search

inveniosoftware / invenio-oauthclient

Invenio module that provides OAuth web authorization support.
https://invenio-oauthclient.readthedocs.io
MIT License
6 stars 74 forks source link

CERN contribs do not clear `provides` on logout #220

Closed ntarocco closed 3 years ago

ntarocco commented 4 years ago

Package version (if known): any

Describe the bug

When logging in, the extend_identity method is adding some roles to the identity. When logging out, such roles are not cleaned. Probably this cleaning should be done here, before return.

Logged in user:

Current behaviour

Never logged in user:

<AnonymousIdentity id="None" auth_type="None" provides={Need(method='system_role', value='any_user')}>

Authenticated user:

<Identity id="7" auth_type="None" provides={Need(method='id', value=7), Need(method='role', value='cern-user'), Need(method='system_role', value='authenticated_user'), Need(method='id', value='<email>@cern.ch'), Need(method='system_role', value='any_user'), Need(method='role', value='admin')}>

Anonymous user after logout:

<AnonymousIdentity id="None" auth_type="None" provides={Need(method='id', value='<email>@cern.ch'), Need(method='system_role', value='any_user'), Need(method='role', value='admin'), Need(method='role', value='cern-user')}>

Expected behaviour

Anonymous user after logout:

<AnonymousIdentity id="None" auth_type="None" provides={Need(method='system_role', value='any_user')}>