HP-2429 | feat: migrate old user from Tunnistamo to Keycloak #102
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
charn
force-pushed
the
HP-2429-ad-migrate
branch
5 times, most recently
from
72d30c1 to
61e9838
Compare
tuomas777
reviewed
Jun 20, 2024
charn
force-pushed
the
HP-2429-ad-migrate
branch
4 times, most recently
from
62abe22 to
b59c550
Compare
charn
changed the title
charn
force-pushed
the
HP-2429-ad-migrate
branch
2 times, most recently
from
670d70b to
13adbc0
Compare
Migration happens one user at a time upon login. Feature can be configured using the following settings. - `HELUSERS_USER_MIGRATE_ENABLED` enable the feature. Defaults to `False`. - `HELUSERS_USER_MIGRATE_EMAIL_DOMAINS` whitelisted email domains for migration. Defaults to `["hel.fi"]`. - `HELUSERS_USER_MIGRATE_AMRS` which authentication methods are used for migration. Defaults to `["helsinkiad"]`. Migration logic is only run on certain conditions: - Correct authentication method is used (AMR-claim) - Email domain is correct - User with the new UUID doesn't exist yet - Old user is found by email - Old user has username generated by helusers.utils.uuid_to_username Instead of allowing a new user to be created the migration is done by replacing the old user UUID with the one from the incoming token payload. Logic which is run later should take care of updating other user related fields. Primary key is separate from the user UUID, so the user UUID can be changed. This migration should therefore retain all the data related to the user. Migration logic only supports authentication methods from this package and Python Social Auth pipeline helusers.defaults.SOCIAL_AUTH_PIPELINE. This doesn't support migrating users which are using e.g. a different pipeline for Python Social Auth (e.g. the default pipeline). Refs: HP-2429
charn
force-pushed
the
HP-2429-ad-migrate
branch
from
13adbc0 to
cbd4771
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Migration happens one user at a time upon login.
By default, the migration logic is configured to support migrating users from Tunnistamo AD authentication to Keycloak AD authentication.
Feature can be configured using the following settings.
HELUSERS_USER_MIGRATE_ENABLEDenable the feature. Defaults toFalse.HELUSERS_USER_MIGRATE_EMAIL_DOMAINSwhitelisted email domains for migration. Defaults to["hel.fi"].HELUSERS_USER_MIGRATE_AMRSwhich authentication methods are used for migration. Defaults to["helsinkiad"].Migration logic is only run on certain conditions:
helusers.utils.uuid_to_usernameInstead of allowing a new user to be created the migration is done by replacing the old user UUID with the one from the incoming token payload. Logic which is run later should take care of updating other user related fields.
Primary key is separate from the user UUID, so the user UUID can besound changed. This migration should therefore retain all the data related to the user.
Migration logic only supports authentication methods from this package and Python Social Auth pipeline
helusers.defaults.SOCIAL_AUTH_PIPELINE. This doesn't support migrating users which are using e.g. a differentpipeline for Python Social Auth (e.g. the default pipeline).
Refs: HP-2429