Idea #12705
closed
Documentation/helper scripts for migrating users to federated identity
Added by Peter Amstutz over 6 years ago. Updated over 6 years ago.
Related issues
Updated by Peter Amstutz over 6 years ago
- Blocked by Idea #11453: Federated user identity which works across a network of Arvados clusters added
Updated by Tom Morris
Updated by Peter Amstutz over 6 years ago
- Target version changed from 2017-12-20 Sprint to 2018-01-17 Sprint
Updated by Tom Clegg over 6 years ago
- Related to Idea #12702: Migrate user accounts added
Updated by Tom Clegg over 6 years ago
- Status changed from New to In Progress
12705-user-migrate-docs @ d309809f4f81c4f92b7441a0e4dc1e9e2f27be76
Updated by Tom Clegg over 6 years ago
- Related to Idea #12945: Document and test identity provider migration for user accounts added
Updated by Anonymous over 6 years ago
- Status changed from In Progress to Resolved
Applied in changeset arvados|707e31dad5efed2bb4af7e624f90cff80b6e4052.
Updated by Tom Clegg over 6 years ago
- Status changed from Resolved to In Progress
After moving an errant federated account record (added by a user logging in to a remote cluster before their account has been migrated) out of the way, the remote cluster's cached token entry gets moved along with it. When the user visits with the same token, they end up using the account that was supposed to be moved out of the way. The easy workaround is to wait 5 minutes for the cache to expire. This should be documented.
However, there's also a cache bug that prevents the remote cluster's token entry from being updated even after the cache time expires. This should be fixed. (Another consequence of the bug is that the cache stops working if the authoritative cluster changes a token without changing its uuid, which isn't common but should be handled correctly.)
Updated by Tom Clegg over 6 years ago
12705-token-cache @ 7ec6b571c54af1ddd404488b2922c41dfdffdde1
Updated by Lucas Di Pentima over 6 years ago
This lgtm. Just a related question:
- File
services/api/app/models/api_client_authorization.rb- Line 167: Isn’t that
elsifsuperfluous? shouldn’t it be just anelseclause?
- Line 167: Isn’t that
Updated by Tom Clegg over 6 years ago
Lucas Di Pentima wrote:
- File
services/api/app/models/api_client_authorization.rb
- Line 167: Isn’t that
elsifsuperfluous? shouldn’t it be just anelseclause?
Not quite, if remote_user['is_active'] then we don't want to deactivate the local user -- and if !Rails.config.new_users_are_active then we don't want to activate, either.
Updated by Anonymous over 6 years ago
- Status changed from In Progress to Resolved
- % Done changed from 50 to 100
Applied in changeset arvados|d179241c734c2c533f4453beaecd53d27ced9a98.