rmiccoli
commented
10 months ago Hi @bl000m,
Hello, I have 2 questions related to user attributes and roles in Indigo IAM, I hope you can help. Thank you in advance
1. Renater User attributes retrieval
When a user authenticates with Renater and registers on the Indigo IAM using the test account
etudiant1, they are prompted to manually input attributes such as given name, family name, email, etc. Is there a method to automatically detect and populate these attributes( below the fake attributes provided by Renater foretudiant1) from the Renater profile?Example Scenario:
* User logs in with Renater credentials. * Redirected to IAM Indigo for registration. * Attributes (given name, family name, etc.) are manually entered. * Is there an automated way to fetch these attributes from the Renater profile?
You can configure it, by adding in your application-*.yml file the following section:
iam:
registration:
samlEntityId: ${IAM_SAML_IDP_METADATA}
authentication-type: saml
fields:
name:
read-only: false
external-auth-attribute: given_name
surname:
read-only: false
external-auth-attribute: family_name
email:
read-only: false
external-auth-attribute: email
username:
read-only: false
external-auth-attribute: suggested_usernameNote that the attribute names (given_name, etc) are derived from the SAML assertion that is returned after authentication with an external provider. Sometimes, for instance, some assertions return preferred_username rather than suggested_username. You can later verify this at the /iam/authn-info endpoint after logging in with your IdP.
I think this last sentence also partly answers the second question.
2. User role (admin or not, group admin or not) and attributes Retrieval
It's unclear how to retrieve the roles of users registered on the IAM Indigo instance. Additionally, if attributes are added or updated for a user, what is the process for retrieving the updated information?
Example Scenario:
* User attributes or roles are modified in the IAM Indigo instance. * How can the client retrieve the updated information? * How can the roles associated with a user be queried programmatically?Fake attributes provided by Renater for
etudiant1* Attribut (a↓z) Valeur cn Dupont Jean displayName Jean Dupont eduPersonAffiliation student;member eduPersonNickname Jean eduPersonOrgDN dc=renater,dc=fr eduPersonOrgUnitDN o=maths,dc=renater,dc=fr eduPersonPrimaryAffiliation student eduPersonPrimaryOrgUnitDN o=maths,dc=renater,dc=fr eduPersonPrincipalName etudiant1@test-renater.fr eduPersonScopedAffiliation student@test-renater.fr;member@test-renater.fr eduPersonTargetedID https://test-idp.federation.renater.fr/idp/shibboleth!https://test-sp.federation.renater.fr!G7RU5R5PVWO2EQKBIO3ZHOMTQEQ2MO6J facsimileTelephoneNumber 0102030405 givenName Jean l Paris labeledURI http://example.org/dupont mail jean.dupont@formation.renater.fr mailForwardingAddress jeanperso@example.org o formation.renater.fr ou maths pairwise-id G7RU5R5PVWO2EQKBIO3ZHOMTQEQ2MO6J@test-renater.fr postalAddress 1 rue de Paris$12345 Ville preferredLanguage FR schacHomeOrganization test-renater.fr schacHomeOrganizationType urn:schac:homeOrganizationType:int:nren schacPersonalUniqueCode urn:schac:personalUniqueCode:int:esi:fr:1234567890G sn Dupont subject-id etudiant1@test-renater.fr supannActivite {CNU}5404 supannAutreMail etud1@fai1.fr;etud2@fai2.fr supannAutreTelephone 1234567890 supannCMSType etudiant supannCivilite Mr supannCodeINE 1234567890G supannEntiteAffectation z-123;z-124 supannEntiteAffectationPrincipale z-123 supannEtablissement {ILN}1-341725201;{AUTRE}formation.renater.fr supannEtuAnneeInscription 2008 supannEtuCursusAnnee {SUPANN}L3 supannEtuDiplome {SISE}2001350 supannEtuElementPedagogique {UAI:0171463Y}4929 supannEtuEtape {UAI:0171463Y}401 supannEtuId 12345 supannEtuInscription [etab={UAI}0131843H][anneeinsc=2007][regimeinsc={SISE}10][sectdisc={SISE}04][typedip={SISE}YA][cursusann=D3][affect=56R17][diplome={SISE}2001099][etape={UAI:0131843H}B8EFAI-B8EFA3] supannEtuRegimeInscription {SISE}10 supannEtuSecteurDisciplinaire {SISE}27 supannEtuTypeDiplome {SISE}DC supannListeRouge FALSE supannMailPerso jeanperso@example.org supannNomDeNaissance Dupont supannOIDCDateDeNaissance 1993-02-04 supannOIDCGenre male supannPrenomsEtatCivil Jean Pierre supannRefId {INE}1234567890G;{APOGEE}12345 supannRessourceEtat {MAIL}I:SupannExpire;{COMPTE}A supannRessourceEtatDate {COMPTE}I:SupannExpire:20211212:20220612;{COMPTE}A:SupannSursis:20210912:20211212;{COMPTE}A::20180115: supannRoleEntite [role=PRESIDENT][type=CONSEIL-ETUDIANT] supannRoleGenerique PRESIDENT-CONSEIL-ETUDIANT telephoneNumber +33 1 23 45 67 89 title M. uid etudiant1
bl000m
federicaagostini
Hello, I have 2 questions related to user attributes and roles in Indigo IAM, I hope you can help. Thank you in advance
1. Renater User attributes retrieval
When a user authenticates with Renater and registers on the Indigo IAM using the test account
etudiant1, they are prompted to manually input attributes such as given name, family name, email, etc. Is there a method to automatically detect and populate these attributes( below the fake attributes provided by Renater foretudiant1) from the Renater profile?Example Scenario:
2. User role (admin or not, group admin or not) and attributes Retrieval
It's unclear how to retrieve the roles of users registered on the IAM Indigo instance. Additionally, if attributes are added or updated for a user, what is the process for retrieving the updated information?
Example Scenario:
Fake attributes provided by Renater for
etudiant1