc
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/common/gcp_strings.cc
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/common/gcp_strings.h
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/BUILD.gn
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/gaia_credential_base.cc
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/gaia_credential_base.h
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/gaia_credential_provider.cc
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/gaia_credential_provider_idl.templ
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/gaia_resources.grd
[add] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/gaia_resources_grd/IDS_ACCOUNT_IN_USE.png.sha1
[add] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/gaia_resources_grd/IDS_ACCOUNT_LOCKED.png.sha1
[add] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/gaia_resources_grd/IDS_INVALID_EMAIL_DOMAIN.png.sha1
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/gcp_utils.h
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/os_user_manager.cc
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/reauth_credential.cc
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/reauth_credential.h
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/reauth_credential_unittests.cc
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/reg_utils.cc
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/gaiacp/reg_utils.h
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/test/fake_gls_run_helper.cc
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/test/fake_gls_run_helper.h
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/chrome/credential_provider/test/test_credential.h
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/third_party/win_build_output/midl/chrome/credential_provider/gaiacp/x64/gaia_credential_provider_i.h
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/third_party/win_build_output/midl/chrome/credential_provider/gaiacp/x64/gaia_credential_provider_p.c
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/third_party/win_build_output/midl/chrome/credential_provider/gaiacp/x86/gaia_credential_provider_i.h
[modify] https://crrev.com/45c88323269838c60dd910cc843949b46601e40f/third_party/win_build_output/midl/chrome/credential_provider/gaiacp/x86/gaia_credential_provider_p.c

Sign in to add a comment