Some external auth systems generate invalid usernames, that should be prevented.

[hexylena]

Reported to @cat-bro as it was noticed on UseGalaxy.org.au, but I think it's a more general issue. One user's username includes a space. It's blocking access to their histories.

• https://usegalaxy.org.au/u/Wossen Mengesha/h/metabarcodingedna-through-obitools
• https://usegalaxy.org.au/u/Wossen+Mengesha/h/metabarcodingedna-through-obitools
• https://usegalaxy.org.au/u/Wossen%20Mengesha/h/metabarcodingedna-through-obitools

all 404.

Diagnosis

You cannot manually enter a space, it's coming from their external authentication system most likely.

Remediation

We should fix it on the external auth side. Additionally it would make sense to ensure that when usernames come from external authentication systems, that they are properly mangled or just error, forcing the galaxy admin to choose a safer field that doesn't include prohibited values, or some automatic transformation for that field.

[dannon]

Same thing happens when keycloak tries to use the email as the username IIRC -- foo@foo.com gets set instead of a mangled version.

[cat-bro]

Of 25K users on Galaxy Australia, 800 or so have spaces in their usernames. It's unconventional, but is this a problem for any other reason than the fact that history link urls are not being urlencoded/decoded by galaxy? That would not be hard to fix.

[dannon]

We could 'fix' the urls to encode, but I think that just perpetuates a problem where we don't want usernames with spaces. What we discussed in a recent backend WG meeting was to address the creation issue (i.e. -- new users from external auth will be created with usernames following the spec that is enforced for 'normal' user creation) and to provide a gxadmin command or script to 'fix' existing usernames with spaces.

[cat-bro]

I'm seeing a lot of illegal punctuation in usernames as well, (),'&~ et cetera

[hexylena]

It's unconventional, but is this a problem for any other

I think spaces will be an issue for anyone running as real user as well, and LDAP + real user is a common combination (xref #11270 which @nsoranzo debugged to be a username mangling from external auth)

I'm seeing a lot of illegal punctuation in usernames as well, (),'&~ et cetera

mildly terrifying

[hexylena]

Can confirm that EU's all look safe

galaxy=> select username from galaxy_user where username ~ '^.*[^a-zA-Z0-9_.-]+.*$';
 username 
----------
(0 rows)

[cat-bro]

I think spaces will be an issue for anyone running as real user as well

Yikes, yes that would be a big problem