@chad you have been successfully destroyed :-)

Also @philippe.jadin if you could delete my test accounts there, it would be so nice. ?

I have a theory on what's going on here but need to poke at it.

My thought here is, Phabricator on the initial auth screen is trying to load the image resource when you register, and it's getting set in SESSION. So when you do finally auth, you get redirected to it.

On the last redirect, you can see COOKIE got set to redirect to the image.

Whatever auth I try on your server, I get redirected to an image. For Google and Facebook, it redirected me to the Project Icon. For GitHub, it redirected to my GitHub image. I did a Charles to see if I could spot anything, but maybe @epriestley knows how to read these better than I.

I have not been able to reproduce this on this install or my local install.

Support Impact This is just completely broken and possibly destroys or mangles data.

Support Impact Conduit can not represent some messages (e.g., diffs with non-utf8 text), which has no workaround, and is very difficult to use relative to other APIs.
High Support Impact Waiting on this makes it harder to deprecate the old stuff (since it will be more widely deployed) and may mean we need to convert or modernize more methods.

This isn't ideal, but it's also not something we can prioritize right now.

We should support T5603 before allowing projects to be left via Conduit, because at least one major install assumes bots can't leave projects (which is currently true).

I'm going to assume Evan figured out what happened here. Please feel free to reopen with more details! :)

Yeah, that's reasonable, especially if other users don't hit this. I haven't seen other reports of anything smilar.

@hartman - would really appreciate any information you can provide in case epriestley didn't deduce what happened correctly. thanks!

I've been using this for a while and it seems to work well.

D9389 has some discussion and context of binary wire encodings.

Erk, wrong button.

✘ Merged into T4377.

T3980 has the most interesting requirements (like cache behavior.)

administrators can not create accounts associated with LDAP accounts.

Actually, I'm even more confused because administrators can not create accounts associated with LDAP accounts.

If you don't have LDAP set up and can't repro it with username/password, I can take a shot with LDAP (I have it set up and it's enormously painful and complicated to set up, or at least it was for me).

Yes, with his LDAP credentials.

security.require-multi-factor-auth seems to satisfy this for now. We can provide more granular alternatives later if use cases arise.

✘ Merged into T5579.