| Summary: | Allow for independent shibboleth autocreate and sync mapping | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Pete <pgsengstock> |
| Component: | Authentication | Assignee: | Martin Renvoize (ashimema) <martin.renvoize> |
| Status: | Needs Signoff --- | QA Contact: | Testopia <testopia> |
| Severity: | enhancement | ||
| Priority: | P5 - low | CC: | blawlor, dpavlin, martin.renvoize |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | Sponsored | Comma delimited list of Sponsors: | ByWater Solutions |
| Crowdfunding goal: | 0 | Patch complexity: | Small patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | 39224 | ||
| Bug Blocks: | 24880 | ||
| Attachments: |
Bug 33538: Database updates adding sync options for identity providers
Bug 33538: DBIx::Class schema update Bug 33538: DBIC Schema customisations Bug 33538: Update application to respect new sync fields Bug 33538: Unit tests |
||
|
Description
Pete
2023-04-14 19:17:22 UTC
At one point we had autocreate and sync both working for our use case, but since some Koha upgrade, possibly 23.05, it stopped working the way that we expected it to and have had to turn off sync. In our use case we are using SSO for library staff accounts. We had autocreate set some default level of permissions so that staff could login to the staff interface and do some basic circ when they first logged in. Then we managed elevating permissions in Koha. We had sync turned on and our SAML so that we could update staff attributes like branchcode and name in the IdP and the Koha account would update the next time the staff logged in. Originally the sync allowed for updating the user's attributes sent by SAML, but allowed for the elevated permissions to be retained. We had to turn off sync because Shibboleth started syncing the permission flags to the default and all staff lost their permissions. We don't store and send permission flags in our IdP, but to get this working again without a patch we would have to do that. I think Shibboleth's sync should only update attributes that are explicitly passed from the SAML app, so that you could configure defaults for other fields in autocreate. This is particularly useful for setting default permissions for new staff. Created attachment 193700 [details] [review] Bug 33538: Database updates adding sync options for identity providers Adds database update and kohastructure change to include sync_on_creation and sync_on_update fields to the identity_provider_mappings table. Test plan: 1. Apply the atomic update 2. Verify new fields exist in the identity_provider_mappings table Sponsored-by: ByWater Solutions Created attachment 193701 [details] [review] Bug 33538: DBIx::Class schema update Auto-generated DBIx::Class schema updates from database changes Sponsored-by: ByWater Solutions Created attachment 193702 [details] [review] Bug 33538: DBIC Schema customisations Add boolean flags to the new fields added Sponsored-by: ByWater Solutions Created attachment 193703 [details] [review] Bug 33538: Update application to respect new sync fields Updates the Koha Object classes, API controller and definitions as well as the Auth handlers to understand the new sync fields. Test plan 1) Apply the full patchset 2) Update the sync definitions for an Identity provider 3) Login via that Identity Provider for the first time and confirm the prescribed fields synced. 4) Update some fields for your patron that correspond to both syned and unsynced fields on updates. 5) Login again via the Identity Provider and confirm unsynced fields remain unchanged and synced fields are updated back to the identity provider provided value. Sponsored-by: ByWater Solutions Created attachment 193704 [details] [review] Bug 33538: Unit tests Add and update unit tests to account for the new sync fields Sponsored-by: ByWater Solutions |