search

OSC / ood_auth_registration

(DEPRECATED - we now use Keycloak for identity brokering) OSC OnDemand Open ID Connect CI Logon Registration page
MIT License
1 stars 1 forks source link

Automap users if coming from KeyCloak #14

Open ericfranz opened 7 years ago

ericfranz commented 7 years ago

If coming from KeyCloak, having authenticated with OIDC connected to OSC LDAP, we should auto-map the users "KeyCloak account" with their OSC account, and redirect them to their original destination.

Therefore, this is the user flow for a first time OSC user logging in via KeyCloak:

screen shot 2017-03-22 at 4 31 22 pm screen shot 2017-03-22 at 4 31 25 pm screen shot 2017-03-22 at 4 31 28 pm
ericfranz commented 7 years ago

Here is an updated design.

When going to /register:

image

The /register/mappings.php page will:

  1. use OOD_USER_MAP_CMD to determine if the logged in user is already mapped. If not, redirect the user to /register
  2. display prominently the DN and associated claim headers (provider information) and the username you are logged in as. This can look similar to the register page. If it makes things easier.
    • screen shot 2017-04-04 at 4 18 22 pm
  3. (optionally) show other DNs mapped to this username with the ability to delete them
  4. Hide the delete button (and explain that this mapping cannot be deleted) if the mapping is between OSC-LDAP and the HPC account.

When deleting a mapping from /register/mappings.php:

image