Feat: enable dynamic profile field mapping via env variables for oidc response #1041

Junjiequan · 2024-01-30T10:24:22Z

Description

This PR introduces configurable userInfo, enabling teams to customize returned values for the frontend. Default behavior remains unchanged if no configuration is provided. Notably, displayName in oidc.strategy now concatenates givenName and familyName.

Motivation

Different teams like to show different things in their user profiles. For example, at ESS, we use oidc.sub as the username. This change lets each team pick what works best for them, making sure our system suits everyone's needs.

Fixes:

added userInfoMapping field in the configuration file, which can be customized using the following environment variable name.

      userInfoMapping: {
        id: process.env.OIDC_USERINFO_MAPPING_FIELD_ID,
        username: process.env.OIDC_USERINFO_MAPPING_FIELD_USERNAME,
        displayName: process.env.OIDC_USERINFO_MAPPING_FIELD_DISPLAYNAME,
        familyName: process.env.OIDC_USERINFO_MAPPING_FIELD_FAMILYNAME,
        emails: process.env.OIDC_USERINFO_MAPPING_FIELD_EMAILS,
        email: process.env.OIDC_USERINFO_MAPPING_FIELD_EMAIL,
        thumbnailPhoto: process.env.OIDC_USERINFO_MAPPING_FIELD_THUMBNAIL_PHOTO,
        groups: process.env.OIDC_USERINFO_MAPPING_FIELD_GROUPS,
      },

Changes:

changes made

Tests included/Docs Updated?

Included for each change/fix?
Passing? (Merge will not be approved unless this is checked)
Docs updated?
New packages used/requires npm install?
Toggle added for new features?

…ion-process-confi

src/auth/strategies/oidc.strategy.ts

src/users/schemas/user-profile.schema.ts

src/auth/strategies/oidc.strategy.ts

…ion-process-confi

src/auth/strategies/oidc.strategy.ts

As not all config settings can be made as environment variables, provide a override mechanism to allow (build-time) configuration adjustments. An example for the graphql access groups provider will be in the next commit. Change-Id: I8dc82ca4f0ac0a1b60fa47eadb147c228a77b841

Instead of requiring an explict service provider for each facility, use extended configurations. Basic enabling/disabling is implemented in the standard config via environment vars, GraphQL needs extendend configuration via localconfiguration. Change-Id: I2ed630bac8f1f66d4f754e5b95d6b232ec63cf3d

Change-Id: I832b6d9e2680aa8423441924de59c4157b50c8e6

Junjiequan · 2024-02-05T09:06:07Z

#726 raised by @bpedersen2 is merged into this PR to test access-group-provider implementation

nitrosx

@Junjiequan I'm not sure that this PR is ready for production. I think we need to do another round of brainstorming and check that the code is correct.
Thoughts?

src/auth/access-group-provider/access-group-from-graphql-api-call.service.ts

src/auth/access-group-provider/access-group-from-multiple-providers.service.ts

src/auth/access-group-provider/access-group-from-payload.service.ts

src/auth/strategies/oidc.strategy.ts

src/config/configuration.ts

…rvice

nitrosx

Make sure to use SciCat Logger and not directly nestjs one

src/auth/access-group-provider/access-group-from-graphql-api-call.service.ts

src/auth/access-group-provider/access-group-service-factory.ts

…meter is not given.

…ion-process-confi

src/auth/access-group-provider/access-group-from-graphql-api-call.service.ts

…ser-identity dto

…ion-process-confi

bpedersen2

Looks good to me, just docs probably need updates

…ion-process-confi

nitrosx · 2024-02-26T16:00:42Z

I confirm that @Junjiequan updated the documentation. Ready to be merged

…ion-process-confi

bpedersen2

Except for a minor doc glitch looks fine

bpedersen2 · 2024-02-27T11:58:13Z

README.md

@@ -110,6 +116,20 @@ Valid environment variables for the .env file. See [.env.example](/.env.example)
 - `OIDC_SCOPE` [string] _Optional_ Space separated list of the info returned by the oidc service. Example: "openid profile email"
 - `OIDC_SUCCESS_URL` [string] _Optional_ SciCat Frontend auth-callback URL. Required in order to pass user credentials to SciCat Frontend after OIDC login. Example: https://myscicatfrontend/auth-callback
 - `OIDC_ACCESS_GROUPS` [string] _Optional_ Functionality is still unclear.
+- `OIDC_ACCESS_GROUPS_PROPERTY` [string] _Optional_ Target field to get the access groups value from OIDC response.
+- `OIDC_USERINFO_MAPPING_FIELD_USERNAME` [string] _Optional_ comma-separated list. Specifies the fields from the OIDC response to concatenate and use as the user's profile username. For example, setting `OIDC_USERINFO_MAPPING_FIELD_USERNAME="iss, sub"` combines the iss (issuer) and sub (subject) values from the OIDC response, resulting in a username like `myIssuer_myUserName`. This allows for customizable username definitions based on OIDC response attributes.


This field is mentioned 2 times here (see line 124)

bpedersen2 · 2024-02-27T11:58:26Z

README.md

+- `OIDC_USERINFO_MAPPING_FIELD_DISPLAYNAME` [string] _Optional_ Specifies the fields from the OIDC response and use as the user's profile displayname. For example, setting `OIDC_USERINFO_MAPPING_FIELD_DISPLAYNAME="preferred_username"` use displayName value from the OIDC response, resulting in a displayname like `myPreferredName`. This allows for customizable displayname definitions based on OIDC response attributes.
+- `OIDC_USERINFO_MAPPING_FIELD_EMAIL` [string] _Optional_ Same as `OIDC_USERINFO_MAPPING_FIELD_DISPLAYNAME`. Defaults to "email"
+- `OIDC_USERINFO_MAPPING_FIELD_DISPLAYNAME` [string] _Optional_ Same as `OIDC_USERINFO_MAPPING_FIELD_DISPLAYNAME`. Defaults to "name"
+- `OIDC_USERINFO_MAPPING_FIELD_USERNAME` [string] _Optional_ Same as `OIDC_USERINFO_MAPPING_FIELD_DISPLAYNAME`. Defaults to "preferred_username" || "name"


duplicated, and looking at the code the first one is correct.

…ion-process-confi

feat: Enable dynamic profile field mapping via env variables

590e66c

Junjiequan requested review from nitrosx and bpedersen2 January 30, 2024 10:24

Junjiequan added 4 commits January 30, 2024 11:25

Merge branch 'master' into SWAP-3745-scicat-be-make-oidc-user-validat…

05fda06

…ion-process-confi

add oidc groups to access groups

a8c7150

fix: minor fix for typo

03fcc15

fix: set default oidc displayName to userInfo.name

f174ff3

Junjiequan changed the title ~~Feat: enable dynamic profile field mapping via env variables~~ Feat: enable dynamic profile field mapping via env variables for oidc response Jan 30, 2024

Added removal of duplicates post-array concatenation

13739cf

Junjiequan mentioned this pull request Jan 30, 2024

Fix: Changed profile.username to profile.displayName for header username display SciCatProject/frontend#1388

Merged

6 tasks

nitrosx requested changes Jan 30, 2024

View reviewed changes

Junjiequan added 2 commits January 30, 2024 15:41

fixed typo and wrong user profile schema

7458961

Merge branch 'master' into SWAP-3745-scicat-be-make-oidc-user-validat…

854cf3f

…ion-process-confi

bpedersen2 requested changes Jan 30, 2024

View reviewed changes

src/auth/strategies/oidc.strategy.ts Show resolved Hide resolved

bpedersen2 and others added 5 commits January 30, 2024 17:17

Add example graphql handler

c17335c

Change-Id: I832b6d9e2680aa8423441924de59c4157b50c8e6

removed redundant code

ca4f17c

OIDC userinfo and user query settings have been made configurable

b96d585

Junjiequan requested review from nitrosx and bpedersen2 February 5, 2024 08:49

nitrosx requested changes Feb 5, 2024

View reviewed changes

nitrosx mentioned this pull request Feb 5, 2024

RFC: Configurable access groups #726

Closed

3 tasks

Junjiequan added 4 commits February 6, 2024 14:51

improved if condition for parseQueryFilter

927525a

fixed wrong default logger method integration

6b9cf7f

improved logger message format

2736ea3

get accessGroupsProperty from userPayload for AccesGroupFromPayloadSe…

2f3c50d

…rvice

Junjiequan requested a review from nitrosx February 7, 2024 08:28

fix access-group-from-payload unit test fail

75cf22a

nitrosx requested changes Feb 7, 2024

View reviewed changes

src/auth/access-group-provider/access-group-from-graphql-api-call.service.ts Show resolved Hide resolved

src/auth/access-group-provider/access-group-service-factory.ts Show resolved Hide resolved

Junjiequan added 2 commits February 7, 2024 11:40

refactor: improved readability of parseQueryFilter in oidc.strategy file

13c4f69

fixed defaultLogger to log message without undefined even second para…

29e3e3d

…meter is not given.

Junjiequan requested a review from nitrosx February 8, 2024 12:29

Merge branch 'master' into SWAP-3745-scicat-be-make-oidc-user-validat…

952621a

…ion-process-confi

nitrosx approved these changes Feb 9, 2024

View reviewed changes

src/auth/access-group-provider/access-group-from-graphql-api-call.service.ts Show resolved Hide resolved

Junjiequan added 2 commits February 9, 2024 16:02

moved externalId and provider of create-user-identity dto to update-u…

f26522f

…ser-identity dto

Merge branch 'master' into SWAP-3745-scicat-be-make-oidc-user-validat…

f3b7268

…ion-process-confi

bpedersen2 reviewed Feb 14, 2024

View reviewed changes

Junjiequan added 3 commits February 20, 2024 15:01

Merge branch 'master' into SWAP-3745-scicat-be-make-oidc-user-validat…

0b701c1

…ion-process-confi

minor refactoring

c300a77

README updates for new environment variables

fd7e9c1

Junjiequan requested a review from bpedersen2 February 22, 2024 15:30

Junjiequan enabled auto-merge (squash) February 22, 2024 15:31

Merge branch 'master' into SWAP-3745-scicat-be-make-oidc-user-validat…

5d51633

…ion-process-confi

Junjiequan disabled auto-merge February 22, 2024 15:31

Merge branch 'master' into SWAP-3745-scicat-be-make-oidc-user-validat…

571cfbd

…ion-process-confi

bpedersen2 approved these changes Feb 27, 2024

View reviewed changes

Junjiequan added 2 commits February 27, 2024 16:12

Update README.md

2f52cf7

Merge branch 'master' into SWAP-3745-scicat-be-make-oidc-user-validat…

24cf7a3

…ion-process-confi

Junjiequan merged commit acc81ea into master Feb 28, 2024
7 checks passed

Junjiequan deleted the SWAP-3745-scicat-be-make-oidc-user-validation-process-confi branch February 28, 2024 08:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat: enable dynamic profile field mapping via env variables for oidc response #1041

Feat: enable dynamic profile field mapping via env variables for oidc response #1041

Junjiequan commented Jan 30, 2024

Junjiequan commented Feb 5, 2024

nitrosx left a comment

nitrosx left a comment

bpedersen2 left a comment

nitrosx commented Feb 26, 2024

bpedersen2 left a comment

bpedersen2 Feb 27, 2024

bpedersen2 Feb 27, 2024

Feat: enable dynamic profile field mapping via env variables for oidc response #1041

Feat: enable dynamic profile field mapping via env variables for oidc response #1041

Conversation

Junjiequan commented Jan 30, 2024

Description

Motivation

Fixes:

Changes:

Tests included/Docs Updated?

Junjiequan commented Feb 5, 2024

nitrosx left a comment

Choose a reason for hiding this comment

nitrosx left a comment

Choose a reason for hiding this comment

bpedersen2 left a comment

Choose a reason for hiding this comment

nitrosx commented Feb 26, 2024

bpedersen2 left a comment

Choose a reason for hiding this comment

bpedersen2 Feb 27, 2024

Choose a reason for hiding this comment

bpedersen2 Feb 27, 2024

Choose a reason for hiding this comment