Cannot assign user name "username" to account 1000255; name already in use.
Jelly
Server Error
Cannot assign user name "x00175420" to account 1000255; name already in use.
Jelly
Edwin Kempin
I know this problem from our internal system and I've spent some time
looking at it.
I'm not sure that everythink I'm saying now is correct, but this is
how I explained it to myself ;-)
First of all Gerrit treats user names as case sensitive, while LDAP doesn't.
Let's say in LDAP you have the user in lower case "x00175420", then
with this entry LDAP accepts "x00175420" and "X00175420" as username.
On first login to Gerrit the user types in his user name and Gerrit
queries LDAP for it. Since LDAP is case-insensitive about the
username, the LDAP authentication succeeds regardless if the Gerrit
user typed in his username in lower or upper case.
The username in the case as it is typed in by the Gerrit user is then
stored in 'account_external_ids' -> 'gerrit' , while the username in
the case as it comes from LDAP is stored in 'account_external_ids' ->
'username'.
'account_external_ids' -> 'gerrit' is the username that is used for
the login to the Gerrit WebUI. Since Gerrit treats the username as
case-sensitive "x00175420" and "X00175420" are different users for
Gerrit, however for both users LDAP would return the username in the
same case. Since 'account_external_ids' -> 'username' must be unique
the creation of the second user fails with error message that you see:
"Cannot assign user name "x00175420" to account 1000255; name already
in use." (why 1000255 is displayed as account_id I can't say, this
looks indeed strange and might be a bug)
As consequense of this every user has to decide on the first login to
Gerrit which case he want to use and then to login always with this
case.
Best regards,
Edwin
2011/8/26 Jelly <sino...@gmail.com>:
> --
> To unsubscribe, email repo-discuss...@googlegroups.com
> More info at http://groups.google.com/group/repo-discuss?hl=en
>
Mariusz Kozłowski
First of all Gerrit treats user names as case sensitive, while LDAP doesn't.
same case. Since 'account_external_ids' -> 'username' must be unique
Nasser Grainawi
Regards,Mariusz
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en
Employee of Qualcomm Innovation Center, Inc.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum
Edwin Kempin
http://code.google.com/p/gerrit/issues/detail?id=485 [1] only ensured
that the creation of a new account fails if the ldap name is already
in use ('account_external_ids' -> 'username'). So this change actually
introduced the error message about which we are discussing here.
Before this change the situation was even worse, because Gerrit simply
created a new account for the user whenever the login was done with a
different case. Unfortunately there was an exception during the
creation of the new accounts (because the ldap name was already in
use) which was ignored, so that the result was an inconsistent account
which was not fully usable. You can imagine how users were confused by
this. Depending on the case they used for the login they were seeing
different dashboards and for some of their accounts they got strange
exceptions on certain operations.
I think to finally fix the whole issue Gerrit should be able to match
usernames case-insensitive (e.g. by configuration).
[1] https://review.source.android.com/17446
2011/8/30 Nasser Grainawi <nas...@codeaurora.org>:
Edwin Kempin
we are currently trying to make the login to Gerrit case-insensitive
(at least in case LDAP is used as authentication type). We prepared 2
commits, one to make the login to the WebUI case-insensitive [1] and
another one to make the authentication for git operations (git over
http and git over ssh) case-insensitive [2]. Unfortunately RSAC is
still down and it's unclear when it comes back, so we can't push the
commits for review. However we would like to get early feedback if
this goes into the right direction and whether there is a chance to
get it approved. Maybe there are also better ideas how to implement
it. The code is available in github, it would be nice if somebody can
have a look at it.
Thanks and best regards,
Edwin
[1] https://github.com/EdwinKempin/gerrit-case-insensitive-login/commit/5e295e55e66717d3430514710abfd359122e4f27
[2] https://github.com/EdwinKempin/gerrit-case-insensitive-login/commit/e6b40363d344da428c9b587e174746cbe26bee32
On 31 Aug., 07:43, Edwin Kempin <edwin.kem...@gmail.com> wrote:
> No, the fix that was done forhttp://code.google.com/p/gerrit/issues/detail?id=485[1] only ensured
> that the creation of a new account fails if the ldapnameis already
> introduced the error message about which we are discussing here.
> Before this change the situation was even worse, because Gerrit simply
> which was not fully usable. You can imagine how users were confused by
> this. Depending on the case they used for the login they were seeing
> different dashboards and for some of their accounts they got strange
> exceptions on certain operations.
>
> I think to finally fix the whole issue Gerrit should be able to match
> usernames case-insensitive (e.g. by configuration).
>
> [1]https://review.source.android.com/17446
>
> 2011/8/30 Nasser Grainawi <nas...@codeaurora.org>:
>
>
>
>
>
>
>
> > On Aug 26, 2011, at 12:59 AM, Mariusz Kozłowski wrote:
>
>
> >> First of all Gerrit treatsusernames as case sensitive, while LDAP
>
> > True. We had the same case here as we have both linux and windows users and
> > both have their habits. Windows users tend to login with small letters while
> > linux users use capitalized login. LDAP returns capitalized uid and that
> > causes gerrit to not accept lowercase logins.
> > [...]
>
> >> same case. Since 'account_external_ids' -> 'username' must be unique
>
> > What I do here is periodically import data from LDAP to gerrit and then run
> > 'fixup' script that creates additional entries in 'account_external_ids'. So
> > for example:
> > 'Foo Bar' has login (uid) 'F.Bar' in LDAP and in 'account_external_ids' we
> > have such mappings:
> > 1000532 | | |
> > username:F.Bar
> > 1000532 | F....@company.com | | gerrit:F.Bar
> > 1000532 | F....@company.com | | gerrit:f.bar
> > This seems to work well.
>
> > just not noticing it anymore.
> > Nasser
>
> > Regards,
> > Mariusz
> > --
> > To unsubscribe, email repo-discuss...@googlegroups.com