Review what shows in user account info and what can be changed

[mercecrosas]

@eaquigley @mheppler we'll review what should be shown in the user account and what they can or can't change.

From @scolapasta

Usability:

• what we show the users. We decided we needed to show users something unique and so opted for showing the useridentifier. The fact that it shows with a @ can indeed be confusing, we discussed that, but decided it was lower priority for the 4.0 release. However we did discuss several issues of not displaying the @ (easy to strip out) and handling the other prefixes (& and :) in a different manner. One such solution was to group users and groups separately, using a primefaces feature to the auto complete, but we also did not implement that because we first need to upgrade primefaces (there is a github issue for this).
• can users change user names / identifiers? We decided to not allow users to change this. Whether we want to or not can still be up for debate*. If we do, then it would make sense for sure to separate these as the identifier is used to assign roles. As Michael pointed out there were technical reasons for this (supported role assignees, some of which are internal). Of course, we can revisit this like we can revisit anything, but this was something that was thought out and thoroughly discussed (and yes, there were differing opinions).

This is issue is not about the technical issues related to this (although they need to be taken into account):

Technical:

• the issue of how we reference role assignments, discussed briefly above
• this particular user (and others like him): in this case really, there is no reason we just don't allow '.' and maybe some other characters as usernames. So then that will work. If no one has objections, I will add that for the next patch (some time today).

[scolapasta]

We should discuss what exactly we mean for this issue.

[pdurbin]

Related: 2015-04-30 Dataverse User Accounts and Auth Meeting

[pdurbin]

As of Dataverse 4.2.3, when users log in via Shibboleth and click on "Account Information" they see "You are logged in through your institution. If you need to update any of this information, please contact your institution." Here's a screenshot:

We like to show something that looks more like what a builtin/local user sees (but they won't be able to edit anything for "phase 1" of the next round of Shibboleth development):

[eaquigley]

Notes on the page in the above screenshot from 2/11 Design Review of Shibboleth:

• Render position to not appear since it won't have a value
• Leave this text above filled out account information: You are logged in through your institution. If you need to update any of this information, please contact your institution.
• If possible, make API Token a tab on account page and remove the Edit Account Information button for remote auth users

[pdurbin]

I'm just copying a comment from @eaquigley from #2915 (comment) to this issue since that issue is about API stuff and this issue is about UI stuff (different parts of the code):

"Additionally, we discussed adding a line of text into the UI on Create Account and Account Information pages to direct them to the user guide to learn more about converting their remote account into a local account if they are leaving their university."

[eaquigley]

@pdurbin gave us a demo of what this currently looks like:

Comments from @mheppler and me:

• remove tool tips from view mode (pass to @mheppler for help with fixing an existing bug with this)
• have user identifier be username (for consistency with built in account page)
• strip out @ for the username

[pdurbin]

In b317365 I changed the following:

• Get values from AuthenticatedUser rather than BuiltIn user (except I show username for builtin users and "useridentifier" for Shib users with the @ removed. Shibboleth users don't have a username per Users are unable to change their username #1445).
• Never show Position for Shib users (it's never populated)

I deployed this to https://shibtest.dataverse.org if anyone would like to check it out.

@mheppler I'm giving this issue to you to work on tooltips, etc. that we talked about. Please make your changes to the (2939-shib branch) but please be aware that I'll be continuing to make changes there as well (so you'll want to pull the latest before committing and pushing.) My understanding is that we want:

• non-broken tooltips when builtin users are editing their info
• better wording for tooltips when in "view" mode (Shib users shouldn't see "the name you would like to use since they can't directly change it)
• a better bundle key name than user.toEditDetail (I left a TODO about this)

As a reminder, you can fake out your development environment to log in as a Shibboleth user with a dev setting: http://guides.dataverse.org/en/4.2.4/developers/dev-environment.html#shibboleth . Without this you won't be able to see what Shibboleth users will see. Only "RANDOM" is documented but you can also use "HARVARD1" if you want the same user over and over when you visit http://localhost:8080/shib.xhtml

@eaquigley there's a note about "direct them to the user guide to learn more about converting their remote account into a local account if they are leaving their university". Are you planning on letting me know when you've added this to the User Guide (I'd suggest using the same branch that @mheppler and I are working on, mentioned above. Also, please not that I'm planning on deferring any work related to the API token page.

@michbarsinai when playing with the code I made some direct edits to my database to make the builtin username different from the corresponding authenticateduser "identifier". To my surprise, this meant that I was no longer able to log in as this user. The code seemed to be trying to create a new user when I attempted to log in. Anyway, I thought this was all very strange and thought I'd mention it. I guess we'll deal with this if someone requests a username change (due to marriage or divorce or whatever) which is mentioned in #1445.

[mheppler]

Revised text for Shibboleth users on the Account Information pg, added a link to the Contact Dataverse Support popup. Also added this link to the error message text for 404 and 403 errors.

[pdurbin]

@mheppler I left a note about regression testing 404 and 403 errors in #2939 but I couldn't quickly figure out how to trigger a 403 error. Any advice?

Update: Nevermind. Just log in with a user who doesn't have access to an unpublished dataverse and try to visit it (i.e. http://localhost:8080/dataverse/birds ) and make sure you get the 403.

[pdurbin]

I'm moving this issue to QA. There's lots of stuff in the initial description/comment for this issue but what we've done on the account page for pull request #3025 is:

• Allow Shibboleth users to view (but not edit) their account information. (Prior to pull request Shibboleth: Remote Authentication Phase 1 #3025 they would only see "You are logged in through your institution. If you need to update any of this information, please contact your institution.")
• Indicate that users should contact Support if they are leaving their institution.

[kcondon]

This is working as described but the Support popup does not include the check for robots equation's operands: 2+3= shows up as +=

[pdurbin]

@kcondon unfortunately, the math challenge started being broken in 4.3 and it's gotten worse in the Shib branch. I just opened #3036 about this. Thanks for the heads up.

[pdurbin]

@scolapasta I'm giving this issue to you. Please see my comment at #3036 (comment) .

[kcondon]

OK, since the only remaining issue in this ticket was opened in a new ticket, 3036 (thanks phil) we can close this one. The 4.3 issue is only on the Notifications tab in the initial welcome email, there is a link to Support, was not aware of changes there. Noticed it here because shib changes added more places for this link and so triggered explicit test.

Closing.