#25042: When user is authenticated using external (REMOTE_USER) authentication,
their attributes should get updated if the external environment provides
the data
-------------------------------+--------------------
Reporter: adelton | Owner: nobody
Type: Uncategorized | Status: new
Component: contrib.auth | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------
When external authentication is used, the traditional result is the
username, passed to application via REMOTE_USER or similar mechanism.
With user identities being primarily managed outside of applications' user
databases, user records in applications' databases (that need to be
created so that foreign keys have parents) will increasingly be created
during the first successful login. While the username might be enough for
some applications, some might want the full set of attributes including
the name and email address to get filled based on the data from the
external identity/authentication source.
Since {{{AbstractUser}}} defines {{{first_name}}}, {{{last_name}}}, and
{{{email}}}, I propose these attributes to be populated upon successful
external authentication. The source of this data could be
{{{REMOTE_USER_FIRSTNAME}}}, {{{REMOTE_USER_LASTNAME}}}, and
{{{REMOTE_USER_EMAIL}}} based on the proposal at
http://www.freeipa.org/page/Environment_Variables#Proposed_Additional_Variables.
With mod_auth_mellon 0.10.10 (for SAML), the configuration to populate
these variables is
{{{
MellonSetEnvNoPrefix REMOTE_USER_FIRSTNAME givenname
MellonSetEnvNoPrefix REMOTE_USER_LASTNAME fullname
MellonSetEnvNoPrefix REMOTE_USER_EMAIL email
}}}
With mod_lookup_identity, the configuration would typically be
{{{
LookupUserAttr givenname REMOTE_USER_FIRSTNAME
LookupUserAttr sn REMOTE_USER_LASTNAME
LookupUserAttr mail REMOTE_USER_EMAIL
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/25042>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/050.f9d3214ca54cbee5141ccd729754663b%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
