Shibboleth users lost access after migrating from v1.2 to 2.2

Administrators
1

After migrating to from v1.2 to v2.2.8, users who only had Shibboleth accounts, are asked to create an account upon login but the new account is not associated with any of the permissions they had for categories and events on v1.2.
Is there a way that I can associate Shibboleth email with the permissions access instead of the ID?

This is my setup for SSO:

# SSO
AUTH_PROVIDERS = {
    'shib-sso': {
          'type': 'shibboleth'
        , 'title': 'Fermilab SSO'
        , 'attrs_prefix': 'SSO_'
        , 'callback_uri': '/login/shib-sso/shibboleth'
    }
}
IDENTITY_PROVIDERS = {
    'shib-sso': {
        'type': 'shibboleth',
        'title': 'Fermilab SSO',
        'identifier_field': 'SSO_USERID',
        'mapping': {
                     'email': 'SSO_EMAIL',
                     'login': 'SSO_USERID',
                     'personId': 'SSO_USERID',
                     'last_name': 'SSO_NAME_LAST',
                     'first_name': 'SSO_NAME_FIRST'
                    },
        'trusted_email': True
        }
   }
2

Indico always matches emails even if the identifier (sso_userid) doesn’t match… so it’s very strange that that are asked to create new accounts instead of getting the prompt to associate their existing account…

3

The account was a Shibboleth account. In the permissions the person’s email was already present, yet he could not access the category or the event.
When I looked at the user account, the creation date was today’s day.

4

The interesting question would be where his correct account is. Maybe he had a different email there but it worked in the past because once an account is linked to a login method the email doesn’t matter?

In any case, once you found the account and know it’s the same user, just merge them…

5

I did check the email and is exactly the same as in the newly created account.
I will look in the database and see what exists there just in case I have missed something

6

When I look at the database I see the following:

image
image1400×326 28.4 KB

The top entry is the one created today. The other two are the ones migrated from v1.2 but are marked are deleted for some reason.
Also, there are no identities for this person.
I do not understand how he managed to create two indico accounts with the same email in indico v1.2 and why the migration process marked both accounts as deleted.
How can I merge these accounts as I do not see them in the indico interface?

7

I edited the database and changed the e-mail entries for the two deleted accounts to be different (pen1@fnal.gov, pen2@fnal.gov) and made the deleted flag on the emails and users to false. Then I was able to see the accounts on the interface and merged them.
The user tested his access and it is working fine.
Not the most elegant solution, but it worked.

8

This happens exactly when you have the problem of multiple users with the same email in the legacy database:

The code tries to keep the one with identity information (ie accounts like shibboleth or ldap), but if that’s not possible both of them are deleted (that’s the problem with garbage data… you cannot really do much more than throwing it away :/)

Your way of fixing it manually by undeleting the user and their email entry and then merging was a good idea! It’s the solution that a human can easily do for specific case, but a migration script migrating ten thousands of users can’t :wink:

9

Thank Adrian! I imagined thatt was the case and this is what I told the user (two accounts with the same email is not allowed).
I am glad that the way I fixed the issue is acceptable as I was not able to find any other way of doing it fast. The only small glitch I had was that the new interface has the reverse order (primary, secondary) from v1.2… and I had to change which email is the primary one, very easy in this version, just click a button!!
Thank you for looking into this.

10

Hi @penelopec were you able to resolve this? I have a similar issue