airavata-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Marcus Christie (Jira)" <>
Subject [jira] [Commented] (AIRAVATA-3319) Handle missing name and email attributes from CILogon
Date Fri, 28 Aug 2020 15:04:00 GMT


Marcus Christie commented on AIRAVATA-3319:

I'm not sure how preferred_username gets mapped in Keycloak. It doesn't appear that CILogon
returns this and I'm guessing Keycloak just maps email to preferred_username.

> Handle missing name and email attributes from CILogon
> -----------------------------------------------------
>                 Key: AIRAVATA-3319
>                 URL:
>             Project: Airavata
>          Issue Type: New Feature
>          Components: Django Portal
>            Reporter: Marcus Christie
>            Assignee: Marcus Christie
>            Priority: Major
> {quote}
> tl;dr: CILogon will no longer require Identity Providers (IdPs) to assert email addresses
and names for new users of OAuth2/OIDC (OpenID Connect) clients.
> {quote}
> [!topic/outages/kksaYVrW1Io]
>  This issue to design a user authentication flow that handles missing attributes and
prompts the user to supply them as necessary.
> h2. Questions
> - [ ] Will we always get a {{preferred_username}} attribute? Question for CILogon team
> - [ ] what will Keycloak do if any of these attributes are missing?
> h2. Design
> h3. User doesn't have first name and/or last name attributes
> - callback handles user authentication
> - fetch userinfo and check for missing attributes
> - note that first and/or last name are missing
> - disable user in Keycloak
> - (?) Question: log the user in with a flag that profile is not complete? Or don't log
the user in and put the user information somewhere in the session?
> -- I think, log the user in but set a session flag that the profile is not complete.
in workspace/ and in the UI use this to prevent API calls and to prevent the user
from seeing UIs that they can't yet interact with.
> - redirect user to web form with profile information filled in
> -- email
> -- email again
> -- first name (if available)
> -- last name (if available)
> - user submits form
> - validate form
> - if form is valid and all required information is supplied, then ...
> -- update the user record in Keycloak
> -- enable the user
> h3. User doesn't have email attribute
> Similar flow to above except
> - send the user an email verification link if the profile is complete and the email address
has been supplied
> -- more generally, if the user updates their profile information and the email changes,
need to re-verify the email address
> - when the email verification link is clicked, re-check the the profile is complete
> - if profile is complete, update the user record and enable the user
> - otherwise kick the user to the profile form and require the missing profile attributes

This message was sent by Atlassian Jira

View raw message