{"action":"created","issue":{"url":"https://api.github.com/repos/edx/edx-platform/issues/9651","labels_url":"https://api.github.com/repos/edx/edx-platform/issues/9651/labels{/name}","comments_url":"https://api.github.com/repos/edx/edx-platform/issues/9651/comments","events_url":"https://api.github.com/repos/edx/edx-platform/issues/9651/events","html_url":"https://github.com/edx/edx-platform/pull/9651","id":105340933,"number":9651,"title":"Automatic account provisioning for opted-in SAML providers","user":{"login":"e-kolpakov","id":3330048,"avatar_url":"https://avatars.githubusercontent.com/u/3330048?v=3","gravatar_id":"","url":"https://api.github.com/users/e-kolpakov","html_url":"https://github.com/e-kolpakov","followers_url":"https://api.github.com/users/e-kolpakov/followers","following_url":"https://api.github.com/users/e-kolpakov/following{/other_user}","gists_url":"https://api.github.com/users/e-kolpakov/gists{/gist_id}","starred_url":"https://api.github.com/users/e-kolpakov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/e-kolpakov/subscriptions","organizations_url":"https://api.github.com/users/e-kolpakov/orgs","repos_url":"https://api.github.com/users/e-kolpakov/repos","events_url":"https://api.github.com/users/e-kolpakov/events{/privacy}","received_events_url":"https://api.github.com/users/e-kolpakov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-09-08T09:39:40Z","updated_at":"2015-09-09T14:24:20Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/edx/edx-platform/pulls/9651","html_url":"https://github.com/edx/edx-platform/pull/9651","diff_url":"https://github.com/edx/edx-platform/pull/9651.diff","patch_url":"https://github.com/edx/edx-platform/pull/9651.patch"},"body":"**Description:** Forward port of https://github.com/edx-solutions/edx-platform/pull/511\r\n**JIRA:** [YONK-80](https://openedx.atlassian.net/browse/YONK-80)\r\n**Background:** This change adds automatic account provisioning for opt-in IdPs (configured in admin backend). If provider is opted-in, the data coming from it will be used to automatically create user account, requiring no user interaction. If some required data is missing or invalid (i.e. username or email), fake data is generated to still provision the account.\r\nThere's an existing setting \"Skip Registration Form\", which does the similar thing (automatically creates an account); the difference between the two is that \"Skip Registration Form\" actually redirects user to real Reg Form and automatically submits it on page load. As a result, the reg workflow is still in place, and if there are any validation issues, user will be see the reg form and all the messages. With Autoprovisioning, account is created completely automatically - reg form is not used; instead, an account is created in a single request. If some data is missing or does not pass validation an attempt is made to fake it; only if it fails the user will be redirected to login/registration form and see the errors, or is asked to log in into existing account.\r\n**Author concerns:** So far, automatic provisioning overrides `Skip Email Verification` provider setting and always skips email verification. This might or might not be a good idea. On one hand, IdP is trusted so much that data coming from it is automatically used and no user interaction is required. On the other hand, it might make sense to still allow normal email verification for such kind of providers.\r\n**Sandboxes:** [LMS](http://pr9651.sandbox.opencraft.com/), [Studio](http://studio.pr9651.sandbox.opencraft.com/)\r\n**Testing instructions:**\r\n*When using provided sandboxes, steps 1-3 are already performed, so you can skip them*\r\n1. Follow instructions at [Shibboleth Configuration](https://openedx.atlassian.net/wiki/display/OpenOPS/New+Shibboleth+Configuration) docs until step 6.\r\n2. The easiest way to set up a second part of SAML authentication process is to use http://testshib.org\r\n2.1. Export edX SSO metadata to a file.\r\n2.2. Import them at [\"Register\" step](https://www.testshib.org/register.html) of testshib configuration (make sure the filename is unique)\r\n2.3. When editing SAML provider config (step 6 in Shibboleth Config guide), check \"Autoprovision account\" checkbox and set `urn:oid:1.3.6.1.4.1.5923.1.1.1.6` as email hint (testshib does not send email, but sends [eduPersonPrincipalName](http://www.internet2.edu/products-services/trust-identity-middleware/mace-registries/internet2-object-identifier-oid-registrations/) which looks like an email and is just enough for testing purposes). \r\n3. If you have aliases for lms in your environemnt (i.e. localhost:8000 and lms.local both point to LMS), make sure you're accessing signin view from the same hostname your exported metadata lists as `AssertionConsumerService[@Location]` attribute.\r\n4. Go to login or registration form\r\n5. Click on the testshib SSO provider\r\n![testshib](https://cloud.githubusercontent.com/assets/3330048/9581432/1dc3233a-5008-11e5-8047-14e247f22db3.png)\r\n6. Use any username and password testhib provides (myself, alterego or superego)\r\n7. Clicking \"login\" in Testhib should redirect to LMS and automatically provision an account for new user. Subsequent logins with same user should log him into an existing account\r\n\r\n- - -\r\n**Settings**\r\n```yaml\r\nEDXAPP_FEATURES:\r\n  ENABLE_THIRD_PARTY_AUTH: true\r\n```"},"comment":{"url":"https://api.github.com/repos/edx/edx-platform/issues/comments/138925887","html_url":"https://github.com/edx/edx-platform/pull/9651#issuecomment-138925887","issue_url":"https://api.github.com/repos/edx/edx-platform/issues/9651","id":138925887,"user":{"login":"e-kolpakov","id":3330048,"avatar_url":"https://avatars.githubusercontent.com/u/3330048?v=3","gravatar_id":"","url":"https://api.github.com/users/e-kolpakov","html_url":"https://github.com/e-kolpakov","followers_url":"https://api.github.com/users/e-kolpakov/followers","following_url":"https://api.github.com/users/e-kolpakov/following{/other_user}","gists_url":"https://api.github.com/users/e-kolpakov/gists{/gist_id}","starred_url":"https://api.github.com/users/e-kolpakov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/e-kolpakov/subscriptions","organizations_url":"https://api.github.com/users/e-kolpakov/orgs","repos_url":"https://api.github.com/users/e-kolpakov/repos","events_url":"https://api.github.com/users/e-kolpakov/events{/privacy}","received_events_url":"https://api.github.com/users/e-kolpakov/received_events","type":"User","site_admin":false},"created_at":"2015-09-09T14:24:20Z","updated_at":"2015-09-09T14:24:20Z","body":"@sarina yes, it is reviewed and merged: https://github.com/edx-solutions/edx-platform/pull/511. There're no code changes since https://github.com/edx-solutions/edx-platform/pull/511 so far."}}