Confirming New Users

colinrymer

Summary:

An active member of our team that is a manager in the Owners, Administrators, and Recovery group is unable to confirm new members. The confirmation of new members was also attempted while they were just a regular member in the listed groups. When they click the confirm button on the invitations page, they get the following error:

What I Expect:

When a member of the Administrators group clicks confirm on a Pending Confirmation, the pending user is confirmed.

What Happens:

The member sees an error popup informing them the operation is not permitted.

Steps to Reproduce:

1. Create new teams account.
2. Invite new member
3. Add confirmed new member to Administrators, Owners, and Recovery groups.
4. Have new member invite additional new members.
5. Have new member confirm pending new members.

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided

rob

Hi, @colinrymer.

Thanks so much for the report! I spent some time looking at your account, finding the error logs on our server, and chatting with another developer on how this could be happening. Basically, we know why it isn't working, but we can't figure out how things got into that state. I could not reproduce the issue by following your steps.

The short answer to the problem is that if you remove this person from the Administrators Group and then add him back, he should be able to confirm new members as usual.

Somehow things got into a bad state on our server so that it thinks he doesn't have a certain permission when he really does. As I said, we've not been able to reproduce this issue ourselves, so if you see it again, could you let us know? It appears that the user in question is the only one on your team with this problem, so it seems to be a pretty rare issue that is probably caused by specific circumstances, and we just haven't figured out what yet.

ref: #1048

colinrymer

I was able to reproduce the issue by

1. removing the person from the Administrators, Owners, and Recovery groups
2. adding them back to all three at the same time
3. making them a manager of all three groups

I was then able to fix the issue by removing them from just the Administrators group and then adding them back (I've since made them a manager as well, but they were able to confirm users before and after that change).

rob

Very interesting. Thanks, @colinrymer! I'm going to have another go at this today and see what I can find.

rob

Ok, we're tracking it down. It does appear to be a race condition caused by multiple simultaneous requests to the server. @ssoroka is on the case! :)

ssoroka

Just an update: We've identified the issue and have a plan to fix it. As a temporary work-around, you can remove the user from all groups, then add the user to the Administrators, Owners, and Recovery groups one at a time instead of all three at once, and it will resolve the problem. This is inconvenient for now, but if you're stuck, it'll un-stick you. :) We should have it fixed up properly soon.

Steven