auth: Don't log email when user tried authing to the wrong subdomain.

We want to avoid logging this kind of potentially sensitive information.
Instead, it's more useful to log ids of the matching accounts on
different subdomains.

zerver/forms.py

@@ -460,7 +460,9 @@ class OurAuthenticationForm(AuthenticationForm):
 
             if return_data.get("invalid_subdomain"):
                 logging.warning(
-                    "User %s attempted password login to wrong subdomain %s", username, subdomain
+                    "User attempted password login to wrong subdomain %s. Matching accounts: %s",
+                    subdomain,
+                    return_data.get("matching_user_ids_in_different_realms"),
                 )
                 error_message = _(
                     "Your Zulip account {username} is not a member of the "

zerver/tests/test_signup.py

@@ -821,13 +821,15 @@ class LoginTest(ZulipTestCase):
         self.assert_logged_in_user_id(None)
 
     def test_login_wrong_subdomain(self) -> None:
-        email = self.mit_email("sipbtest")
+        user_profile = self.mit_user("sipbtest")
+        email = user_profile.delivery_email
         with self.assertLogs(level="WARNING") as m:
             result = self.login_with_return(email, "xxx")
+            matching_accounts_dict = {"realm_id": user_profile.realm_id, "id": user_profile.id}
             self.assertEqual(
                 m.output,
                 [
-                    "WARNING:root:User sipbtest@mit.edu attempted password login to wrong subdomain zulip"
+                    f"WARNING:root:User attempted password login to wrong subdomain zulip. Matching accounts: [{matching_accounts_dict}]"
                 ],
             )
         self.assertEqual(result.status_code, 200)

zproject/backends.py

@@ -219,6 +219,9 @@ def common_get_active_user(
             return None
         if return_data is not None:
             return_data["invalid_subdomain"] = True
+            return_data["matching_user_ids_in_different_realms"] = list(
+                UserProfile.objects.filter(delivery_email__iexact=email).values("realm_id", "id")
+            )
         return None
     if not is_user_active(user_profile, return_data):
         return None