<div dir="ltr"><div><div>That's really cool and clearly works. <br></div>However, non-staff would be confused when they see that Okta sign in. In fact, how do non-staff sign in at all?<br><br></div>Either way, I think I would like to use FxA. Isn't that a project we're trying to promote in general in the company?<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Nov 23, 2015 at 6:23 PM, Daniel Coates <span dir="ltr"><<a href="mailto:dcoates@mozilla.com" target="_blank">dcoates@mozilla.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">There's a demo of the current progress here:<br>
<a href="https://123done-dcoates.dev.lcip.org" rel="noreferrer" target="_blank">https://123done-dcoates.dev.lcip.org</a> with code here:<br>
<a href="https://github.com/dannycoates/123done/tree/google-auth" rel="noreferrer" target="_blank">https://github.com/dannycoates/123done/tree/google-auth</a><br>
<div class="HOEnZb"><div class="h5"><br>
On Mon, Nov 23, 2015 at 1:59 PM, Ryan Kelly <<a href="mailto:rfkelly@mozilla.com">rfkelly@mozilla.com</a>> wrote:<br>
> On 24/11/2015 05:07, Sean McArthur wrote:<br>
>> +dev-fxacct<br>
>><br>
>> We are working on figuring this out for the company. It's looking like<br>
>> the solution for sites that require employee accounts can use Google<br>
>> Sign In, and require it to use okta.<br>
><br>
> Indeed, IIUC Danny has put together a working demo of this using<br>
> Google's OpenID Connect login flow, which bridges to Okta and thus auths<br>
> against LDAP for @<a href="http://mozilla.com" rel="noreferrer" target="_blank">mozilla.com</a> addresses.<br>
><br>
> We'll see about putting together a little how-to for other folks to try<br>
> out, I hear it was pretty painless to set up.<br>
><br>
><br>
> Cheers,<br>
><br>
> Ryan<br>
><br>
><br>
>> On Mon, Nov 23, 2015, 9:49 AM Peter Bengtsson <<a href="mailto:pbengtsson@mozilla.com">pbengtsson@mozilla.com</a><br>
>> <mailto:<a href="mailto:pbengtsson@mozilla.com">pbengtsson@mozilla.com</a>>> wrote:<br>
>><br>
>> For the record, we wouldn't interface with Workday at all. Only<br>
>> <a href="http://ldap.mozilla.org" rel="noreferrer" target="_blank">ldap.mozilla.org</a> <<a href="http://ldap.mozilla.org" rel="noreferrer" target="_blank">http://ldap.mozilla.org</a>>.<br>
>> (How <a href="http://ldap.mozilla.org" rel="noreferrer" target="_blank">ldap.mozilla.org</a> <<a href="http://ldap.mozilla.org" rel="noreferrer" target="_blank">http://ldap.mozilla.org</a>> gets populated is<br>
>> out of context).<br>
>><br>
>> On Mon, Nov 23, 2015 at 12:18 PM, Schalk Neethling<br>
>> <<a href="mailto:sneethling@mozilla.com">sneethling@mozilla.com</a> <mailto:<a href="mailto:sneethling@mozilla.com">sneethling@mozilla.com</a>>><br>
>> wrote:<br>
>><br>
>> > As long as it does not do a 'if in workday' pass or else you shall not<br>
>> > pass :)<br>
>> ><br>
>> > Geo contractors are not in Workday.<br>
>> ><br>
>> > On Mon, Nov 23, 2015 at 6:47 PM, Peter Bengtsson<br>
>> <<a href="mailto:pbengtsson@mozilla.com">pbengtsson@mozilla.com</a> <mailto:<a href="mailto:pbengtsson@mozilla.com">pbengtsson@mozilla.com</a>>><br>
>> > wrote:<br>
>> ><br>
>> >> Suppose you use Persona to auth people to your site. Given that<br>
>> someone<br>
>> >> manages to log in with a @<a href="http://mozilla.com" rel="noreferrer" target="_blank">mozilla.com</a> <<a href="http://mozilla.com" rel="noreferrer" target="_blank">http://mozilla.com</a>> (or<br>
>> foundation or mozilla-jp)<br>
>> >> they've<br>
>> >> proven they're active staff.<br>
>> >> If they leave the company, most likely their access to your site,<br>
>> under a<br>
>> >> staff email address, should cease. E.g. logging in to Air Mozilla<br>
>> to see<br>
>> >> staff live events. Persona took care of that as each new session got<br>
>> >> checked against the provider (e.g. <a href="http://mozilla.com" rel="noreferrer" target="_blank">mozilla.com</a> <<a href="http://mozilla.com" rel="noreferrer" target="_blank">http://mozilla.com</a>>).<br>
>> >><br>
>> >> If we switch to FxA we lose this automatic check that Persona<br>
>> used to do.<br>
>> >> You OAuth sign in a user and set her cookie to last X weeks and<br>
>> she'll be<br>
>> >> signed in for X weeks. How do you kill that session cookie if she no<br>
>> >> longer<br>
>> >> has ability to check check email to her @<a href="http://mozilla.com" rel="noreferrer" target="_blank">mozilla.com</a><br>
>> <<a href="http://mozilla.com" rel="noreferrer" target="_blank">http://mozilla.com</a>> address?<br>
>> >><br>
>> >> Is there already an established solution for this?<br>
>> >><br>
>> >> If not, I'd be up for writing a central solution for talking to our<br>
>> >> <a href="http://ldap.mozilla.org" rel="noreferrer" target="_blank">ldap.mozilla.org</a> <<a href="http://ldap.mozilla.org" rel="noreferrer" target="_blank">http://ldap.mozilla.org</a>> (which is a derivative<br>
>> of Workday).<br>
>> >> We can either stand up a service that your server can query or we can<br>
>> >> stand<br>
>> >> up a service that can webhook-post to you.<br>
>> >><br>
>> >> What do you think?<br>
>> >><br>
>> >><br>
>> >> --<br>
>> >> Peter Bengtsson<br>
>> >> Mozilla Web Engineering<br>
>> >> _______________________________________________<br>
>> >> dev-webdev mailing list<br>
>> >> <a href="mailto:dev-webdev@lists.mozilla.org">dev-webdev@lists.mozilla.org</a> <mailto:<a href="mailto:dev-webdev@lists.mozilla.org">dev-webdev@lists.mozilla.org</a>><br>
>> >> <a href="https://lists.mozilla.org/listinfo/dev-webdev" rel="noreferrer" target="_blank">https://lists.mozilla.org/listinfo/dev-webdev</a><br>
>> >><br>
>> ><br>
>> ><br>
>> ><br>
>> > --<br>
>> > Kind Regards,<br>
>> > Schalk Neethling<br>
>> > Senior Front-End Engineer<br>
>> > Mozilla ::-::<br>
>> ><br>
>><br>
>><br>
>><br>
>> --<br>
>> Peter Bengtsson<br>
>> Mozilla Web Engineering<br>
>> _______________________________________________<br>
>> dev-webdev mailing list<br>
>> <a href="mailto:dev-webdev@lists.mozilla.org">dev-webdev@lists.mozilla.org</a> <mailto:<a href="mailto:dev-webdev@lists.mozilla.org">dev-webdev@lists.mozilla.org</a>><br>
>> <a href="https://lists.mozilla.org/listinfo/dev-webdev" rel="noreferrer" target="_blank">https://lists.mozilla.org/listinfo/dev-webdev</a><br>
>><br>
>><br>
>><br>
>> _______________________________________________<br>
>> Dev-fxacct mailing list<br>
>> <a href="mailto:Dev-fxacct@mozilla.org">Dev-fxacct@mozilla.org</a><br>
>> <a href="https://mail.mozilla.org/listinfo/dev-fxacct" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/dev-fxacct</a><br>
>><br>
> _______________________________________________<br>
> Dev-fxacct mailing list<br>
> <a href="mailto:Dev-fxacct@mozilla.org">Dev-fxacct@mozilla.org</a><br>
> <a href="https://mail.mozilla.org/listinfo/dev-fxacct" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/dev-fxacct</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr">Peter Bengtsson<br>Mozilla Web Engineering<br></div></div>
</div>