SimpleSAML email address breaks login for user
davidrkupton opened this issue · comments
When an FID record does not have an email address (can happen for any user, but more common for sponsored accounts), Drupal fakes an email address on first login.
This then seems to prevent the user from logging in via SSO until this manual workaround:
- the username is manually set to the UID (can be done in the backend by someone with Administrator role)
- the email address is set to a unique email on boston.gov (can be done in the backend by someone with Administrator role)
- the realname record is manually updated to
firstname lastnamein Drupal's MySQL Database.
Need to either convince IAM to enforce the existence of an email address, or else update SimpleSAML in Drupal to accommodate the circumstance when an email address is missing from sso's SAML response. SAML need to be modified to create the record using the UID as the UserName, firstname.lastname@boston.gov as the email guess and firstname lastname as the realname.
Work effort 1-2 days to develop, 1-2 days to test
@davidrkupton Can we close this ticket or do we need to move it to JIRA?
@stephaniemar
I think this is still an issue.
It can only be solved by FID enforcing email addresses on all accounts created.
You can raise this with Gretchen to see if that poicy has or is likely to be adopted.
@davidrkupton IAM will be moving off of FID to Azure- will this still be an issue? Some accounts still will not have an email address.
Ok. Gretchen is on vacation this week, I will send her a note about this for when she gets back.