Jazz Forum Welcome to the Jazz Community Forum Connect and collaborate with IBM Engineering experts and users

For unauthenticated users, why do links to private project areas on jazz hub go to an error page instead of an authentication page?

If I log out of jazz hub and use a bookmark to get to my private project Dashboard I am presented with:

Error!
The project <project name> does not exist or is not accessible with your credentials.
If you have JazzAdmins privileges you can investigate the problem in the Jazz Admin Web UI.

Why doesn't it take me to a page where I can authenticate instead?



0 votes



2 answers

Permanent link
I don't know what the correct answer is, but it's clear that there is a security aspect to this: If the system worked as you describe, then I could learn whether a (private) project with a particular name existed by synthetically constructing an appropriate URL. 

0 votes

Comments

Perhaps, although on jazz.net if you construct a link for a non-existant project area you're still prompted for credentials before seeing the same error in my original question.  I'd expect jazz hub to behave the same way.  How else are users in private jazz hub areas sharing links to anything?

Agree there's an issue here. I'll point this thread out to the developers working in that area. 


Permanent link
Hi Brian,

This is something we've discussed:  is it better to acknowledge that a private project exists and prompt for login or is it better to act like a private project doesn't exist? 

It'd be great if you could open an enhancement request in the JazzHub project with your input.  https://hub.jazz.net/ccm01/web/projects/srich%20|%20JazzHub#action=com.ibm.team.dashboard.viewDashboard

0 votes

Comments

Hi Lauren

As I mentioned in my comment to McQ, JazzHub is behaving differently than jazz.net.  Requesting credentials before presenting an error message that says
"Error!
The project <project name=""> does not exist or is not accessible with your credentials"
does not acknowledge the existance of that private project area.  This issue makes links in workitem email notifications unusable in private project areas. 

I've opened defect 15923

1 vote

Hi Brian,

It actually does acknowledge the existence of a private project since we support guest access for public projects on jazz.net. We do not prompt if you land on a public project, so if we did when you landed on a private project, you would know it exists.

I agree, however, that the current behaviour gives a horrible user experience for private project users and that is not okay. In this case I think it might be worth divulging the existence to solve this UX issue.

My comment should read "since we support guest access for public projects on JazzHub" (we do not support guest access on jazz.net).

Thanks Adam.  I'll admit I'm still unsure how taking a user to an authentication page would confirm the existence of a private project area.  Wouldn't it only confirm that there is no public project area with that name? 

Your answer

Register or log in to post your answer.

Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.

Search context
Follow this question

By Email: 

Once you sign in you will be able to subscribe for any updates here.

By RSS:

Answers
Answers and Comments
Question details
× 12,020
× 383

Question asked: Jan 23 '14, 3:02 p.m.

Question was seen: 4,915 times

Last updated: Feb 05 '14, 11:15 a.m.

Confirmation Cancel Confirm