Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Shibboleth: handle Identity Providers that provide multiple first or last names separated by semicolons in indeterminate order #1608

Closed
pdurbin opened this issue Mar 6, 2015 · 3 comments
Assignees
Labels
Type: Feature a feature request

Comments

@pdurbin
Copy link
Member

pdurbin commented Mar 6, 2015

At least one Identity Provider is known to sometimes provide more than one first name (givenName) separated by semicolons. From internal discussion it is believe that multiple last names (sn) are also possible.

Unfortunately, it sounds like we can not rely on the first value being the preferred one: "The IdP is going to pass back multiple values for multivalued attributes. There's no set order that I know of." So if we just always persist the first value, the user might notice that their first name keeps changing.

Hopefully not too many Identity Providers return multiple first names. For both "givenName" and "sn" Ohio State, for example, says, "The attribute is currently single-valued" at https://webauth.service.ohio-state.edu/~shibboleth/attributes.html . The Identity Provider is probably in the best position to decide which givenName is the preferred one, so it makes sense that many of them only send a single value.

@bencomp
Copy link
Contributor

bencomp commented Mar 6, 2015

I suggest to explain a possibly changing name in support documents. Perhaps for Shib users, a link to the exact docs could be added below their profile name in small print: Why did my profile name change?

Or when a change is detected on login, this could be sent as a notification ("We updated your profile name with the new information we received from [your identity provider]") with a link to the doc.

@pdurbin pdurbin added this to the In Review - 4.0 milestone Mar 6, 2015
@pdurbin pdurbin added Type: Feature a feature request Status: Dev labels Mar 6, 2015
@pdurbin pdurbin changed the title Shibboleth: handle Identity Providers that provide multiple first or last names separated by semicolons Shibboleth: handle Identity Providers that provide multiple first or last names separated by semicolons in indeterminate order Mar 6, 2015
@pdurbin
Copy link
Member Author

pdurbin commented Mar 9, 2015

Now the Shib code looks for multiple values for firstName and lastName, sorts them alphabetically, and uses the first value. At least this way users shouldn't see their name changing. And if they prefer the value that comes later in the alphabet, they can talk to their identity provider. Moving to QA.

@pdurbin pdurbin removed their assignment Mar 9, 2015
@kcondon
Copy link
Contributor

kcondon commented Mar 20, 2015

@posixeleni has a shib account with multiple names. Phil sat with her and confirmed the multi name case works as expected. Closing.

@kcondon kcondon closed this as completed Mar 20, 2015
pdurbin added a commit that referenced this issue Mar 2, 2016
- Put email addresses throught the same "find single value" logic
  originally developed in #1608 for multiple first and last names.
- Add `@ValidateEmail` to the "email" field on AuthenticatedUser to
  match BuiltinUser.
- Add null check added to EmailValidator to make it testable.
- Add `INVALID_EMAIL` and `MISSING_REQUIRED_ATTR` modes for Shib testing
  in dev.
- Remove red warning when TestShib doesn't provide "mail" attribute.
- Catch authSvc.createAuthenticatedUser exceptions and handle errors
  better.
- Reformat code (getPrettyFacesHomePageString seems ok).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Feature a feature request
Projects
None yet
Development

No branches or pull requests

4 participants