Bug 33538 - Allow for independent shibboleth autocreate and sync mapping
Summary: Allow for independent shibboleth autocreate and sync mapping
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Martin Renvoize (ashimema)
QA Contact: Testopia
URL:
Keywords:
Depends on: 39224
Blocks: 24880
  Show dependency treegraph
 
Reported: 2023-04-14 19:17 UTC by Pete
Modified: 2026-02-24 10:34 UTC (History)
3 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: Sponsored
Comma delimited list of Sponsors: ByWater Solutions
Crowdfunding goal: 0
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 33538: Database updates adding sync options for identity providers (3.11 KB, patch)
2026-02-24 10:34 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 33538: DBIx::Class schema update (1.86 KB, patch)
2026-02-24 10:34 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 33538: DBIC Schema customisations (1.01 KB, patch)
2026-02-24 10:34 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 33538: Update application to respect new sync fields (9.61 KB, patch)
2026-02-24 10:34 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 33538: Unit tests (7.30 KB, patch)
2026-02-24 10:34 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Pete 2023-04-14 19:17:22 UTC
Shibboleth auth's autocreate and sync functions both rely on the same //shibboleth/mapping block in koha-conf.xml.  Because autocreate requires mapping and/or defaults for branchcode and categorycode, this has the undesired affect of overwriting manual edits to borrowers on later syncs if the those fields are not delivered via shibboleth and explicitly mapped.  Example:

1) Patron signs in for first time and borrower account is autocreated with a default branch and categorycode.
2) Staff update patron to set new branch and category codes as needed (e.g. from "SSOAUTH" to "MAINLIB").
3) On next sign-in, patron's mapped data is synced, but branch and category codes are overwritten with the defaults.

Suggested workaround is to differentiate //shibboleth/autocreatemapping vs //shibboleth/syncmapping.  This allows greater control over which fields are mapped for autocreate vs sync.  This schema change would not be backward compatible, though.
Comment 1 Brendan Lawlor 2024-04-10 14:26:16 UTC
At one point we had autocreate and sync both working for our use case, but since some Koha upgrade, possibly 23.05, it stopped working the way that we expected it to and have had to turn off sync.

In our use case we are using SSO for library staff accounts. We had autocreate set some default level of permissions so that staff could login to the staff interface and do some basic circ when they first logged in. Then we managed elevating permissions in Koha.

We had sync turned on and our SAML so that we could update staff attributes like branchcode and name in the IdP and the Koha account would update the next time the staff logged in.

Originally the sync allowed for updating the user's attributes sent by SAML, but allowed for the elevated permissions to be retained. We had to turn off sync because Shibboleth started syncing the permission flags to the default and all staff lost their permissions.

We don't store and send permission flags in our IdP, but to get this working again without a patch we would have to do that.

I think Shibboleth's sync should only update attributes that are explicitly passed from the SAML app, so that you could configure defaults for other fields in autocreate. This is particularly useful for setting default permissions for new staff.
Comment 2 Martin Renvoize (ashimema) 2026-02-24 10:34:40 UTC
Created attachment 193700 [details] [review]
Bug 33538: Database updates adding sync options for identity providers

Adds database update and kohastructure change to include
sync_on_creation and sync_on_update fields to the
identity_provider_mappings table.

Test plan:
1. Apply the atomic update
2. Verify new fields exist in the identity_provider_mappings table

Sponsored-by: ByWater Solutions
Comment 3 Martin Renvoize (ashimema) 2026-02-24 10:34:41 UTC
Created attachment 193701 [details] [review]
Bug 33538: DBIx::Class schema update

Auto-generated DBIx::Class schema updates from database changes

Sponsored-by: ByWater Solutions
Comment 4 Martin Renvoize (ashimema) 2026-02-24 10:34:43 UTC
Created attachment 193702 [details] [review]
Bug 33538: DBIC Schema customisations

Add boolean flags to the new fields added

Sponsored-by: ByWater Solutions
Comment 5 Martin Renvoize (ashimema) 2026-02-24 10:34:44 UTC
Created attachment 193703 [details] [review]
Bug 33538: Update application to respect new sync fields

Updates the Koha Object classes, API controller and definitions as well
as the Auth handlers to understand the new sync fields.

Test plan
1) Apply the full patchset
2) Update the sync definitions for an Identity provider
3) Login via that Identity Provider for the first time and confirm the
   prescribed fields synced.
4) Update some fields for your patron that correspond to both syned and
   unsynced fields on updates.
5) Login again via the Identity Provider and confirm unsynced fields
   remain unchanged and synced fields are updated back to the identity
   provider provided value.

Sponsored-by: ByWater Solutions
Comment 6 Martin Renvoize (ashimema) 2026-02-24 10:34:45 UTC
Created attachment 193704 [details] [review]
Bug 33538: Unit tests

Add and update unit tests to account for the new sync fields

Sponsored-by: ByWater Solutions