Update create user to expect users from Entra #1429
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
To enable CICA users to access the CP, we will enable a new connection in Auth0 with EntraID. This updates the code we use to create a user from the ID token to normalize their name, and store their email as the justice_email, to avoid them having to reauth to capture it.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Previously the username would be used when installing user helm charts. This was fine when all users came from github, as their usernames were guaranteed to be valid with helm. However this is not the case with usernames from Entra, as they can include invalid characters such as '.' which results in an error after the user logs in trying to provision the user. This changes uses the slug, which is valid for helm, however accessing tools will still not be compatible so tooling will not be available for these users.
michaeljcollinsuk
force-pushed
the
feature/cica-access
branch
from
2328f89 to
9e4f974
Compare
This reverts commit 93cb6cd. We will resolve the issue these changes were meant to fix in a different way when we fully implement access with EntraID
michaeljcollinsuk
force-pushed
the
feature/cica-access
branch
from
c0a9302 to
ce950ed
Compare
michaeljcollinsuk
force-pushed
the
feature/cica-access
branch
from
ce950ed to
28b6719
Compare
There was a problem hiding this comment.
Tested locally with my justice user.
Changed my existing user's email so user could log into control panel.
Could see limited toolbar options. Switched to superuser and granted new user access to quicksight.
Switched back to new user and could access quicksight successfully.
jamesstottmoj
approved these changes
Jan 13, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR resolves relates to ministryofjustice/analytical-platform#6237
To enable CICA users to access the CP, we will enable a new connection in Auth0 with EntraID.
This updates the code we use to create a user from the ID token to normalize their name, and store their email as the justice_email, to avoid them having to reauth to capture it.
Tooling and all AP functionality other than QuickSight have been disabled for users that are not created via GitHub.
In future, to enable tooling for users coming via Entra, I think we would need have to update the helm charts so that we do not rely on their username, as those created from Entra are not compatible.
Another side effect is that we have a unique restriction on the
justice_emailfield on the user model. This means if you auth via entra and your justice email is already stored against your normal "alpha" user, upon login a 500 error is raised as a user will already exist with that justice email address. To get around this in testing we will need to remove thejustice_emailfrom your alpha user before authing with entra.🧑💻 How should the reviewer test these changes?
justicedigital-panda-awsidentitycenter) to be set up and enabled for the Control Panel EKS app in Auth0. This is currently set up in dev.justice_emailset against your current alpha user created by logging in with GitHub, remove it📚 Documentation status