Make provisioning identifier configurable

[phavekes]

This issue is imported from pivotal

Door in de manage-config aan te geven welk attribuut gebruikt moet worden als gebruikers-identifier bij (SCIM) provisioning, kan de applicatie flexibel zijn in welke identifier gebruikt gaat worden bij authenticatie. Primaire use-case is het inzetten van de subjectID, wat nog niet door alle instellingen ondersteund wordt.

Default is nu eppn, keuzelijst met

• subject_id (urn:oasis:names:tc:SAML:attribute:subject-id)\
• eduperson_principal_name (urn:mace:dir:attribute-def:eduPersonPrincipalName)\
• uids (urn:mace:dir:attribute-def:uid) - is a multi-value attribute\
• email (urn:mace:dir:attribute-def:mail)\
• eduID (urn:mace:eduid.nl:1.1)

[phavekes]

Flow when using the targeted eduID identifier in the provisioning

1. user logs in and accepts invite
2. start provisioning
3. Lookup provisioning in manage.
4. If provisioning-identifier is eduID, lookup institutuinGUID for the provisioning in manage

• Add new API to eduID:

• Input : any targeted eduID identifier + InstitutionGUID

• eduID will lookup or create the eduID identifier for the institution, and return this

• New API endpoint for Invite OpenConext-myconext#533

• Add Validation in manage:

• If the provisioning identifier is eduid a InstitutionGUID for the provisioning must be provided and exist for an IdP

• Log a warning if the configured identifier for the provisioning was not available in the SAML assertion for the user, and fall back to eppn

• Write a testing-scenario for openconext-playground (@phavekes)

[phavekes]

Untested, but no effect if not configured in manage