Update User object with user Organization based on Group membership in Active Directory

bcgov / MFIN-Data-Catalogue

The Finance Data Catalogue enables users to discover data holdings at the BC Ministry of Finance and offers information and functionality that benefits consumers of data for business purposes. The product is built using Drupal and adheres to the Government of BC's Core Metadata Standard.

Other

6 stars 0 forks source link

Update User object with user Organization based on Group membership in Active Directory #443

Closed NicoledeGreef closed 5 days ago

NicoledeGreef commented 1 month ago

OP timer

https://openplus.monday.com/boards/4092908516/pulses/6510466907

Relates to #424

[ ] OpenID Connect Microsoft Azure Active Directory client
[ ] @NicoledeGreef I met with the team about this at stand-up today. How we do it depends on how you are set up on you end. If you are using Office 365, there is a module that can connect, then pull all sorts of metadata for use in Drupal. See https://www.drupal.org/project/o365. Currently we are using OpenID connect
[ ] install module on dv14
[ ] configure
[ ] new keys?
[ ] ensure that the Catalogue admin role can adjust the mappings between AD group and Organization in drupal

lkmorlan commented 1 month ago

The take-away from today's meeting is that the service we are currently using does not provide group information. We could get this information by doing a lookup after every login.

This API could be useful: https://api.loginproxy.gov.bc.ca/openapi/swagger#/ https://bcgov.github.io/sso-docs/

Relevant channel: https://chat.developer.gov.bc.ca/channel/sso

SSO docs: https://bcgov.github.io/sso-docs/advanced/identity-mappers

lkmorlan commented 1 month ago

I have emailed the IDIR team about using a secondary lookup to get the group information.

NicoledeGreef commented 1 month ago

IDIM recommended reaching out to ADMS team which I did. We received a speedy response and await more info from that team.

NicoledeGreef commented 5 days ago

Closing this ticket for now with the Icebox tag. We'll pick it up after more discussion with the SSO common component team as they would need to change what they return and this has larger implications than just our product.