The lookup before your password, and why it cannot recognise you

Most sign-in pages ask for an address and a password on the same screen. Rutba asks for the address first, and looks something up before anybody types a password: where this address signs in.

When we wrote the first version of this post, that question had two possible answers: Rutba’s own sign-in, or, for a company whose workspace kept its own, the company’s. Since 24 September there is one sign-in for the whole suite, so for every organisation we host the answer is now the same door. The lookup still runs first, and the two properties below are why it is worth describing anyway.

The domain, and nothing else

The lookup uses the domain of the address and nothing else. A verified company domain that is not a public email provider can name an organisation; an organisation with no live sign-in of its own, or a suspended one, answers as nobody’s: naming the organisation would tell a stranger the domain is ours while sending them nowhere useful.

The same answer for an address that does not exist

This lookup runs in front of somebody who has not signed in, which makes it the most exposed thing in the whole journey. If it could tell a real address from an invented one, it would be a free service for checking whether a person works somewhere: run down a list of names at a company, keep the ones that answer differently, and you have a phishing target list.

So nothing on this path takes a person, a membership, or the local part of an address. It takes the domain. Two addresses at one domain cannot produce different answers, however hard a caller pushes, because the difference between them is never read. That is a property of the shape rather than a promise about behaviour, which is the only kind worth publishing.

A real address and an invented one at the same domain must answer identically. And they do, because nothing on the path ever looks at the address.

A directory outage is not a sign-in outage

If the lookup cannot be made at all, sign-in carries on with the answer nearly everybody gets anyway: Rutba’s own. Nobody is stopped at the door because a list was briefly unavailable.

That rule has a sharp edge, and we found it the hard way. The service that answered the lookup had been retired, and the address configured for it went on pointing at a port nothing was listening to. Every lookup failed; every failure fell back to “sign in here”; and because that is the right answer for most people, nothing looked broken. A path that had been built on both ends, configured, and tested in isolation was doing nothing at all for weeks.

The fix was to serve the lookup from the records that already describe which organisation owns which domain, in the backend that now holds them: no new fields, no second copy, and one fewer service in the path. The gate it had to pass was the one the retired service set for itself: a real address and an invented one at the same domain, answering identically.