Single Sign On

[marcosmenendez]

There are 3 possible sign-in origins: webapp, extension and social. We should simplify and coordinate them:
Simplify by forwarding social sign-in to the webapp at https://www.thegooddata.org/sign-in. After sign-in, the user should be redirected to the original url at Open Atrium
Coordinate by simultaneously signing in or out in the other 2 platforms when a users signs in or out on any of the 3
Avoid caps errors by converting username to small letters in OA both in registration and sign-in

[josereyero]

First Beta Version deployed and set up into PRE.

Some notes:

• Created new module: TGD SSO (tgd_sso)
• Initial import and synchronization done (There's some very basic UI for it)
• For initial testing, we still keep both: OA login and TGD SSO
  (See link in the login page: "Log in using master server", similar ones on registration, etc...)
• There's a one click option already implemented to fully disable OA profiles/login/etc... Not to try before this has been properly tested though.
• Administration accounts don't have automatic log out (yet). Just in case there's some bug and we need to tweak configuration. There's a permission for that atm "tgd sso local login".

Pages (Need full admin privileges to view):

• Settings, https://collaborate-pre.thegooddata.org/admin/config/tgd/sso
• Admin page, https://collaborate-pre.thegooddata.org/admin/people/tgd_sso
• Note "Remote account information" field group on user profile edit pages...

TODO:

• UI Polishing (Specially "Edit profile page", links...)
• Performance assessment. Now OA does a backend request to Webapp for every page load.
• Update user display name when importing accounts from master server.
• Decide account cancellation workflow (Related issue)
• Decide on keeping independent admin accounts on OA, not synced with Webapp. Those may be needed for reconfiguration if the system fails (currently supported partly)

[josereyero]

More TODO:

• Automatic management of account roles (Atm accounts are just created with "authenticated user", need to see how the workflow is for updating them to "authenticated plus")

[josereyero]

Done: UI Polishing (profile page gone), user display name, admin account syncing (they can log in with password reset url, generated with drush).

Blocking issues (Before we can deploy this one):

• Delegate account maintenance to the webapp #14
• SSO Integration: User not returned after edit profile webapp#52

Pending (Postpone?):

• Account cancellation workflow
• Management of account roles ("authenticated plus")

[josereyero]

Done. Deployed and enabled in production site.