SSO on dotcom: Allow Local Users to Access AT Sites Without Being Logged into wp.com

[mrfoxtalbot]

Impacted plugin

Jetpack

Quick summary

When a local user tries to log into a WordPress.com, they are required to sign up for WordPress.com and log in first.

The only exception is Classic Interface sites, where users can visit /wp-admin and log in without logging into WordPress.com

This is a significant departure from the dotorg experience and can be extremely confusing. I would argue that Local users should be able to access any AT sites (Classic or Default) without the need to log into WordPress.com first.

More context in p1724253856166289-slack-C048CUFRGFQ and pc4f5j-4IL-p2where

Steps to reproduce

1. Create a Local Users on a Default Interface Site (example.com)
2. Open an incognito window, visit example.com/wp-admin
3. Notice how you are redirected to https://wordpress.com/log-in and asked to login there first.

A clear and concise description of what you expected to happen.

Visiting example.com/wp-admin should work out of the box on ALL Atomic sites.

What actually happened

I got redirected to dotcom and the credentials I had been given did not work

Impact

All

Available workarounds?

Yes, difficult to implement

If the above answer is "Yes...", outline the workaround.

No response

Platform (Simple and/or Atomic)

Atomic

Logs or notes

No response

[jeherve]

cc @mmtr who recently worked on #38996.

[mmtr]

I think my biggest concern is whether we might be introducing an unexpected regression because we've been redirecting to the wpcom login instead of showing the wp-admin login since 2017 (https://github.com/Automattic/wpcomsh/pull/24, originally requested here: p58i-4Uy-p2#comment-34443).

Said that, there is a more targeted approach to handle this that should be relatively safe:

• If the Atomic site does NOT have local users:
  • Always redirect to the wpcom login
• If there are local users (and regardless of whether the admin interface is Default or Classic):
  • Redirect to the wpcom login if the user comes from Calypso
  • Show the wp-admin login otherwise

@mrfoxtalbot do you think this can work?

[github-actions[bot]]

Support References

This comment is automatically generated. Please do not edit it.

• [ ] p58i-4Uy-p2#comment-34443
• [ ] pc4f5j-4Ky-p2#comment-4456

[mrfoxtalbot]

Enabling this no-dotcom login only on sites that have local users would bridge this gap, sure.

Do you see any other potential issues or ramifications if we go forward with this?

Thanks again @mmtr!

[mmtr]

Do you see any other potential issues or ramifications if we go forward with this?

Nothing specific. It just feels like a change big enough to have unexpected regressions, so we need to monitor things carefully and be sure that everyone in Happiness is aligned with this change.

[mrfoxtalbot]

a change big enough to have unexpected regressions, so we need to monitor things carefully and be sure that everyone in Happiness is aligned

I agree. I am going to review other SSO-related issues, look at the user feedback we already have https://github.com/Automattic/wp-calypso/issues/88410#issuecomment-2309722300, and talk to HEs to make sure we tackle this with enough perspective.

I will share an update (probably a PT P2) soon. Thanks again, @mmtr.

[mrfoxtalbot]

P2ed here pc4f5j-4Ky-p2

[mmtr]

Just increased the priority of this one to High, since it seems it has been a massive pain point for a long time now.

I'll start working on a solution straight away while we gather more feedback in the post above, so we can ship it in a few days if we don't get any advice against it.

[mrfoxtalbot]

Thank you, @mmtr! Do you have anyone in mind whose approval would be a good confidence check?

[mmtr]

@mrfoxtalbot I don't 🙁 I just hoped someone with enough background to weigh in your P2 post, so I pinged @obenland and @jmdodd directly (pc4f5j-4Ky-p2#comment-4456), just in case they are aware of more scenarios in which the enforced wpcom logic is necessary.