[Bug 40650] New: Identity providers lack support for extended patron attribute type mapping
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Bug ID: 40650 Summary: Identity providers lack support for extended patron attribute type mapping Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: oliver.behnke@aei.mpg.de QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org Hi, so far we've been using LDAP authentication and with extended attribute type mapping (on register and login/update) but we have to move to OIDC. Thankfully there's an identity provider (IdP) for that. Great! However, testing and code inspection indicate that extended patron attributes can't be used for IdP mapping. When I try that I get:
There was an error authenticating to external identity provider No property <ATTRIBUTE> for Koha::Patron
At first glance, the code seems to support that assessment. For instance, the "update_on_auth" feature [1] calls set() which isn't overridden in Koha::Patron so Koha::Object.set() is being called [2], which of course isn't aware of those patron-specific extended attributes, eventually triggering the error above. To me that omission is a regression as existing auth methods like LDAP do support mapping extended patron attributes. Without that we can't rely on using identity providers since we'd lose required functionality. Thanks [1] https://github.com/Koha-Community/Koha/blob/8d31c2e06733fbc0f599ea99fe46df50... [2] https://github.com/Koha-Community/Koha/blob/8d31c2e06733fbc0f599ea99fe46df50... -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Oliver Behnke <oliver.behnke@aei.mpg.de> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=40596 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |enhancement CC| |tomascohen@gmail.com --- Comment #1 from Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> --- This is an enhancement proposal, which I've been meaning to work on for a while. Changing the 'Importance status'. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 --- Comment #2 from Oliver Behnke <oliver.behnke@aei.mpg.de> --- Hi Tomás, any chance you'll find the time to work on this in the foreseeable future? Thanks! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Oliver Behnke <oliver.behnke@aei.mpg.de> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=41908 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@openfifth.c | |o.uk Status|NEW |RESOLVED Resolution|--- |DUPLICATE --- Comment #3 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- I believe I handle this as part of 'Bug 39224: Handle patron_attribute:CODE values in auth protocol handlers' *** This bug has been marked as a duplicate of bug 39224 *** -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |39224 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 [Bug 39224] Migrate SAML/Shibboleth configuration into Identity Providers -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|DUPLICATE |--- Status|RESOLVED |REOPENED -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |martin.renvoize@openfifth.c |ity.org |o.uk -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |39224 Blocks|39224 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 [Bug 39224] Migrate SAML/Shibboleth configuration into Identity Providers -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Small patch Status|REOPENED |Needs Signoff Sponsorship status|--- |Sponsored Comma delimited| |ByWater Solutions list of Sponsors| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 --- Comment #4 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 196542 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196542&action=edit Bug 40650: Support patron_attribute:CODE values in identity provider field mappings Add support for mapping provider attributes to extended patron attributes using the patron_attribute:CODE key in a provider's field mapping. Any identity provider protocol — OAuth, OIDC, SAML2 and Shibboleth — can now populate custom patron attributes alongside core borrower fields, which is essential for SAML2 providers that surface user data not part of the standard borrower record. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |41908 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41908 [Bug 41908] Migrate LDAP configuration into Identity Providers -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |40596 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40596 [Bug 40596] Migrate CAS configuration into Identity Providers -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 --- Comment #5 from Oliver Behnke <oliver.behnke@aei.mpg.de> --- Thanks Martin! This is great news! What's the best way to test this? Which other patches do I have to apply (ideally) against 25.11.2 to be able to take this out for a spin? Cheers -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |33538 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33538 [Bug 33538] Allow for independent shibboleth autocreate and sync mapping -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #196542|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 --- Comment #6 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 196571 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196571&action=edit Bug 40650: Support patron_attribute:CODE values in identity provider field mappings Add support for mapping provider attributes to extended patron attributes using the patron_attribute:CODE key in a provider's field mapping. Any identity provider protocol — OAuth, OIDC, SAML2 and Shibboleth — can now populate custom patron attributes alongside core borrower fields, which is essential for SAML2 providers that surface user data not part of the standard borrower record. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 --- Comment #7 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197299 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197299&action=edit Bug 40650: Add patron_attribute:CODE support to identity provider field mappings Extends _find_patron_by_matchpoint and _update_patron_from_mapped_data in Koha::Auth::Client base class to support the patron_attribute:CODE matchpoint and mapping syntax: - _find_patron_by_matchpoint: when the matchpoint starts with patron_attribute:, searches borrower_attributes by code and value rather than core borrower fields - _update_patron_from_mapped_data: separates patron_attribute: keys from core borrower fields, applying the former via Koha::Patron::Attribute create/replace and the latter via the standard set()/store() path -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 --- Comment #8 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197300 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197300&action=edit Bug 40650: Add unit tests for patron_attribute:CODE matchpoint and mapping Tests _find_patron_by_matchpoint and _update_patron_from_mapped_data to cover the patron_attribute:CODE syntax introduced in bug 40650. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #196571|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |tomascohen@gmail.com |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 --- Comment #9 from Oliver Behnke <oliver.behnke@aei.mpg.de> --- Just FYI, I plan to test and sign off on this as soon as bug 39224 got released. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #197299|0 |1 is obsolete| | Attachment #197300|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 --- Comment #10 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 202048 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202048&action=edit Bug 40650: Add patron_attribute:CODE support to identity provider field mappings Extends _find_patron_by_matchpoint and _update_patron_from_mapped_data in Koha::Auth::Client base class to support the patron_attribute:CODE matchpoint and mapping syntax: - _find_patron_by_matchpoint: when the matchpoint starts with patron_attribute:, searches borrower_attributes by code and value rather than core borrower fields - _update_patron_from_mapped_data: separates patron_attribute: keys from core borrower fields, applying the former via Koha::Patron::Attribute create/replace and the latter via the standard set()/store() path -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 --- Comment #11 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 202049 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202049&action=edit Bug 40650: Add unit tests for patron_attribute:CODE matchpoint and mapping Tests _find_patron_by_matchpoint and _update_patron_from_mapped_data to cover the patron_attribute:CODE syntax introduced in bug 40650. Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #202048|0 |1 is obsolete| | Attachment #202049|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 --- Comment #12 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204717 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204717&action=edit Bug 40650: Add patron_attribute:CODE support to identity provider field mappings Extends _find_patron_by_matchpoint and _update_patron_from_mapped_data in Koha::Auth::Client base class to support the patron_attribute:CODE matchpoint and mapping syntax: - _find_patron_by_matchpoint: when the matchpoint starts with patron_attribute:, searches borrower_attributes by code and value rather than core borrower fields - _update_patron_from_mapped_data: separates patron_attribute: keys from core borrower fields, applying the former via Koha::Patron::Attribute create/replace and the latter via the standard set()/store() path Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 --- Comment #13 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204718 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204718&action=edit Bug 40650: Add unit tests for patron_attribute:CODE matchpoint and mapping Tests _find_patron_by_matchpoint and _update_patron_from_mapped_data to cover the patron_attribute:CODE syntax introduced in bug 40650. Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 --- Comment #14 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204719 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204719&action=edit Bug 40650: Support multi-valued attribute mappings _update_patron_from_mapped_data() replaces the full set of values for a mapped patron_attribute:CODE on every sync (delete then recreate), since identity_provider_mappings enforces a unique (identity_provider_id, koha_field) constraint - only one mapping can ever target a given code per provider, so the IdP is authoritative for whatever it maps there and a value that changed or disappeared should be reflected here too. A mapped value that resolves to an arrayref (e.g. an OIDC claim mapped without an index, or a multi-valued SAML2 attribute) is now handled properly: one row is created per element on a repeatable attribute type, deduped and with the previous set replaced as above. A non-repeatable attribute given multiple values, or a core borrower field given an array at all (which can't hold more than one value), logs a warning and falls back to the first value instead of storing a stringified reference or dying mid-login. Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |26.11 Initiative type|--- |Epic Strategic theme|--- |Modernisation --- Comment #15 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Just a rebase.. would be great to get this whole set moving -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|41908 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41908 [Bug 41908] Migrate LDAP configuration into Identity Providers -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org