Err, I'll recheck whether the re-login happened, give me several hours (different time zone), it'll be later today. I think it happened, but I'm not sure.

I think we've hit the same issue with @dannycolin yesterday. I was trying to add him into the packager group and we could see him being in the group on accounts.fpo but it never got propagated to src.fpo.

@frostyx The groups are synced on login. So first thing to check if the user logged out and logged in again to refresh groups.

I confirmed, the new person re-tried to log in to src.fpo, but nothing synced there

Okay, it's complicated and unpleasant. Clicking (by the new person) the Log out menu item and then Log In button does not work, the page just shows you logged in with no underground syncing.

The trick is to open the src.fpo page, log out from there, remove src.fedoraproject.org cookies, which logs you out fully, then log in - this time you'll be asked to enter the password, after which the sync of the groups will finally happen.

Playing with the cookies is an unpleasant step ;)

Also login in private browser window should work as well.

Removing cookies should not normally be needed. ;(

Are you sure they were not added to the group on that first relogin? It might not have shown for them until a reload I guess if the page was cached...

I believe the problem is with the quick re-login. You click to "Log out" and it does that, indicated by the "Log In" button now. Then you click the "Log In" button and the page just changes the button to the avatar and that's it. You are not asked for your password, no real login screen, just a state change of the page. I also tried F5 before clicking the Log in button, with no difference.

With removed cookies the login screen appears and the things work as they should, the groups are synced.

Well, thats expected if you have a valid cookie still. Logging out doesn't destroy that... it goes to log you in and sees you already are authenticated so it just does it directly.

If you logout, and quit your browser and restart it, does it ask you for information to login again? (It should)

also if you have a valid kerberos ticket it should redirect you to id and it will see you have a valid ticket and just log you in, you don't need to enter anything then, but you should see a redirect to id there.

Finally, there's a known amusing case: If you go to a page that requires auth... like the settings page and click logout, it will log you out, but the page it tries to redirect you back to requires you to be logged in, so it just logs you back in again. :(

No, clicking logout, closing the browser (all its windows), starting browser and clicking Log In, does not ask for the password - no kerberos ticker for FEDORAPROJECT.ORG active.

I'm affected by the https://pagure.io/fedora-infrastructure/issue/12649 too.

Apparently the session cookie (named 'disgit_pagure' here) is valid for 31 days. It does require https and also being used from the same ip as it was used from before.

I don't understand why the logout button wouldn't delete this cookie.

Can you look that you have it, logout and see if it's still there?

I wonder if it's related to the 12649 issue and it should be ending your session when it's not?

@abompard any ideas here?

Any news here? Are things any different now that the 500s ticket is fixed?

I'm sorry for the delay, I lost track of this.

Can you look that you have it, logout and see if it's still there?

Do you know how to do that with Firefox, please? I can see in the Settings that I have several cookies for the src.fpo, but it does not show me what they are, neither what they contain; or at least I did not find how to do it.

Speaking of which...

No, clicking logout, closing the browser (all its windows), starting browser and clicking Log In, does not ask for the password - no kerberos ticker for FEDORAPROJECT.ORG active.

I'm affected by the https://pagure.io/fedora-infrastructure/issue/12649 too.

I've been happily clicking and commenting in pull requests on the src.fpo, specifically https://src.fedoraproject.org/rpms/at-spi2-core/pull-request/8 and https://src.fedoraproject.org/rpms/at-spi2-core/pull-request/9 . Somewhere in the middle the page decided that I'm logged out - probably the cookie finally expired, I do not know. I clicked on the Log In button and this time I've been asked for my credentials, thus I entered them and when I confirmed them I ended up with:

Unauthorized
mismatching_state: CSRF Warning! State not equal in request and response.

When I close the page and click on the pull request URL and there on the Log In button again, I'm not asked for the credentials, I get the "401 Unauthorized" error immediately. I closed the browser and opened the pull request URL from scratch and it did not let me in either.

Huh.

Well, to find the cookie:

control-shift-i to open the web inspector
storage tab
cookies
look for the 'distgit_pagure' cookie.

But that cookie is supposed to be valid for 31 days. So I don't understand why it would have expired for you, or why you are now getting a unauthorized. ;(

@abompard any ideas on this one ?

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/infra/tickets/issues/12643

Please continue any further discussion there.