search

instructure / canvas-lms

The open LMS by Instructure, Inc.
https://github.com/instructure/canvas-lms/wiki
GNU Affero General Public License v3.0
5.71k stars 2.52k forks source link

openid connect authentication_provider_id filter failing auth #678

Closed artfulhacker closed 9 years ago

artfulhacker commented 9 years ago

openid is failing for us because it looks like the query being made is filtering on this value:

authentication_provider_id

SELECT "pseudonyms".* FROM "pseudonyms" WHERE "pseudonyms"."account_id" = 1 AND "pseudonyms"."workflow_state" = 'active' AND "pseudonyms"."authentication_provider_id" = 4 AND (LOWER(unique_id)=L OWER('UNIQUE_ID_HERE')) LIMIT 1

where the user row with that unique id doesn't have a authentication_provider_id, in fact none of my users have a value here

without manually adding the value '4' to every user we want to use openid, what is going on here? why is it filtering on this value?

adding new users and they still remain empty for this value.

ccutrer commented 9 years ago

This is working as designed. Make sure to read the documentation at https://canvas.instructure.com/doc/api/logins.html#method.pseudonyms.create for the authentication_provider_id field. You can also use an SIS import to change the authentication provider of a pseudonym starting with the next release: https://canvas.beta.instructure.com/doc/api/file.sis_csv.html. You cannot currently change the authentication provider of a login via the API.

ccutrer commented 9 years ago

I should also add that the lack of UI for changing the authentication provider on a user is a feature gap, not a bug. You could probably try and push for that to get higher priority by creating a feature request at https://community.canvaslms.com/

artfulhacker commented 9 years ago

ah you're right, I kept looking at the API for "create a user" for this field, not "create a login"

artfulhacker commented 9 years ago

yea good call, it really should be in the UI, how do we get the auth ID from the UI or would that be API only?

ccutrer commented 9 years ago

If you only have the one, you can use openid_connect as the id. If you have more than one, it will show up on the authentication providers configuration page (the last part of the direct login URL that it shows you). You can also get it from the API by listing your authentication_providers (or account_authorization_configs on current stable; it gets renamed in the next release, but the old names still work for compatibility).

artfulhacker commented 9 years ago

amazing, adding openid connect was perfect for us. awesome work!