Moving to Ubuntu Single Sign On

Question

We're planning to replace the Launchpad provider button with the Ubuntu SSO in the near-ish future. This will require a bit of shuffling, including a brief period where neither button is shown on /users/login.

Why the unavailability?

Basically, there's not a real way for us to map existing Launchpad credentials to new Ubuntu SSO ones (although the logins, and backing database, are the same). Canonical* is willing to help us out, taking a snapshot of the Launchpad creds and giving us the equivalent Ubuntu SSO ones. For those in the OpenID know, this is providing a Launchpad Claimed ID -> Ubuntu SSO Claimed ID map.

In order to do this completely, we need to deter new registrations with Launchpad for the duration of the migration; so we'll remove the Launchpad button. Once the mapping is done, we'll replace it with an Ubuntu SSO one.

How will this work?

At the end of the migration, everyone currently with Launchpad credentials will have both Launchpad and Ubuntu SSO credentials.

Like so:

When will this happen?

Soon... ish, think days not weeks (fingers crossed). There are still some logistics to be worked out.

Hopefully once under way it'll take minutes, if it takes longer we'll put up a system message.

If you have any concerns or objections please raise them here.

_{*Many thanks to Marco and Jorge for getting us a technical contact.}

Answer 1

For what it is worth, it should be possible to deduce the Ubuntu SSO identity URL from a Launchpad profile page.

Taking my own Launchpad profile page as an example, I can grab the OpenID discovery information about it:

$ curl -H 'Accept: application/xrds+xml' https://launchpad.net/~jamesh
<?xml version="1.0"?>
<xrds:XRDS xmlns="xri://$xrd*($v*2.0)"
           xmlns:xrds="xri://$xrds"
           xmlns:openid="http://openid.net/xmlns/1.0">
  <XRD>
    <Service priority="0">
      <Type>http://specs.openid.net/auth/2.0/signon</Type>
      <URI>https://login.launchpad.net/+openid</URI>
      <LocalID>https://login.launchpad.net/+id/xxBzhNG</LocalID>
    </Service>
    <Service priority="1">
      <Type>http://openid.net/signon/1.1</Type>
      <URI>https://login.launchpad.net/+openid</URI>
      <openid:Delegate>https://login.launchpad.net/+id/xxBzhNG</openid:Delegate>
    </Service>
    <Service priority="2">
      <Type>http://openid.net/signon/1.0</Type>
      <URI>https://login.launchpad.net/+openid</URI>
      <openid:Delegate>https://login.launchpad.net/+id/xxBzhNG</openid:Delegate>
    </Service>
  </XRD>
</xrds:XRDS>

So my profile page delegates to the identity URL https://login.launchpad.net/+id/xxBzhNG.

As login.launchpad.net is basically just a reskinning of Ubuntu-SSO rather than an independent service, my identity URL on Ubuntu-SSO is https://login.ubuntu.com/+id/xxBzhNG.

So it would theoretically be possible to determine what identity URLs to add using only publicly available information.