It sounds like this is resolved. We almost certainly can not raise a more specific exception.

I found problem, because I type fully LDAP DN (cn=root,dc=example,dc=domain) as Username at Import from LDAP.
but if there could have any error message will be better.

Sorry, meant OAuth support instead of OpenID. The gist of it was delegate authentication to a dedicated system. Be it via OpenID, OAuth, SAML, etc.

Phabricator also does not support OpenID and we specifically declined to support it in T524#35252.

In T8787#177689, @siepkes wrote:

My 2 cents; I wouldn't spent too much time on implementing various authentication schemes for Phabricator like Yubikey, U2F, password with SMS or whatever flavour of authentication comes out tomorrow. Since Phabricator supports OpenID such authentication schemes can easily be delegated to IAM solutions like GLUU, OpenAM, KeyCloak, etc.

Now it might be a good idea to make a tutorial showing how to install KeyCloak with Phabricator to get U2F support but actually trying to be an IAM seems like a waste of time and duplication of effort.

My 2 cents; I wouldn't spent too much time on implementing various authentication schemes for Phabricator like Yubikey, U2F, password with SMS or whatever flavour of authentication comes out tomorrow. Since Phabricator supports OpenID such authentication schemes can easily be delegated to IAM solutions like GLUU, OpenAM, KeyCloak, etc.

In HEAD of master, keys now have a detail screen which shows a transaction record. Clicking the key name will take you there:

Here's my technical plan on this:

This SQL query will map all users that don't have an LDAP mapping, allowing them to log in using LDAP as long as their LDAP username matches their Phabricator username.

OK so they have to make it at step 3, before his first session expires, otherwise I'd have to update it directly in DB.

They can link their accounts in Settings → External Accounts.

OK for the security feature, but in my case LDAP is the only auth provider (username/password is disabled), so my users can't link their accounts.

This is expected. This is a security feature, not a bug. Just because you have a Phabricator user account named joe does not mean you have authority over the LDAP user account named joe, and vice versa. In many cases LDAP and Phabricator user account names differ. Users must prove they have control over external accounts by linking them before they can use those external accounts to access Phabricator.

I didn't see anything related in recent changelogs, so I didn't update out instance.
But if you could wait a couple of days, I could try to reproduce.

Is the issue reproducible with an updated version of Phabricator?

(☞ﾟヮﾟ)☞ Prioritized ☜(ﾟヮﾟ☜)

Very minor technical note: we can't support this for all providers. The username + password, LDAP, and I think Persona (although see T10125) providers can't initiate a login flow with a redirect (since the user has to type stuff or do javascriptey things, not just navigate to a URI).

sure.

Should I file a separate task for the general feature request?

That feature exists, but it's currently only supported for the Phabricator provider. There's no technical reason we can't support it on other providers, it was just built very narrowly for a Phacility (SAAS) use case and it was simpler to keep it narrowly scoped:

Unsure if fits into this task or not but with only a single auth provider enabled for login it would be nice if it were transparent (and got automatically selected) rather than requiring the user to press a button.

This is now deployed and appears to be working.

The workflow to set a password on an account which does not have one is:

This report doesn't have enough information for us to move forward or resolve it. See Providing Reproduction Steps for help with writing complete, self-contained reproduction steps that we can follow to reproduce an issue.

The Fedora QA phabricator instance uses persona and has been using it since December 2014.

Sounds good. Let us know if you run into anything else.

Thanks @epriestley, it makes sense what you say.

You can register an event listener for the TYPE_AUTH_WILLREGISTERUSER event. We are generally moving away from this system, but it works today and I don't have any near-term plans to replace it in this case. This is the documentation:

I've an old generation one. The first three generations weren't U2F.

It's also worth noting that newer yubi keys have a u2f support that doesn't require third party server integration. Which may be more palatable?

You can "Award Token".

Came here to request this feature, searched for it, found it. Multiple LDAPs over here. Is there some kind of +1 technology over here so you know how many people come here to request it?

This was probably implemented in rP51d2d06e3722ad807be588dc894e8d0f0e8be076

How can i use DiffusionBrowseController.php to brow my files with non-latin character names correctly?