Google account delegated auth fails (worked before)

[Former Member]

Hello,

I use StreamWork for managaing a local allotments. I use my Google account to login and I've been doing this for some time.

However, yesterday I'm unable to login to StreamWork using my Google account. StreamWork throws an error:

The e-mail REMOVEDFORSECURITY@gmail.com is already used by another SAP StreamWork account. Please login with that account to access SAP StreamWork.  Upon login you will be given the option to add your Google credentials (REMOVEDFORSECURITY@gmail.com) to that account.

(I've replaced my real email with REMOVEDFORSECURITY)

Some things to note:

• I can login to my Google Account fine to read and send emails etc. There's nothing wrong with my Google Account.
• I'm using the right Google Account. The feedback from the error message also shows I'm using the right one.
• I've using Firefox and Microsoft IE - reproduce the problem in both
• I've used 2 different computers - repoduce the problem in both
• There's no point pressing the 'reset password' button, as the authentication is delegated to google, and my google account and password is working just fine, but not from StreamWork

the http headers from one of the failed logins is:

https://streamwork.com/session/new

GET /session/new HTTP/1.1

Host: streamwork.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-us,en;q=0.5

Accept-Encoding: gzip, deflate

DNT: 1

Connection: keep-alive

Referer: https://accounts.google.com/ServiceLoginAuth

Cookie: _cstar_user_agent=BAeXMilwhTSNmWQYD6de3U; _12sprints_srv=m26; _cstar_session=c204a1e673ed52c14543e805d16d5d52; BIGipServerstage.streamwork.com-443-pool=217718700.20480.0000; COMETCOOKIE=comet0

HTTP/1.1 200 OK

P3P: policyref="/w3c/policy.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa CONi OUR STP BUS PHY ONL UNI COM NAV INT DEM STA"

Vary: Accept-Encoding

X-Runtime: 39

Etag: "2e6ef784a58b28f7f059fc5634ff1d49"

Set-Cookie: _12sprints_srv=m26; path=/; secure; HttpOnly

Set-Cookie: _cstar_session=c204a1e673ed52c14543e805d16d5d52; path=/; secure; HttpOnly

Content-Type: text/html;charset=utf-8

Content-Encoding: gzip

Date: Tue, 07 Aug 2012 19:15:12 GMT

Server: -

Accept-Ranges: bytes

Cache-Control: no-store

Pragma: no-cache

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Transfer-Encoding: chunked

Connection: Keep-Alive

I have not been able to log into my account for 24 hours and I am the Admin to the site - big problem!

I have tried sending an email to 'security@sapstreamwork.com' and I haven't even had an auto reply for receipt of the emails - is this monitored??

Please can someone tell me what I need to do?

I do have a hotmail.com account that could be used as a 'backup'. I.e. if someone at SAP could add this hotmail.com account to the activity that would work around the problem as I can login to StreamWork using my hotmail.com account (no activities associated with it at the moment)

Thanks

Gill

[RuedigerMueller · Accepted solution]

Hi Gill,

I just did a test and the issue is finally solve for my gmail users. Please give it a try and let me know if you are able to login again.

We discussed the problem with Google and they rolled back the changes which they did to the OpenID service. Google was very responsive after we were able to rule out that the problem is caused by a code change on our side and we told them about the issues.

I am really sorry that it took so long to resolve this issue. Believe me: if I would have been able to provide you with an ETA for the fix I would have done so. The problem did not affect all gmail users and therefore was a bit complicated to track down.

Best regards,

  Rüdiger

[Former Member · Accepted solution]

Hi Rudiger

I have tested the Google Account login and it does work - what a relief!

I have a contingency Admin now on my other account, just in case it happens again.

Thanks for letting me know and for explaining the root of the problem.

Gill

[RuedigerMueller]

Hi Gill,

We cannot hack our database and add users to activities.

I have one more idea for a work around: are there any other users in the activity which you need to access? In that case you can do the following:

• Create a new basic StreamWork user
• Ask the other person to create a new StreamWork activity
• Ask the other person to copy the content of the original activity to the new activity. For each item under "More Actions" you will find the action "Copy To" -> Activity..."

Regards,

  Rüdiger

[Former Member]

That's disappointing that there is no utility to enable this kind of support to users.

While your suggestion is ok, there is no synchronisation and would require another user to support me in making any changes. They might as well just email things to me and vice versa.

So on DAY 7 with no real workaround, do you have an ETA for a fix, please?

And some kind of an apology and explanation of why it has taken so long to resolve would help.

Gill

[RuedigerMueller]

Hi Gill,

What exactly are you doing? Are you following this sequence:

• Go to https://streamwork.com/session/new
• Click on the "Google Account" button
• Get redirected to Google to logon to Google
• Get redirected to StreamWork
• Get the error message above

When you registered for the StreamWork account: did you use a different e-mail address and only map the gmail address in the user settings?

Regards,

  Rüdiger

[Former Member]

Ruediger

That is the workflow I follow, but most times I am already logged into Google so do not need to follow step 3.

When I registered I used my Googel Account straight away; gillian.wignall@gmail.com

Hope that helps

Gill

[RuedigerMueller]

Hi Gill,

I am able to reproduce with my own gmail users. Seems to be a general bug. I am in the process of contacting development to have a look into this. I will keep you posted.

Thinking about a work around for you: are there other users in the activity which you need to access? In that case you could create a new user and ask the other user to invite your new user to that activity.

Sorry for the inconvenience.

Best regards,

  Rüdiger

[Former Member]

Many thanks for that.

As for your suggested workaround I'm not sure this will work. As the activity is set only for my GoogleID Account to invite others. The acitivity is NOT setup to allow anyone to invite anyone.

As mentioned earlier in the thread, I do have a completely seperate, disconnected, unlinked account where I use a different email address to identify me - my hotmail.com account. 

So, may I suggest that someone in SAP adds my hotmail.com account into the activity?

This is a critical issue and is completely BLOCKING my activities to use this system.

This critical BLOCKING issue has been on going for 3 days.

I feel some time has been lost due to inappropriate suggestions being made, for example: resetting a password in StreamWork for an account held by Google; synchroising the password of two completely seperate accounts to be the same,

Now you've confirmed this is a problem on the SAP side, (not on my side) I really must press for a time to when either a workaround will work or when a complete solution is provided. Can you please set my expectation to when you can provide me with a time to when you will have a workaround or a solution please? I repeat, this is a complete BLOCKING issue to using the system.

My personal expectation is that any completely BLOCKING issue should be resolved, or workaround provided within about 120 minutes (2 hours). So far we're on 3 days and counting....

Did anyone test the system before it was rolled out?

Many thanks

Gill

[RuedigerMueller]

Hi Gill,

Engineering is working on the problem. The latest information which I got is that we are getting different data back from th Google ID service than the data which is stored in our DB.

There is no easy fix as we need to find a way to map the information in the database to what is returned by Google right now.

Regards,

  Rüdiger

Reference to other sites having issues with Google ID service removed

[Former Member]

Hi Rudiger

Many thanks for your update.

I wait to hear from you.

Thanks

Gill

[Former Member]

Hi Rudiger

I wanted to check one thing with you, please. Is it possible to have an alternative hotmail account added to an activity?

This would very much help in the interim.

Thanks

Gill

[Former Member]

Hi Rudiger,

Just been reading the link you posted as part of the explanation of the bug caused by Google. It says on that page that this was logged June 2nd 2011. You may want to check that you have posted the correct link - otherwise this looks a bit strange...

By the way, I only started using Streamwork in January 2012.

I did find this doing a simple search on Google for 'google oauth api changes' https://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&sqi=2&ved=0CEgQFjAA&url=https%3A%2... The last time this OpenSource documentation was changed was 26 June 2012; this would suggest that there have not been any changes from the Google side.

Gill

[RuedigerMueller]

Hi Gill,

I asked engineering for any work around. They are aware of this thread and also of your proposal.

Regards,

  Rüdiger

[RuedigerMueller]

Hi Gill,

Yes - the reference which I included was wrong. I have removed it.

You have to search for "Google OpenID issues" and you will find for example a entry from SUSE Studio from August 10, 2012

Rüdiger

[Former Member]

Hi Rudiger

Thanks for your reply.

I did do a Google search for the string you suggest but didnt see any SUSE link in the first page.

Would you mind posting the link please?

Thanks

Gill

[RuedigerMueller]

Hi Gill,

I was refering to this page: http://blog.susestudio.com/2012/08/google-authentication-issues.html

Regards, Rüdiger

[Former Member]

Thanks for that Rudiger - that does help to explain what is going on.

However that does still leave me with a problem - no access. I have asked at least twice if I can have my hotmail account (riverrower@hotmail.com) added to the activity that I use, but everyone has avoided answering the question.

Would you tell me who can do this for me, please? Bearing in mind it is a closed group and controlled only by the Admin.

I started asking for help on Tuesday 7th August and have already missed one deadline, and have 2 more coming up this week (one is a go-live deadline which impacts 50 people). It took until Friday 10th August for anyone to agree with me that the problem was not a user error. No work around has been provided for this blocking issue and there is no ETA for a fix. This is now day SIX.

If there is no URGENT workaround, we will have to remove ourselves from Streamwork - we CANNOT work like this.

I hope you can help

Gill

[Former Member]

Hello Gill,

Streamwork should be accessed using the email address and the StreamWork password. We appreciate if you can change your StreamWork password and google password to be the same. 

Unfortunately we couldn't find your Hotmail account in the streamwork system, we could only find your g-mail account which is of Basic Edition Type.

Please feel free to contact us in case if you have any further questions.

We have a comprehensive Help section( http://www.sap.com/solutions/technology/cloud/streamwork/delivery/help.epx ) which provides online documentation, user guides, tutorials and also a user forum(http://scn.sap.com/community/streamwork/content).

The user forum is always the first recommended channel to get help by connecting with other people using SAP StreamWork. Search this forum first for answers to your questions and to share information with other users.

Many Thanks!

Regards,

Smitha HS
SAP Cloud Support

[Former Member]

Hello Smitha,

Firstly, whilst I have 2 user IDs, one is setup using delegated Google Authentication, the other is using SAP StreamWork 'normal' authentication. The two accounts are just that, 2 completely seperate accounts. They are not and can not use used in conjuction with each other, either at login or within the application. Though, like any two accounts, they can be a member of the same StreamWork Activity.

The purpose of delegated authentication is so there is no need to have a seperate login. The login is delegated to another source, leaving the application to apply its own authorisations. I do not understand that the synchroisation of a password across two completely seperate disconnected accounts could help. This just doesn't make any sense whatsoever. That would be like me having to use the same password as you, just so I could login.

Thank you for pointing out the online help, but I'm not sure improving my understanding is going to help a product problem with the site.  This isn't a user error, or user problem. My workflow has remained the same. It used to work, now it doesn't. No changes made on myside either to workflow, account setup in Google or in StreamWork. The problem, for me, is with the site.

As a workaround I would very much appriciate if you could add my riverrower@hotmail.com account to the activity that is owned by gillian.wignall@gmail.com. Both these seperate accounts are my own accounts.

This is really urgent for me, and I must say I'm really struggling to get some progress here.

Many thanks

Gill

[Former Member]

Hello Gill,

We have addressed your issue to one of our colleague from development team.
We will update you as soon as we receive from them.

Many Thanks!

Regards,

Smitha HS
SAP Cloud Support

[Former Member]

Hello Gill,

Could you please request a password reset for the account to which you cannot login – you just need to follow the link on the login page to reset the password. 

If you have logged in successfully once within 24 hours, then you must wait until the timeout expires to reset the password.  This is for the security to prevent someone hijacking an email address and being able to subsequently reset the StreamWork password.

Also for the workaround you suggested - we have released a new functionality in Q2 Release of streamwork system i.e. “Multiple e-mail addresses in the profile”. So this functionality is basically to add multiple e-mail addresses to the user profile. One e-mail will always be the primary address but the secondary e-mail adressess can be added allowing the user to receive activity invites to mutiple different e-mails. Users can also use these e-mails to login to SAP Streamwork system.

As soon as you reset the password and login to the google account, please add your hotmail address as a secondary e-mail address to your account so that you can login using that account also and can view all the activities.

Please get back to us incase of any issues.

Many Thanks!

Regards,

Smitha HS
SAP Cloud Support

[Former Member]

Hello

So, I have already (on someone else's advice) done a password reset. This DOES NOT work as it is a GOOGLE account NOT an SAP Streamwork account. The password works fine on Google applications so I see no reason to do this.

I would be very happy to associate the hotmail account to my gmail SAP account, if I could get access!!!! This is extremely frustrating, and problematic.

For the group that I administer the documents and SAP Streamwork site, I was the person who encouraged the group to use the software. I am very doubtful now about how much I will encourage it's use. We have a deadline tomorrow and I cannot do my part of the work - we have a big problem.

Would you let me know what timescales the development team are working to on this please?

Gill

[Former Member]

Hi Gill,

you are not alone with this problem!!

Unfortunately I don't have a backup user/mail to login...

I also sent yesterday two mails to 'security@sapstreamwork.com', but without any reaction!!!

Please let me know if you or anyone else has a solution.

Thanks.

Best regards

Matthias

[Former Member]

Hello  Gill / Matthias,

I'm Smitha from Cloud Support and I'm investigating your issue. We will update this discussion as soon as we have some information to help you.

Apologies for the inconvienience caused.

Regards,

Smitha HS
SAP Cloud Support

[Former Member]

Hello Matthias,

We appreciate if you can provide the current e-mail address which you are using for Streamwork system.

Since we found 3 e-mail address in your name and couldn't find which e-mail address you are using currently.

moto_guzy@web.de

Matthias.Guzy@freudenberg-it.com

motoguzy@googlemail.com

We have a comprehensive Help section which provides online documentation, user guides, tutorials and also a user forum.

The user forum is always the first recommended channel to get help by connecting with other people using SAP StreamWork. Search this forum first for answers to your questions and to share information with other users.

Many Thanks!

Regards,

Smitha HS
SAP Cloud Support

[Former Member]

Hello Smitha,

I'm currently using 2 Streamworks as administrator.

One with Matthias.Guzy@freudenberg-it.com, which is still working fine.

The other one with motoguzy@googlemail.com, which is not working any more! This one I normally only accessed by Google-Credentials.

Could you please contact be directly under Matthias.Guzy@freudenberg-it.com.

Thanks a lot.

Best regards.

Matthias