{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/origin/pulls/comments/41997536","id":41997536,"diff_hunk":"@@ -0,0 +1,71 @@\n+package identitymapper\n+\n+import (\n+\t\"fmt\"\n+\n+\tkapi \"k8s.io/kubernetes/pkg/api\"\n+\n+\tauthapi \"github.com/openshift/origin/pkg/auth/api\"\n+\t\"github.com/openshift/origin/pkg/user\"\n+\tuserapi \"github.com/openshift/origin/pkg/user/api\"\n+\tidentityregistry \"github.com/openshift/origin/pkg/user/registry/identity\"\n+\tuserregistry \"github.com/openshift/origin/pkg/user/registry/user\"\n+\tmappingregistry \"github.com/openshift/origin/pkg/user/registry/useridentitymapping\"\n+)\n+\n+type UserStrategyType string\n+\n+const (\n+\t// StrategyTypeLookup does not provision a new identity or user, it only allows identities already associated with users\n+\tStrategyTypeLookup UserStrategyType = \"lookup\"\n+\n+\t// StrategyTypeClaim associates a new identity with a user with the identity's preferred username\n+\t// if no other identities are already associated with the user\n+\tStrategyTypeClaim UserStrategyType = \"claim\"\n+\n+\t// StrategyTypeAdd associates a new identity with a user with the identity's preferred username,\n+\t// adding to any existing identities associated with the user\n+\tStrategyTypeAdd UserStrategyType = \"add\"\n+\n+\t// StrategyTypeReplace associates a new identity with a user with the identity's preferred username,\n+\t// replacing any existing identities associated with the user\n+\tStrategyTypeReplace UserStrategyType = \"replace\"\n+\n+\t// StrategyTypeGenerate finds an available username for a new identity, based on its preferred username\n+\t// If a user with the preferred username already exists, a unique username is generated\n+\tStrategyTypeGenerate UserStrategyType = \"generate\"\n+)\n+\n+type UserStrategy interface {","path":"pkg/auth/userregistry/identitymapper/mapper.go","position":39,"original_position":39,"commit_id":"44a66dbab838dc9a8937d15df9d95afbfbd559f3","original_commit_id":"44a66dbab838dc9a8937d15df9d95afbfbd559f3","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"body":"godoc.  Explain why this is different/better than `UserIdentityMapper`.","created_at":"2015-10-14T14:10:12Z","updated_at":"2015-10-14T14:10:12Z","html_url":"https://github.com/openshift/origin/pull/5060#discussion_r41997536","pull_request_url":"https://api.github.com/repos/openshift/origin/pulls/5060","_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments/41997536"},"html":{"href":"https://github.com/openshift/origin/pull/5060#discussion_r41997536"},"pull_request":{"href":"https://api.github.com/repos/openshift/origin/pulls/5060"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/5060","id":47359938,"html_url":"https://github.com/openshift/origin/pull/5060","diff_url":"https://github.com/openshift/origin/pull/5060.diff","patch_url":"https://github.com/openshift/origin/pull/5060.patch","issue_url":"https://api.github.com/repos/openshift/origin/issues/5060","number":5060,"state":"open","locked":false,"title":"Configurable identity mapper strategies","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"body":"On login, we currently auto-provision a unique username for new identities. Additional strategies should exist.\r\n\r\nThis PR adds a `mappingMethod` option to all identity providers:\r\n\r\n```\r\noauthConfig:\r\n  identityProviders:\r\n  - challenge: true\r\n    login: true\r\n    mappingMethod: \"...\"\r\n    ...\r\n```\r\n\r\n`mappingMethod` can be set to the following values:\r\n\r\n* **lookup**\r\n  * Administrator wants to manually configure identity/user mappings. Login process should only look up existing mappings, not create them\r\n* **generate** (prior default behavior)\r\n  * Provision with generation of unique usernames (e.g. \"bob\", \"bob2\")\r\n  * This strategy should not be used in combination with LDAP group sync\r\n* **claim** (new default)\r\n  * Provision with deterministic username, fail if username is already mapped to another identity\r\n* **replace**\r\n  * Provision with deterministic username, replace mapping if username is already mapped to another identity\r\n* **add**\r\n  * Provision with deterministic username, add to existing user if username is already mapped to another identity\r\n  * Needed when multiple identity providers are configured which identity the same set of users and map to the same usernames\r\n\r\nTODO:\r\n- [x] Decide on default strategy... probably \"claim\"\r\n- [x] Decide on name for \"claim\" and \"generate\" strategies\r\n- [x] Decide on name for identityProvider field name (currently \"mappingMethod\")\r\n- [ ] Open ansible issue\r\n- [ ] Open doc issue\r\n\r\nFollowups:\r\n- [ ] Consider surfacing a nicer error to the user when the identity provision fails lookup and claim strategies (currently get a 500 Internal Error, internally there's a UserIdentityMapping NotFound error or a ClaimError). Not sure if I'd want to leak this info.\r\n- [ ] Surface a nicer error to the admin when there's a claim strategy failure (they may want to switch to add or replace)\r\n\r\nFixes #5009","created_at":"2015-10-11T04:31:33Z","updated_at":"2015-10-14T14:10:12Z","closed_at":null,"merged_at":null,"merge_commit_sha":"108bad43e882a1e2c0913af30180af16f7711e93","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openshift/origin/pulls/5060/commits","review_comments_url":"https://api.github.com/repos/openshift/origin/pulls/5060/comments","review_comment_url":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/origin/issues/5060/comments","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/44a66dbab838dc9a8937d15df9d95afbfbd559f3","head":{"label":"liggitt:mapper","ref":"mapper","sha":"44a66dbab838dc9a8937d15df9d95afbfbd559f3","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"repo":{"id":23198153,"name":"origin","full_name":"liggitt/origin","owner":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/liggitt/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":true,"url":"https://api.github.com/repos/liggitt/origin","forks_url":"https://api.github.com/repos/liggitt/origin/forks","keys_url":"https://api.github.com/repos/liggitt/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/liggitt/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/liggitt/origin/teams","hooks_url":"https://api.github.com/repos/liggitt/origin/hooks","issue_events_url":"https://api.github.com/repos/liggitt/origin/issues/events{/number}","events_url":"https://api.github.com/repos/liggitt/origin/events","assignees_url":"https://api.github.com/repos/liggitt/origin/assignees{/user}","branches_url":"https://api.github.com/repos/liggitt/origin/branches{/branch}","tags_url":"https://api.github.com/repos/liggitt/origin/tags","blobs_url":"https://api.github.com/repos/liggitt/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/liggitt/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/liggitt/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/liggitt/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/liggitt/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/liggitt/origin/languages","stargazers_url":"https://api.github.com/repos/liggitt/origin/stargazers","contributors_url":"https://api.github.com/repos/liggitt/origin/contributors","subscribers_url":"https://api.github.com/repos/liggitt/origin/subscribers","subscription_url":"https://api.github.com/repos/liggitt/origin/subscription","commits_url":"https://api.github.com/repos/liggitt/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/liggitt/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/liggitt/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/liggitt/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/liggitt/origin/contents/{+path}","compare_url":"https://api.github.com/repos/liggitt/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/liggitt/origin/merges","archive_url":"https://api.github.com/repos/liggitt/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/liggitt/origin/downloads","issues_url":"https://api.github.com/repos/liggitt/origin/issues{/number}","pulls_url":"https://api.github.com/repos/liggitt/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/liggitt/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/liggitt/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/liggitt/origin/labels{/name}","releases_url":"https://api.github.com/repos/liggitt/origin/releases{/id}","created_at":"2014-08-21T18:23:05Z","updated_at":"2015-05-08T13:01:51Z","pushed_at":"2015-10-13T22:27:05Z","git_url":"git://github.com/liggitt/origin.git","ssh_url":"git@github.com:liggitt/origin.git","clone_url":"https://github.com/liggitt/origin.git","svn_url":"https://github.com/liggitt/origin","homepage":"https://openshift.github.io","size":153095,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"842e1a55acc12a422cf6e9be046cb0a4948f9706","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":22442668,"name":"origin","full_name":"openshift/origin","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":false,"url":"https://api.github.com/repos/openshift/origin","forks_url":"https://api.github.com/repos/openshift/origin/forks","keys_url":"https://api.github.com/repos/openshift/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/origin/teams","hooks_url":"https://api.github.com/repos/openshift/origin/hooks","issue_events_url":"https://api.github.com/repos/openshift/origin/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/origin/events","assignees_url":"https://api.github.com/repos/openshift/origin/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/origin/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/origin/tags","blobs_url":"https://api.github.com/repos/openshift/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/origin/languages","stargazers_url":"https://api.github.com/repos/openshift/origin/stargazers","contributors_url":"https://api.github.com/repos/openshift/origin/contributors","subscribers_url":"https://api.github.com/repos/openshift/origin/subscribers","subscription_url":"https://api.github.com/repos/openshift/origin/subscription","commits_url":"https://api.github.com/repos/openshift/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/origin/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/origin/merges","archive_url":"https://api.github.com/repos/openshift/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/origin/downloads","issues_url":"https://api.github.com/repos/openshift/origin/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/origin/labels{/name}","releases_url":"https://api.github.com/repos/openshift/origin/releases{/id}","created_at":"2014-07-30T20:04:05Z","updated_at":"2015-10-14T09:43:11Z","pushed_at":"2015-10-14T14:09:45Z","git_url":"git://github.com/openshift/origin.git","ssh_url":"git@github.com:openshift/origin.git","clone_url":"https://github.com/openshift/origin.git","svn_url":"https://github.com/openshift/origin","homepage":"http://www.openshift.org","size":266888,"stargazers_count":736,"watchers_count":736,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":451,"mirror_url":null,"open_issues_count":587,"forks":451,"open_issues":587,"watchers":736,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/5060"},"html":{"href":"https://github.com/openshift/origin/pull/5060"},"issue":{"href":"https://api.github.com/repos/openshift/origin/issues/5060"},"comments":{"href":"https://api.github.com/repos/openshift/origin/issues/5060/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/origin/pulls/5060/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/origin/pulls/5060/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/origin/statuses/44a66dbab838dc9a8937d15df9d95afbfbd559f3"}}}}