-
Notifications
You must be signed in to change notification settings - Fork 500
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Shibboleth: handle Identity Providers that provide multiple first or last names separated by semicolons in indeterminate order #1608
Comments
I suggest to explain a possibly changing name in support documents. Perhaps for Shib users, a link to the exact docs could be added below their profile name in small print: Why did my profile name change? Or when a change is detected on login, this could be sent as a notification ("We updated your profile name with the new information we received from [your identity provider]") with a link to the doc. |
Now the Shib code looks for multiple values for firstName and lastName, sorts them alphabetically, and uses the first value. At least this way users shouldn't see their name changing. And if they prefer the value that comes later in the alphabet, they can talk to their identity provider. Moving to QA. |
@posixeleni has a shib account with multiple names. Phil sat with her and confirmed the multi name case works as expected. Closing. |
- Put email addresses throught the same "find single value" logic originally developed in #1608 for multiple first and last names. - Add `@ValidateEmail` to the "email" field on AuthenticatedUser to match BuiltinUser. - Add null check added to EmailValidator to make it testable. - Add `INVALID_EMAIL` and `MISSING_REQUIRED_ATTR` modes for Shib testing in dev. - Remove red warning when TestShib doesn't provide "mail" attribute. - Catch authSvc.createAuthenticatedUser exceptions and handle errors better. - Reformat code (getPrettyFacesHomePageString seems ok).
At least one Identity Provider is known to sometimes provide more than one first name (givenName) separated by semicolons. From internal discussion it is believe that multiple last names (sn) are also possible.
Unfortunately, it sounds like we can not rely on the first value being the preferred one: "The IdP is going to pass back multiple values for multivalued attributes. There's no set order that I know of." So if we just always persist the first value, the user might notice that their first name keeps changing.
Hopefully not too many Identity Providers return multiple first names. For both "givenName" and "sn" Ohio State, for example, says, "The attribute is currently single-valued" at https://webauth.service.ohio-state.edu/~shibboleth/attributes.html . The Identity Provider is probably in the best position to decide which givenName is the preferred one, so it makes sense that many of them only send a single value.
The text was updated successfully, but these errors were encountered: