Shibboleth auth's autocreate and sync functions both rely on the same //shibboleth/mapping block in koha-conf.xml. Because autocreate requires mapping and/or defaults for branchcode and categorycode, this has the undesired affect of overwriting manual edits to borrowers on later syncs if the those fields are not delivered via shibboleth and explicitly mapped. Example: 1) Patron signs in for first time and borrower account is autocreated with a default branch and categorycode. 2) Staff update patron to set new branch and category codes as needed (e.g. from "SSOAUTH" to "MAINLIB"). 3) On next sign-in, patron's mapped data is synced, but branch and category codes are overwritten with the defaults. Suggested workaround is to differentiate //shibboleth/autocreatemapping vs //shibboleth/syncmapping. This allows greater control over which fields are mapped for autocreate vs sync. This schema change would not be backward compatible, though.
At one point we had autocreate and sync both working for our use case, but since some Koha upgrade, possibly 23.05, it stopped working the way that we expected it to and have had to turn off sync. In our use case we are using SSO for library staff accounts. We had autocreate set some default level of permissions so that staff could login to the staff interface and do some basic circ when they first logged in. Then we managed elevating permissions in Koha. We had sync turned on and our SAML so that we could update staff attributes like branchcode and name in the IdP and the Koha account would update the next time the staff logged in. Originally the sync allowed for updating the user's attributes sent by SAML, but allowed for the elevated permissions to be retained. We had to turn off sync because Shibboleth started syncing the permission flags to the default and all staff lost their permissions. We don't store and send permission flags in our IdP, but to get this working again without a patch we would have to do that. I think Shibboleth's sync should only update attributes that are explicitly passed from the SAML app, so that you could configure defaults for other fields in autocreate. This is particularly useful for setting default permissions for new staff.
Created attachment 193700 [details] [review] Bug 33538: Database updates adding sync options for identity providers Adds database update and kohastructure change to include sync_on_creation and sync_on_update fields to the identity_provider_mappings table. Test plan: 1. Apply the atomic update 2. Verify new fields exist in the identity_provider_mappings table Sponsored-by: ByWater Solutions
Created attachment 193701 [details] [review] Bug 33538: DBIx::Class schema update Auto-generated DBIx::Class schema updates from database changes Sponsored-by: ByWater Solutions
Created attachment 193702 [details] [review] Bug 33538: DBIC Schema customisations Add boolean flags to the new fields added Sponsored-by: ByWater Solutions
Created attachment 193703 [details] [review] Bug 33538: Update application to respect new sync fields Updates the Koha Object classes, API controller and definitions as well as the Auth handlers to understand the new sync fields. Test plan 1) Apply the full patchset 2) Update the sync definitions for an Identity provider 3) Login via that Identity Provider for the first time and confirm the prescribed fields synced. 4) Update some fields for your patron that correspond to both syned and unsynced fields on updates. 5) Login again via the Identity Provider and confirm unsynced fields remain unchanged and synced fields are updated back to the identity provider provided value. Sponsored-by: ByWater Solutions
Created attachment 193704 [details] [review] Bug 33538: Unit tests Add and update unit tests to account for the new sync fields Sponsored-by: ByWater Solutions