{"action":"closed","number":167,"pull_request":{"url":"https://api.github.com/repos/cloudfoundry/uaa/pulls/167","id":38113312,"html_url":"https://github.com/cloudfoundry/uaa/pull/167","diff_url":"https://github.com/cloudfoundry/uaa/pull/167.diff","patch_url":"https://github.com/cloudfoundry/uaa/pull/167.patch","issue_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/167","number":167,"state":"closed","locked":false,"title":"configurable_automatic_creation_of_SAML_shadow_users","user":{"login":"amiri-ge","id":11050633,"avatar_url":"https://avatars.githubusercontent.com/u/11050633?v=3","gravatar_id":"","url":"https://api.github.com/users/amiri-ge","html_url":"https://github.com/amiri-ge","followers_url":"https://api.github.com/users/amiri-ge/followers","following_url":"https://api.github.com/users/amiri-ge/following{/other_user}","gists_url":"https://api.github.com/users/amiri-ge/gists{/gist_id}","starred_url":"https://api.github.com/users/amiri-ge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amiri-ge/subscriptions","organizations_url":"https://api.github.com/users/amiri-ge/orgs","repos_url":"https://api.github.com/users/amiri-ge/repos","events_url":"https://api.github.com/users/amiri-ge/events{/privacy}","received_events_url":"https://api.github.com/users/amiri-ge/received_events","type":"User","site_admin":false},"body":"This modification allows the administrator to configure their SAML identity provider so that shadow users are not automatically created after the user successfully authenticates with the SAML identity provider. Instead, the application that initiated the authorization code grant flow will receive an OAuth error redirect as per https://tools.ietf.org/html/rfc6749#section-4.1.2.1 indicating that the access is denied because a shadow user does not explicitly exist on the OAuth server (UAA).\r\n\r\nFor background, I discussed this feature with Sree Tummidi a few weeks ago and went over our use case for this behavior. Essentially, we want UAA to signal to the app that a shadow user has not been explicitly provisioned. The app will then put the user through a registration flow. Once the user is successfully registered the app will provision the shadow account for the user and re-initiate the OAuth authorization code grant. Since the browser's session with the SAML server should still be valid, the user is not prompted to enter their credentials a second time. Instead, the UAA server determines that the user shadow account does exist and redirects back to the app with the authorization code and the use is successfully logged in.\r\n\r\nHere are the benefits of this approach:\r\n1. It requires minimal changes to the existing UAA code since it leverages Spring failure handlers for SAML SSO.\r\n2. It allows applications to defer provisioning of shadow users until they have performed the required registration steps which keeps resource usage low.\r\n3. Once user completes registration they do not have to enter their credentials again thanks to the session they already established with the SAML server.\r\n4.  It avoids coupling UAA with any registration logic/workflow.\r\n\r\nUsage: the SAML idp configuration has an extra attribute \"addNew\" which is true by default to preserve the original behavior but can be set to false to enable the behavior described above.\r\n\r\nI've added an integration test for this as well as verified that all existing integration tests pass with only one ignored because it was marked by annotation to be ignored.","created_at":"2015-06-19T14:33:58Z","updated_at":"2015-07-09T00:31:26Z","closed_at":"2015-07-09T00:31:26Z","merged_at":null,"merge_commit_sha":"3f1d4eec5e90f74a90a66f16a3f13133f9cc94f6","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/cloudfoundry/uaa/pulls/167/commits","review_comments_url":"https://api.github.com/repos/cloudfoundry/uaa/pulls/167/comments","review_comment_url":"https://api.github.com/repos/cloudfoundry/uaa/pulls/comments{/number}","comments_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/167/comments","statuses_url":"https://api.github.com/repos/cloudfoundry/uaa/statuses/7093c303d18504d7645a1727cb6b89febf519957","head":{"label":"GESoftware-CF:US21634","ref":"US21634","sha":"7093c303d18504d7645a1727cb6b89febf519957","user":{"login":"GESoftware-CF","id":12106002,"avatar_url":"https://avatars.githubusercontent.com/u/12106002?v=3","gravatar_id":"","url":"https://api.github.com/users/GESoftware-CF","html_url":"https://github.com/GESoftware-CF","followers_url":"https://api.github.com/users/GESoftware-CF/followers","following_url":"https://api.github.com/users/GESoftware-CF/following{/other_user}","gists_url":"https://api.github.com/users/GESoftware-CF/gists{/gist_id}","starred_url":"https://api.github.com/users/GESoftware-CF/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GESoftware-CF/subscriptions","organizations_url":"https://api.github.com/users/GESoftware-CF/orgs","repos_url":"https://api.github.com/users/GESoftware-CF/repos","events_url":"https://api.github.com/users/GESoftware-CF/events{/privacy}","received_events_url":"https://api.github.com/users/GESoftware-CF/received_events","type":"Organization","site_admin":false},"repo":{"id":35747522,"name":"uaa","full_name":"GESoftware-CF/uaa","owner":{"login":"GESoftware-CF","id":12106002,"avatar_url":"https://avatars.githubusercontent.com/u/12106002?v=3","gravatar_id":"","url":"https://api.github.com/users/GESoftware-CF","html_url":"https://github.com/GESoftware-CF","followers_url":"https://api.github.com/users/GESoftware-CF/followers","following_url":"https://api.github.com/users/GESoftware-CF/following{/other_user}","gists_url":"https://api.github.com/users/GESoftware-CF/gists{/gist_id}","starred_url":"https://api.github.com/users/GESoftware-CF/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GESoftware-CF/subscriptions","organizations_url":"https://api.github.com/users/GESoftware-CF/orgs","repos_url":"https://api.github.com/users/GESoftware-CF/repos","events_url":"https://api.github.com/users/GESoftware-CF/events{/privacy}","received_events_url":"https://api.github.com/users/GESoftware-CF/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/GESoftware-CF/uaa","description":"CloudFoundry User Account and Authentication (UAA) Server","fork":true,"url":"https://api.github.com/repos/GESoftware-CF/uaa","forks_url":"https://api.github.com/repos/GESoftware-CF/uaa/forks","keys_url":"https://api.github.com/repos/GESoftware-CF/uaa/keys{/key_id}","collaborators_url":"https://api.github.com/repos/GESoftware-CF/uaa/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/GESoftware-CF/uaa/teams","hooks_url":"https://api.github.com/repos/GESoftware-CF/uaa/hooks","issue_events_url":"https://api.github.com/repos/GESoftware-CF/uaa/issues/events{/number}","events_url":"https://api.github.com/repos/GESoftware-CF/uaa/events","assignees_url":"https://api.github.com/repos/GESoftware-CF/uaa/assignees{/user}","branches_url":"https://api.github.com/repos/GESoftware-CF/uaa/branches{/branch}","tags_url":"https://api.github.com/repos/GESoftware-CF/uaa/tags","blobs_url":"https://api.github.com/repos/GESoftware-CF/uaa/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/GESoftware-CF/uaa/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/GESoftware-CF/uaa/git/refs{/sha}","trees_url":"https://api.github.com/repos/GESoftware-CF/uaa/git/trees{/sha}","statuses_url":"https://api.github.com/repos/GESoftware-CF/uaa/statuses/{sha}","languages_url":"https://api.github.com/repos/GESoftware-CF/uaa/languages","stargazers_url":"https://api.github.com/repos/GESoftware-CF/uaa/stargazers","contributors_url":"https://api.github.com/repos/GESoftware-CF/uaa/contributors","subscribers_url":"https://api.github.com/repos/GESoftware-CF/uaa/subscribers","subscription_url":"https://api.github.com/repos/GESoftware-CF/uaa/subscription","commits_url":"https://api.github.com/repos/GESoftware-CF/uaa/commits{/sha}","git_commits_url":"https://api.github.com/repos/GESoftware-CF/uaa/git/commits{/sha}","comments_url":"https://api.github.com/repos/GESoftware-CF/uaa/comments{/number}","issue_comment_url":"https://api.github.com/repos/GESoftware-CF/uaa/issues/comments{/number}","contents_url":"https://api.github.com/repos/GESoftware-CF/uaa/contents/{+path}","compare_url":"https://api.github.com/repos/GESoftware-CF/uaa/compare/{base}...{head}","merges_url":"https://api.github.com/repos/GESoftware-CF/uaa/merges","archive_url":"https://api.github.com/repos/GESoftware-CF/uaa/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/GESoftware-CF/uaa/downloads","issues_url":"https://api.github.com/repos/GESoftware-CF/uaa/issues{/number}","pulls_url":"https://api.github.com/repos/GESoftware-CF/uaa/pulls{/number}","milestones_url":"https://api.github.com/repos/GESoftware-CF/uaa/milestones{/number}","notifications_url":"https://api.github.com/repos/GESoftware-CF/uaa/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/GESoftware-CF/uaa/labels{/name}","releases_url":"https://api.github.com/repos/GESoftware-CF/uaa/releases{/id}","created_at":"2015-05-17T01:44:16Z","updated_at":"2015-05-17T01:44:18Z","pushed_at":"2015-07-07T19:31:21Z","git_url":"git://github.com/GESoftware-CF/uaa.git","ssh_url":"git@github.com:GESoftware-CF/uaa.git","clone_url":"https://github.com/GESoftware-CF/uaa.git","svn_url":"https://github.com/GESoftware-CF/uaa","homepage":"","size":24152,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"cloudfoundry:develop","ref":"develop","sha":"63025e2bd244de537e504c3ce03a65e3ca81385f","user":{"login":"cloudfoundry","id":621746,"avatar_url":"https://avatars.githubusercontent.com/u/621746?v=3","gravatar_id":"","url":"https://api.github.com/users/cloudfoundry","html_url":"https://github.com/cloudfoundry","followers_url":"https://api.github.com/users/cloudfoundry/followers","following_url":"https://api.github.com/users/cloudfoundry/following{/other_user}","gists_url":"https://api.github.com/users/cloudfoundry/gists{/gist_id}","starred_url":"https://api.github.com/users/cloudfoundry/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cloudfoundry/subscriptions","organizations_url":"https://api.github.com/users/cloudfoundry/orgs","repos_url":"https://api.github.com/users/cloudfoundry/repos","events_url":"https://api.github.com/users/cloudfoundry/events{/privacy}","received_events_url":"https://api.github.com/users/cloudfoundry/received_events","type":"Organization","site_admin":false},"repo":{"id":3382195,"name":"uaa","full_name":"cloudfoundry/uaa","owner":{"login":"cloudfoundry","id":621746,"avatar_url":"https://avatars.githubusercontent.com/u/621746?v=3","gravatar_id":"","url":"https://api.github.com/users/cloudfoundry","html_url":"https://github.com/cloudfoundry","followers_url":"https://api.github.com/users/cloudfoundry/followers","following_url":"https://api.github.com/users/cloudfoundry/following{/other_user}","gists_url":"https://api.github.com/users/cloudfoundry/gists{/gist_id}","starred_url":"https://api.github.com/users/cloudfoundry/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cloudfoundry/subscriptions","organizations_url":"https://api.github.com/users/cloudfoundry/orgs","repos_url":"https://api.github.com/users/cloudfoundry/repos","events_url":"https://api.github.com/users/cloudfoundry/events{/privacy}","received_events_url":"https://api.github.com/users/cloudfoundry/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/cloudfoundry/uaa","description":"CloudFoundry User Account and Authentication (UAA) Server","fork":false,"url":"https://api.github.com/repos/cloudfoundry/uaa","forks_url":"https://api.github.com/repos/cloudfoundry/uaa/forks","keys_url":"https://api.github.com/repos/cloudfoundry/uaa/keys{/key_id}","collaborators_url":"https://api.github.com/repos/cloudfoundry/uaa/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/cloudfoundry/uaa/teams","hooks_url":"https://api.github.com/repos/cloudfoundry/uaa/hooks","issue_events_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/events{/number}","events_url":"https://api.github.com/repos/cloudfoundry/uaa/events","assignees_url":"https://api.github.com/repos/cloudfoundry/uaa/assignees{/user}","branches_url":"https://api.github.com/repos/cloudfoundry/uaa/branches{/branch}","tags_url":"https://api.github.com/repos/cloudfoundry/uaa/tags","blobs_url":"https://api.github.com/repos/cloudfoundry/uaa/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/cloudfoundry/uaa/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/cloudfoundry/uaa/git/refs{/sha}","trees_url":"https://api.github.com/repos/cloudfoundry/uaa/git/trees{/sha}","statuses_url":"https://api.github.com/repos/cloudfoundry/uaa/statuses/{sha}","languages_url":"https://api.github.com/repos/cloudfoundry/uaa/languages","stargazers_url":"https://api.github.com/repos/cloudfoundry/uaa/stargazers","contributors_url":"https://api.github.com/repos/cloudfoundry/uaa/contributors","subscribers_url":"https://api.github.com/repos/cloudfoundry/uaa/subscribers","subscription_url":"https://api.github.com/repos/cloudfoundry/uaa/subscription","commits_url":"https://api.github.com/repos/cloudfoundry/uaa/commits{/sha}","git_commits_url":"https://api.github.com/repos/cloudfoundry/uaa/git/commits{/sha}","comments_url":"https://api.github.com/repos/cloudfoundry/uaa/comments{/number}","issue_comment_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/comments{/number}","contents_url":"https://api.github.com/repos/cloudfoundry/uaa/contents/{+path}","compare_url":"https://api.github.com/repos/cloudfoundry/uaa/compare/{base}...{head}","merges_url":"https://api.github.com/repos/cloudfoundry/uaa/merges","archive_url":"https://api.github.com/repos/cloudfoundry/uaa/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/cloudfoundry/uaa/downloads","issues_url":"https://api.github.com/repos/cloudfoundry/uaa/issues{/number}","pulls_url":"https://api.github.com/repos/cloudfoundry/uaa/pulls{/number}","milestones_url":"https://api.github.com/repos/cloudfoundry/uaa/milestones{/number}","notifications_url":"https://api.github.com/repos/cloudfoundry/uaa/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/cloudfoundry/uaa/labels{/name}","releases_url":"https://api.github.com/repos/cloudfoundry/uaa/releases{/id}","created_at":"2012-02-07T22:40:55Z","updated_at":"2015-07-08T13:51:19Z","pushed_at":"2015-07-09T00:22:40Z","git_url":"git://github.com/cloudfoundry/uaa.git","ssh_url":"git@github.com:cloudfoundry/uaa.git","clone_url":"https://github.com/cloudfoundry/uaa.git","svn_url":"https://github.com/cloudfoundry/uaa","homepage":"","size":37815,"stargazers_count":221,"watchers_count":221,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":213,"mirror_url":null,"open_issues_count":23,"forks":213,"open_issues":23,"watchers":221,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/cloudfoundry/uaa/pulls/167"},"html":{"href":"https://github.com/cloudfoundry/uaa/pull/167"},"issue":{"href":"https://api.github.com/repos/cloudfoundry/uaa/issues/167"},"comments":{"href":"https://api.github.com/repos/cloudfoundry/uaa/issues/167/comments"},"review_comments":{"href":"https://api.github.com/repos/cloudfoundry/uaa/pulls/167/comments"},"review_comment":{"href":"https://api.github.com/repos/cloudfoundry/uaa/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/cloudfoundry/uaa/pulls/167/commits"},"statuses":{"href":"https://api.github.com/repos/cloudfoundry/uaa/statuses/7093c303d18504d7645a1727cb6b89febf519957"}},"merged":false,"mergeable":false,"mergeable_state":"dirty","merged_by":null,"comments":6,"review_comments":1,"commits":8,"additions":464,"deletions":4,"changed_files":10}}