PADV-516 - Allow platform acount association by email.

[Squirrel18]

Description:

This PR allows to associate the edx-platform account with a SAML account under these conditions:

• The platform user's email matches the SAML account email.
• There are not multiple platform accounts with the same email.
• The platform user is not staff or superuser.
• The platform user is active.
  This is necessary to prevent users from logging into their edx-platform account to link the SAML IDP account and the edx-platform account.

How to test:

• Set up a local SAML IDP, check this video about SAML and configuring a local IDP: https://youtu.be/1PoWSVtwheI
• Create a test account on edx-platform.
• Set this feature flag at site level: ASSOCIATE_ACCOUNT_WITH_SAML_IDP_USER
• In a private window, log in using the local IDP and use an account with the same email address as the edx-platform account.
• You should be logged in automatically and the accounts should be linked.

Notes:

• Previous implementations: Safer associate by email and Skip email verification #30
• This PR does not contain unit tests as the module itself does not contain any test suites and we are not currently running any test suites for edx-platform.

Reviewers:

• @Jacatove
• @ShonTitor

[Jacatove]

Suggested change

	# It is not allowed to be associated to a staff or superuser to prevent impersonation.
	if users[0].is_staff or users[0].is_superuser:
	raise AuthException(
	backend,
	f'It is not allowed to auto associate staff or superuser users {email}',
	)
	# It is not allowed to be associated to an inactive account to prevent impersonation.
	if not users[0].is_active:
	raise AuthException(
	backend,
	f'Platform user account is not active: {email} {backend.name}',
	)
	return {
	'user': users[0],
	user_account = users[0]
	# It is not allowed to be associated to a staff or superuser to prevent impersonation.
	if user_account.is_staff or user_account.is_superuser:
	raise AuthException(
	backend,
	f'It is not allowed to auto associate staff or superuser users {email}',
	)
	# It is not allowed to be associated to an inactive account to prevent impersonation.
	if not user_account.is_active:
	raise AuthException(
	backend,
	f'Platform user account is not active: {email} {backend.name}',
	)
	return {
	'user': user_account,