Set user attributes based on the IdP in use, not an attribute

[oliwarner]

I've got a multi-IdP setup, with a custom loader, that varies based on the Company (pulled from the URL) you're attempting to log into. That side of the equation seems to work well.

The problem is new users. The User (custom model) instance gets created. And can be used, but I need to link that to the Company. There's a company FK (so company_id in raw terms) field.

This ID is not communicated from the IdP. And that's by-design. allowing the IdP to set the company would be a security hole. I need some way to tie new users on a given IdP to their company.

I have one config per company. Ideally I'd be able to set something that poisoned the attributes, or something that explicitly got used in backends._get_or_create_saml2_user. A config-static dictionary eg NEW_USER_DEFAULTS, seems reasonable but I can't figure out how to access the IdP config in use from within backends._get_or_create_saml2_user. That data doesn't appear to exist by that point.

I've also considered hooking djangosaml2.signals.pre_user_save but again, I don't think I have access to the saml config in use by that point.

Can somebody point me in the right direction?

[oliwarner]

Found djangosaml2.signals.post_authenticated, thought it would save me from insanity. While I now have access to the issuer, I don't have access to the request, so I can't stuff the Company ID into a session var and pick it up afterwards.

I'm very close to losing it. I've seen the comment on #135 telling everybody to create their own ACS view but honestly, recreating all that logic for a little bit of extra context at the end seems just as backwards as the hoops I'm jumping through.

"I think middleware might be the solution" said no sane developer ever. Even so, that's looking like my last best option to hack the company from the session into the user model.

[oliwarner]

ARGL the login process is nuking the session!

[peppelinux]

You can handle this behaviour in many ways, I suggest you to do a purpose and after a brain storming about what would be a good solution we could move to a PR.

Is there any news on this?

[AkambDS]

Not able to set the attributes other then Username set by SAML_USE_NAME_ID_AS_USERNAME = True
Pls help as its showing The attributes dictionary is empty

[peppelinux]

Not able to set the attributes other then Username set by SAML_USE_NAME_ID_AS_USERNAME = True
Pls help as its showing The attributes dictionary is empty

Tell us which version you're using.
It sounds like a misconfiguration in settings.py

[peppelinux]

Fixed here:
#194