Shib group in another group doesn't work

[scolapasta]

In Harvard Dataverse, we have a group of Shib groups. However granting a role assignment to this group doesn't seem to work.

If I add a user to that group, that user does get access, so it's not a group issue.

Similarly if I give the shib group access directly, it also works.

[landreev]

Just curious, did somebody look into this and conclude that it was a trivial fix ("Size: 3")? - If so, please add a couple of words on what/where needs to be fixed. Gustavo's description did not imply that it was obvious (?).
To me at least, "3" suggests something along the lines of, yeah, this is in such and such class, just needs a recursive clause added to a lookup method. (Unless it's already obvious, to anyone who had done any work on shib groups - I haven't personally)

[pdurbin]

I don't know where the 3 came from. I mean, I can see above who added it and when, but there are no breadcrumbs about the reasoning.

I implemented Shib groups originally. I'm fairly uncertain as to how to size this issue. One challenge having an environment to test with. Hopefully the :DebugShibAccountType stuff here is helpful: https://guides.dataverse.org/en/5.13/developers/remote-users.html#shibboleth-and-oauth . I've never set up real Shibboleth on my Mac but @GPortas recently created https://github.com/GPortas/dockerized-idp-testbed/tree/poc which you can read about at https://iqss.slack.com/archives/C010LA04BCG/p1669192401072679?thread_ts=1669151276.670249&cid=C010LA04BCG

Another options is to set up Shibboleth for real on a server (well, I would recommend SAMLtest as a real-ish IdP: https://guides.dataverse.org/en/5.13/installation/shibboleth.html#exchange-metadata-with-your-identity-provider ), but then it's a bit of a pain to get code from your laptop onto the server.

I hope this helps!

[landreev]

I'm generally not opposed to the idea of testing things like this on demo.dataverse.org; considering that it's quite rare that we need to test anything shib-related.

[landreev]

Worth pointing out that it's actually working, partially. Specifically it's working for the purposes of granting a group member permission to view an object in the search results on the collection page. I.e., if I give curator role to a "shib groups in a group" group for a specific unpublished dataset, a logged in shib user can't go to the dataset, but can see the search card for it.