Bug 16027 - Safari can't interact with Mac OS keychain for 'Site login' at Plone 3 portals with OpenID Authentication Support 1.0-b1 installed
Summary: Safari can't interact with Mac OS keychain for 'Site login' at Plone 3 portal...
Status: RESOLVED INVALID
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.4
: P4 Minor
Assignee: Nobody
URL:
Keywords: InRadar, NeedsReduction
Depends on:
Blocks:
 
Reported: 2007-11-17 03:54 PST by Graham Perrin
Modified: 2007-12-18 10:51 PST (History)
3 users (show)

See Also:


Attachments
Standalone page demonstrating the issue (119.17 KB, text/html)
2007-11-18 03:19 PST, Mark Rowe (bdash)
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Graham Perrin 2007-11-17 03:54:50 PST
WebKit nightly and Safari fail to interact with Mac OS keychain for 'Site login' at Plone 3 portals with OpenID Authentication Support 1.0-b1 installed

See http://dev.plone.org/plone/ticket/7373

This may be perceived as an issue with WebKit nightly. 

If you'd like access to a server on which the issue is reproducible, just ask.
Comment 1 Mark Rowe (bdash) 2007-11-17 08:53:09 PST
What version of Safari are you using?
Comment 2 Graham Perrin 2007-11-17 15:38:54 PST
Safari 3.0.4 (523.12)
Comment 3 Mark Rowe (bdash) 2007-11-17 15:44:27 PST
We'll need access to a site on which we can reproduce this before we can investigate this issue.

The use of the keychain happens entirely at the Safari level, so I suspect that this may need to be moved to Radar.  Doing some preliminary investigation here wouldn't hurt though and would provide a bit of information for any others that hit this problem.
Comment 4 Graham Perrin 2007-11-18 03:03:36 PST
(In reply to comment #3)

> We'll need access to a site on which we can reproduce this before we can
> investigate this issue.

Investigators may register themselves at 
<http://perrin.redirectme.net:8080/> - that's my laptop, not an ideal 24/7 test environment, but it'll do for starters. 
Comment 5 Graham Perrin 2007-11-18 03:16:10 PST
See my additional comment at 
http://dev.plone.org/plone/ticket/7373#comment:4

I wonder whether the design of the (alternate) login dialogues is contributory to the issues. 
Comment 6 Mark Rowe (bdash) 2007-11-18 03:19:00 PST
Created attachment 17364 [details]
Standalone page demonstrating the issue

Thanks for the URL. I've attached a standalone version of the log-in page that can be used.

Steps to reproduce:
1) Load page.
2) Click "Site login".
3) Enter username/password.
4) Confirm that you wish Safari to save your password.
5) When page finishes loading, click "Site login" again.
6) Note that username/password is not autofilled.

The issue here is that the username/password box are hidden when the page is loaded, so Safari will not see them when doing it's autofill.  This is now definitely a Safari issue so I will migrate this bug to Radar.
Comment 7 Mark Rowe (bdash) 2007-11-18 03:20:15 PST
Also adding NeedsReduction keyword because I didn't do much reducing of the test case: only enough to remove all external dependencies.
Comment 8 Mark Rowe (bdash) 2007-11-18 03:21:13 PST
<rdar://problem/5607170>
Comment 9 Mark Rowe (bdash) 2007-11-18 03:21:56 PST
Closing as INVALID to reflect that the issue here is outside of WebKit.  Thanks for the bug report.
Comment 10 John Sullivan 2007-12-04 14:59:45 PST
Note this comment from Mark:

The issue here is that the username/password box are hidden when the page is
loaded, so Safari will not see them when doing it's autofill.

That's a security change in Safari 3. It's possible that Safari might one day find another way to address this kind of issue, but for now the best bet is for the site to be redesigned to have the username/password fields visible when the page loads.
Comment 11 Graham Perrin 2007-12-04 17:06:20 PST
Thanks, I'll post a note to 
Plone Core Developers 
http://www.nabble.com/Core-Developers-f6745.html for their consideration. 
Comment 12 Graham Perrin 2007-12-18 10:51:07 PST
Re http://dev.plone.org/plone/ticket/7373#comment:9 Plone may be customised to work around the issue. 

Re http://dev.plone.org/plone/ticket/7373#comment:14 I have bug-reported to Apple, but as this behaviour is associated with 

> a security change in Safari 3

I don't imagine that Apple will revert auto-complete behaviour to suit the design of such pages.