As a cloud.gov tenant developer, when I login I should have reminder for the CLI interaction.

[pburkholder]

---

Security considerations

[note any potential changes to security boundaries, practices, documentation, risk that arise directly from this story]

Implementation sketch

Probably just a template changes, but ¯_(ツ)_/¯.

[bengerman13]

@pburkholder you mean we should have the cf login ... stuff after you log in to account.fr.cloud.gov without going to one of the reset pages?

[pburkholder]

I was slacking with someone today who's an occasional cloud.gov developer. And he started with, "Well, I think the first step is to login to cloud.gov" but then he ended up at the page shown here (minus) the CLI tip, and he was "Oh crap, what's the CLI command I need to run????" So he suggested we put that command on that page for folks who probably have also forgotten the CLI command.

…

On Wed, Feb 24, 2021 at 3:49 PM Ben Berry ***@***.***> wrote: @pburkholder <https://github.com/pburkholder> you mean we should have the cf login ... stuff after you log in to account.fr.cloud.gov without going to one of the reset pages? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#171 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJHWCSAMKXTOYTTNNYN24LTAVQ5RANCNFSM4YFHEVJA> .

-- - *Peter Burkholder | **cloud.gov <https://cloud.gov> compliance & security* please use cloud-gov-compliance@gsa.gov for cloud.gov matters *202-709-2028 <(202)%20209-2028> | peter.burkholder@gsa.gov <peter.burkholder@gsa.gov> * *| pronouns he-him <https://www.mypronouns.org/he-him>* *Free/Busy Calendar <https://calendar.google.com/calendar/embed?src=peter.burkholder@gsa.gov>*

[pburkholder]

This is the login page you get now.

[bengerman13]

that landing page is part of uaa (login.fr.cloud.gov), not uaa-extras (account.fr.cloud.gov) :/
I think this issue really belongs on the upstream UAA release

uaa-extras really just runs:

• invite
• first login
• password reset
• TOTP reset

and for all of those flows, I think, you end up somewhere else when you're done. If folks are going to account.fr.cloud.gov, logging in, and then looking for what to do next, I think our problem is earlier in the flow than the landing page

[pburkholder]

Hmmm, this template must live somewhere in our code base, right? But if it's not a quick fix, maybe not worth doing.

[bengerman13]

not the one you sent a screenshot of - that's the upstream UAA project. This repo is a standalone app that just runs account.fr.cloud.gov

[pburkholder]

OK, so if we want to add passcode to the uaa screen we'd do so in our cf-release repository, and it may or may not be possible to customize https://github.com/cloudfoundry/uaa-release/blob/develop/jobs/uaa/spec to include additional text.

I don't know which repo we control is relevant to what's shown on the uaa homepage. Can you point me to the right place, @bengerman13

[bengerman13]

We might be able to jam it in here: https://github.com/cloud-gov/uaa-customized-boshrelease

OTOH, looking at the upstream, we might also be able to get rid of that repo (unless we implement the changes you're suggesting)