airavata-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Marcus Christie (Jira)" <j...@apache.org>
Subject [jira] [Commented] (AIRAVATA-3319) Handle missing name and email attributes from CILogon
Date Fri, 28 Aug 2020 14:31:00 GMT

    [ https://issues.apache.org/jira/browse/AIRAVATA-3319?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17186571#comment-17186571
] 

Marcus Christie commented on AIRAVATA-3319:
-------------------------------------------

The eduPersonPrincipleName is available in the eppn attribute which is returned for the org.cilogon.userinfo
scope -- https://www.cilogon.org/oidc

> Handle missing name and email attributes from CILogon
> -----------------------------------------------------
>
>                 Key: AIRAVATA-3319
>                 URL: https://issues.apache.org/jira/browse/AIRAVATA-3319
>             Project: Airavata
>          Issue Type: New Feature
>          Components: Django Portal
>            Reporter: Marcus Christie
>            Assignee: Marcus Christie
>            Priority: Major
>
> {quote}
> tl;dr: CILogon will no longer require Identity Providers (IdPs) to assert email addresses
and names for new users of OAuth2/OIDC (OpenID Connect) clients.
> {quote}
> [https://groups.google.com/a/cilogon.org/forum/#!topic/outages/kksaYVrW1Io]
>  This issue to design a user authentication flow that handles missing attributes and
prompts the user to supply them as necessary.
> h2. Questions
> - [ ] Will we always get a {{preferred_username}} attribute? Question for CILogon team
> - [ ] what will Keycloak do if any of these attributes are missing?
> h2. Design
> h3. User doesn't have first name and/or last name attributes
> - callback handles user authentication
> - fetch userinfo and check for missing attributes
> - note that first and/or last name are missing
> - disable user in Keycloak
> - (?) Question: log the user in with a flag that profile is not complete? Or don't log
the user in and put the user information somewhere in the session?
> -- I think, log the user in but set a session flag that the profile is not complete.
in workspace/signals.py and in the UI use this to prevent API calls and to prevent the user
from seeing UIs that they can't yet interact with.
> - redirect user to web form with profile information filled in
> -- email
> -- email again
> -- first name (if available)
> -- last name (if available)
> - user submits form
> - validate form
> - if form is valid and all required information is supplied, then ...
> -- update the user record in Keycloak
> -- enable the user
> h3. User doesn't have email attribute
> Similar flow to above except
> - send the user an email verification link if the profile is complete and the email address
has been supplied
> -- more generally, if the user updates their profile information and the email changes,
need to re-verify the email address
> - when the email verification link is clicked, re-check the the profile is complete
> - if profile is complete, update the user record and enable the user
> - otherwise kick the user to the profile form and require the missing profile attributes
>  



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

Mime
View raw message