-
Type:
Improvement
-
Status: Resolved
-
Priority:
Minor
-
Resolution: Fixed
-
Affects Version/s: 9.10, 10.1
-
Component/s: Authentication
-
Release Notes Summary:The support for read-only directories is added to our SAML implementation.
-
Upgrade notes:
-
Sprint:nxsupport 10.2.4
-
Story Points:2
Looking at the current code:
https://github.com/nuxeo/nuxeo/blob/master/nuxeo-services/login/nuxeo-platform-login-saml2/src/main/java/org/nuxeo/ecm/platform/auth/saml/user/UserMapperBasedResolver.java#L53
This will call the following method with hardcoded values for createIfNeeded and update:
https://github.com/nuxeo/nuxeo/blob/master/nuxeo-services/nuxeo-usermapper/src/main/java/org/nuxeo/usermapper/service/UserMapperComponent.java#L104
For instance, this prevents the usage of LDAP readonly and SAML which attempts to create the user in the directory.
Shibboleth encounters the same issue.
Having those flags customizable through the contribution would solve this issue.
<extension target="org.nuxeo.ecm.platform.ui.web.auth.service.PluggableAuthenticationService"
point="authenticators">
<authenticationPlugin name="OKTA_AUTH" enabled="true"
class="org.nuxeo.ecm.platform.auth.saml.SAMLAuthenticationProvider">
<loginModulePlugin>Trusting_LM</loginModulePlugin>
<needStartingURLSaving>true</needStartingURLSaving>
<parameters>
<parameter name="name">Okta</parameter>
<!-- Uri of the metadata -->
<parameter name="metadata">https://inevo.okta.com/app/kwojxppsUAOQYHDCJHER/sso/saml/metadata</parameter>
<!-- Request timeout in seconds -->
<parameter name="timeout">5</parameter>
<parameter name="userResolverCreateIfNeeded">false</parameter>
<parameter name="userResolverUpdate">false</parameter>
</parameters>
</authenticationPlugin>
</extension>
- causes
-
NXP-29256 Fix class UserMapperBasedResolver
-
- Resolved
-
- depends on
-
-
- Resolved
-
