Repository navigation
Conversation
Install pas.plugins.identity with the dependencies profile, and represent each user account as a Person in /users. Groups stay in source_groups, and Person objects that are not accounts, like team pages, stay plain content. - Patch pas.plugins.identity 1.0.0a11 to use Person instead of the hardcoded UserProfile, and no group content type - Person schema extends IUserContent; Person gets the user attributes (userid, login, fullname, emails, email, verified_emails) and an optional email addresses behavior - A Person created with a login is marked as a user profile - Disallow UserProfile and UserGroup globally - Upgrade step 20260929001 installs the add-on and creates a Person for each user in source_users - New identity-keycloak, identity-oidc, identity-github and identity-google site creation providers, side by side with the pas.plugins.oidc and pas.plugins.authomatic ones Upstream: collective/pas-plugins-identity#127 Refs: https://gitlab.kitconcept.io/kitconcept/distribution-kitconcept-intranet/-/issues/604
1.0.0a12 reads user_content_type and group_content_type everywhere instead of hardcoding UserProfile and UserGroup (upstream #127), so the patch that rewrote PROFILE_PORTAL_TYPE in its modules is removed. Only the user attributes of Person are still patched. The type records are now seeded once at install and left to the site, so the dependencies profile sets user_content_type to Person and an empty group_content_type, keeping groups in source_groups. - Replace the patch tests with checks on principal_types - Test that new groups stay in source_groups, with no UserGroup content Known gap until upstream #129: ensure_profile only creates the user type when the type provides IUserProfile, so a first login no longer creates a Person. Upstream: collective/pas-plugins-identity#129 Refs: https://gitlab.kitconcept.io/kitconcept/distribution-kitconcept-intranet/-/issues/604
Site creation now refuses the keycloak, oidc, authomatic-github and authomatic-google providers, naming the identity-* replacement, so any distribution based on kitconcept.core creates sites with pas.plugins.identity or plain Plone authentication only. - Raise UnsupportedAuthenticationProvider for the old providers - Deprecate setup_oidc_auth, setup_keycloak_auth and setup_authomatic - Replace the shared schema definitions with identity-keycloak, identity-oidc, identity-github and identity-google - Ignore the SITE_AUTHENTICATION_OIDC-* and AUTHOMATIC-* environment variables, with a warning - Offer only internal and the identity-* providers in the testing schema, without the "Identity:" title prefix - identity-keycloak installs pas.plugins.keycloakgroups for the realm groups, and mints userids from the Keycloak sub, the user id the groups plugin looks up - Replace the old provider site creation tests, and fix two profile-installed tests that passed with the profile missing Refs: https://gitlab.kitconcept.io/kitconcept/distribution-kitconcept-intranet/-/issues/604
pas.plugins.identity writes a name claim only over the value it wrote itself. Person.fullname returned the Person title, which broke that in two ways: - A Person without names has the title "None" (collective.person formats a missing first name that way), so the first login never wrote the name - The title utility does not round-trip the written value (last_first gives "Hopper, Grace", extra spaces collapse), so no later login could update the name The getter now returns exactly the full name last written while the first and last name still split from it, and the names joined once they are edited, so a provider keeps a name it owns and leaves an edited one alone. Refs: https://gitlab.kitconcept.io/kitconcept/distribution-kitconcept-intranet/-/issues/604
1.0.0a13 creates the site's user type at login when the site marks its objects IUserProfile one by one (upstream #129), and lists users that only have a profile in api.user.get_users() and listMembers() (upstream #131). With Person as the user type, an SSO first login now creates the Person, and federated users are listed once. - Test that federated and source_users logins create a Person, that the name claim is synced and updated, and that every user is listed once while a Person without login is never listed Upstream: collective/pas-plugins-identity#130 Refs: https://gitlab.kitconcept.io/kitconcept/distribution-kitconcept-intranet/-/issues/604
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces
pas.plugins.oidcandpas.plugins.authomaticwithpas.plugins.identityfor new sites, withPersonas the user content type.Refs: https://gitlab.kitconcept.io/kitconcept/distribution-kitconcept-intranet/-/issues/604
Site creation now refuses the
keycloak,oidc,authomatic-githubandauthomatic-googleproviders withUnsupportedAuthenticationProvider, and the error names the replacement. The shared schema definitions injected into every distribution's schema changed fromkeycloak,oidc,authomatic-githubandauthomatic-googletoidentity-keycloak,identity-oidc,identity-githubandidentity-google.Before a distribution bumps kitconcept.core, it has to update its
schema.jsonto theidentity-*providers. Existing sites keep theirpas.plugins.oidcandpas.plugins.authomaticconfiguration.What changed
Users as
Personpas.plugins.identity(1.0.0a13) is always installed, as a dependency ofkitconcept.core:dependencies.Personin/users, aPrincipalsContainerthat allows onlyPerson. Groups stay insource_groups.Personschema extendsIUserContent. A subscriber marks only the Persons created with a login asIUserProfile, so other Persons, such as team pages, stay plain content and are never listed as users.Persongets the user attributes the identity plugins read (userid,login,fullname,emails,email,verified_emails), plus an optionalkitconcept.core.person_emailsbehavior.fullnamereturns exactly the name a provider last wrote. Because of that, a later login can still update the name, and a name edited on the Person is kept.UserProfileandUserGroupare no longer globally addable.20260929001installs the add-on on existing sites and creates aPersonfor each user insource_users.Authentication providers
identity-keycloak,identity-oidc,identity-githubandidentity-google. They're configured withidentity-*answers orSITE_AUTHENTICATION_IDENTITY-*environment variables. An optionalidentity-site-urlsets the callback URL to<site-url>/login-identity.identity-keycloak, the realm's groups come frompas.plugins.keycloakgroups, and Plone userids are minted from the Keycloaksub, which is the user id that plugin looks up.internal(Plone login) stays, and remains the default.SITE_AUTHENTICATION_OIDC-*andSITE_AUTHENTICATION_AUTHOMATIC-*environment variables are ignored, with a warning.setup_oidc_auth,setup_keycloak_authandsetup_authomaticare deprecated and emit aDeprecationWarning.internaland theidentity-*providers.Upstream work
While integrating, we found three problems in
pas.plugins.identity. All are fixed and released in 1.0.0a13:user_content_type/group_content_type(1.0.0a12)api.user.get_users()/listMembers()Tests
make lintis clean. mypy shows only the 3 errors thatmainalready has.source_userslogins create aPerson, the name claim is synced and updated, every user is listed exactly once, and aPersonwithout a login is never listed. On 1.0.0a12, 10 of these tests fail or error.userid_sourcedefault;group_content_type;fullnamegetter.Not in this PR
schema.jsonto theidentity-*providers;@plone-collective/volto-identity, which hides the Plone password form by default.pas.plugins.oidcandpas.plugins.authomatic(provider configuration and user links). Upstream shipsmigration/oidc.pyandmigration/authomatic.py; this will be a follow-up issue.subuserids. The client's service account needs to be able to view users and query groups.