virtualbox.org switching to single sign on

This is for discussing general topics about how to use VirtualBox.
klaus
Oracle Corporation
Posts: 1115
Joined: 10. May 2007, 14:57

virtualbox.org switching to single sign on

Post by klaus »

More improvements coming up for the virtualbox.org websites!

A tiny bit of the change has already happened a while ago, when SSL support was added. The biggest remaining change is following the same tune, tightening security while keeping things essentially unchanged and easy to use.

Both https://www.virtualbox.org and https://forums.virtualbox.org will move away from using a local authentication database to Oracle Single Sign On. Finally one login for both sites (and many others if you already have an Oracle SSO account). It eliminates the risk of account information theft in the case someone manages to break in.

This brings a small inconvenience for everyone who doesn't yet have an Oracle SSO account: you need to create one. Anyone can get this without being an Oracle customer of any kind.

Go to https://myprofile.oracle.com/ and use "sign up a new account".

The plan is to complete the change sometime in January 2012. So there's plenty of time left for you to get an Oracle SSO login, to be prepared once the change is made.

All the content (bug reports, forum posts) will stay in place, and the moderation style will be unchanged. Everyone can keep their nick name/alias, and new users can pick whatever is free.

I hope everyone makes this small step. Oracle is supporting the open source community around VirtualBox by providing the infrastructure and by keeping it open source.

Thanks.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: virtualbox.org switching to single sign on

Post by mpack »

I do have one question...

Looking ahead, what would happen if Oracle sold VirtualBox? After all, VBox has changed hands twice in the last few years. I just want to make sure that I couldn't end up being locked out of my own forum account if that ever happened.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: virtualbox.org switching to single sign on

Post by mpack »

Hmm. There seems to be an awful lot of personal information "required" in order to sign up for an Oracle account.
klaus
Oracle Corporation
Posts: 1115
Joined: 10. May 2007, 14:57

Re: virtualbox.org switching to single sign on

Post by klaus »

mpack wrote:Looking ahead, what would happen if Oracle sold VirtualBox? After all, VBox has changed hands twice in the last few years. I just want to make sure that I couldn't end up being locked out of my own forum account if that ever happened.
If that would happen (not that it seems likely right now, but we can't predict the future) we'd have to work out a transition back to a different authentication source. Very similar to the transition which is ahead. The forum/trac applications actually still have account information, so this migration will remain possible. I can't see a way to lock out the community.
johnelee
Posts: 40
Joined: 27. May 2009, 16:24
Primary OS: MS Windows XP
VBox Version: PUEL
Guest OSses: ubuntu

Re: virtualbox.org switching to single sign on

Post by johnelee »

Unsurprisingly, perhaps, it seems to be oriented towards business use as part of a named company. For personal use what should one fill in for company etc?

John
Perryg
Site Moderator
Posts: 34369
Joined: 6. Sep 2008, 22:55
Primary OS: Linux other
VBox Version: OSE self-compiled
Guest OSses: *NIX

Re: virtualbox.org switching to single sign on

Post by Perryg »

johnelee wrote:Unsurprisingly, perhaps, it seems to be oriented towards business use as part of a named company. For personal use what should one fill in for company etc?
John
The standard "NA" (not applicable) work on fields that need to have something in them but do not apply.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: virtualbox.org switching to single sign on

Post by mpack »

Well, I finally got around to doing it, and as Perry suggested I used NA or "other" for employment fields. I was unhappy to be required to give my address details however, or be asked the other stuff at all. I await with interest any evidence that this is a portal for junk mail and spam.

Ok, that's done, now what? I didn't see anything about creating nicknames for particular sites. Nothing immediately obvious in my profile here either. I take it that's not done yet. How is this going to work?
Ken Hagan
Posts: 43
Joined: 1. Oct 2009, 17:42
Primary OS: Debian other
VBox Version: PUEL
Guest OSses: Windows (various)
Location: UK

Re: virtualbox.org switching to single sign on

Post by Ken Hagan »

I don't suppose *any* of the following lies within the powers of the VBox people, but if my experience is very different from other people's then I'd be interested to know...

The https://myprofile.oracle.com/ link doesn't work in Opera. You get a page that just says "System error. Please re-try your action. If you continue to get this error, please contact the Administrator.". I've managed to set up an account using IE, but I'm not in the habit of using web sites that have specific browser requirements. I thought the internet had grown out of that one.

The web page states that passwords are limited to alphanumeric but that the only *requirement* is for 8 characters or more and a mixture of upper and lower case letters. However, my experience is that you must include a digit as well. The page should say.

Lastly, I too didn't find anything about nicknames. There's a "change user name" link, but that requires the form of an e-mail address. Since the email address presumably needs to be valid, I expect some people will be reluctant to use it as their displayed name.
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: virtualbox.org switching to single sign on

Post by mpack »

Ken Hagan wrote:I'm not in the habit of using web sites that have specific browser requirements
I used Firefox, not IE, with no problems - so any specificity probably isn't at the website end.
Sasquatch
Volunteer
Posts: 17798
Joined: 17. Mar 2008, 13:41
Primary OS: Debian other
VBox Version: PUEL
Guest OSses: Windows XP, Windows 7, Linux
Location: /dev/random

Re: virtualbox.org switching to single sign on

Post by Sasquatch »

Ken Hagan wrote:The https://myprofile.oracle.com/ link doesn't work in Opera.
That's a reason for me to not sign up at all. I don't want to have to start a VM just to register or whatnot. I also refuse to install another browser on my main PC, because Opera is all I use. If this is what is required to be able to post here, then I won't be here for long as a posting member (and thus probably won't visit the forums at all).
Ken Hagan wrote:The web page states that passwords are limited to alphanumeric but that the only *requirement* is for 8 characters or more and a mixture of upper and lower case letters. However, my experience is that you must include a digit as well. The page should say.
Look again at the limitation, alphanumeric. It means the alphabet and numbers. But indeed, it should say that the password has to contain the full spectrum, not just a subset (alphabet or numbers only). This also shows that they try to avoid a way to hack the system, you're not allowed to enter special characters that could be used for SQL injection attacks. Should we consider this a good thing, or a lazy man's solution?
mpack wrote:I used Firefox, not IE, with no problems - so any specificity probably isn't at the website end.
The Oracle website never worked too well in Opera. It's written to work in IE, and FF just adds some/a lot of hacks to their engine to cope with (bad) code.
Read the Forum Posting Guide before opening a topic.
VirtualBox FAQ: Check this before asking questions.
Online User Manual: A must read if you want to know what we're talking about.
Howto: Install Linux Guest Additions
Howto: Use Shared Folders on Linux Guest
See the Tutorials and FAQ section at the top of the Forum for more guides.
Try searching the forums first with Google and add the site filter for this forum.
E.g. install guest additions site:forums.virtualbox.org

Retired from this Forum since OSSO introduction.
abcuser
Volunteer
Posts: 590
Joined: 10. May 2007, 20:03
Primary OS: Ubuntu other
VBox Version: PUEL
Guest OSses: Ubuntu, Windows XP

Re: virtualbox.org switching to single sign on

Post by abcuser »

I recently added single-sign-on in my company. It was required to do automatic transfer of all users into new system, pain but was done. I think all users from forum/bug tracker should be automatically added into Oracle single-sign-on. Please stop wasting end-users time. Also if not done correctly A LOT of users will stop using forum, because of a bother... I used to be a forum administrator and setting up a new system that required a new login and web site has lost more then 70% of end-users. And needed long long time to get them back - get new users instead.

Just wondering, if I want to register with new name, will I be able to join the forum and specially bag tracker (to my bugs reported)? Will there be some user mappings or something? If not, what happens if my user id is already taken by some other user, will that user potentially have access to my bug tracker account?
Sasquatch
Volunteer
Posts: 17798
Joined: 17. Mar 2008, 13:41
Primary OS: Debian other
VBox Version: PUEL
Guest OSses: Windows XP, Windows 7, Linux
Location: /dev/random

Re: virtualbox.org switching to single sign on

Post by Sasquatch »

The way I see it, is that your username is linked to your email address. So it should not be possible for, let's say, me, to register as you and 'steal' your account, because our email addresses don't match. I hope that there will be a link between users using the email address your register with.

I also hope that users that already have an account here and are active are automatically migrated to OSSO. If only a small set of information is needed to get a working OSSO account, I bet it can be automated because all the information is already in the forum database. It would be email address, username and password. Possibly location, as that is also a requirement of OSSO, some have that filled in. For the migration, users get an email with an activation link so they can activate their account for OSSO, create a password and then automatically get linked with the forum. That way, users who frequent this forum don't have to sign up on another system (it's done automatically) and just need to verify/activate.
It is very likely that a situation will arise that abcuser explained: users don't want to register again and just leave. I've already noted that I would.
Read the Forum Posting Guide before opening a topic.
VirtualBox FAQ: Check this before asking questions.
Online User Manual: A must read if you want to know what we're talking about.
Howto: Install Linux Guest Additions
Howto: Use Shared Folders on Linux Guest
See the Tutorials and FAQ section at the top of the Forum for more guides.
Try searching the forums first with Google and add the site filter for this forum.
E.g. install guest additions site:forums.virtualbox.org

Retired from this Forum since OSSO introduction.
Ken Hagan
Posts: 43
Joined: 1. Oct 2009, 17:42
Primary OS: Debian other
VBox Version: PUEL
Guest OSses: Windows (various)
Location: UK

Re: virtualbox.org switching to single sign on

Post by Ken Hagan »

OK, so we are now in the middle of the move. Fortunately the forums haven't gone over yet, so I am still able to post this.

The SSO still doesn't work with Opera and I wouldn't be at all surprised if it wasn't connected with the W3C validation errors that the SSO page contains.

Is no-one at Oracle even embarrassed about this?
Perryg
Site Moderator
Posts: 34369
Joined: 6. Sep 2008, 22:55
Primary OS: Linux other
VBox Version: OSE self-compiled
Guest OSses: *NIX

Re: virtualbox.org switching to single sign on

Post by Perryg »

You can get Opera to work with OSSO.

Right click on the page and edit site preferences. Go to network and change the Browser Identification to IE or FireFox.
Sasquatch
Volunteer
Posts: 17798
Joined: 17. Mar 2008, 13:41
Primary OS: Debian other
VBox Version: PUEL
Guest OSses: Windows XP, Windows 7, Linux
Location: /dev/random

Re: virtualbox.org switching to single sign on

Post by Sasquatch »

Sites that use browsersniffing are the worst. I hate it when webdevs discriminate between IE, FF, Opera and others. Some throw faulty code on purpose for certain browsers (mostly Opera). Having to alter the browser identification just to get a site working means I won't visit it any more.
Read the Forum Posting Guide before opening a topic.
VirtualBox FAQ: Check this before asking questions.
Online User Manual: A must read if you want to know what we're talking about.
Howto: Install Linux Guest Additions
Howto: Use Shared Folders on Linux Guest
See the Tutorials and FAQ section at the top of the Forum for more guides.
Try searching the forums first with Google and add the site filter for this forum.
E.g. install guest additions site:forums.virtualbox.org

Retired from this Forum since OSSO introduction.
Post Reply