Some users don't have a username in the RC database

[chagai95]

I found 3 users in an old db we were using, but maybe there are more. Just wanted to mention this, but it was easy to exclude them, should I close this ticket?

[HerHde]

Indeed, I could find a user in one of our DBs as well, using jq -s 'map(select(has("username") | not))' < users.json.

Before closing, I should check the impact

[HerHde]

Now I finally added some end to end testing, including a user without username. This is exactly, where the script crashed: https://ci.netzbegruenung.verdigado.net/repos/938/pipeline/504/9

Now I want to handle them in the script. The question is what to do with these users? Warn and skip would be my go-to.

[chagai95]

Maybe add a config option to choose what to do? One thing I could imagine might be useful is to just generate a username either a random string or somehow use the name?

[HerHde]

Would that be helpful for your use-case? And do your affected users have a name attribute?
Another consideration is that some things reference these users by login name, so I'd expect a bit more effort handling them

[chagai95]

I'll check on that, I guess we'll need to decide.

[janonym1]

Would that be helpful for your use-case? And do your affected users have a username attribute? Another consideration is that some things reference these users by login name, so I'd expect a bit more effort handling them

We are using a keycloak for handling oauth and SSO login, so we could maybe fallback on the preferred_username attribute we get from there, when the name is empty.

preferred_username is usually a email-address: name.sirname@domain.com but the @ sign is ugly when escaping, so maybe we should just use name.sirname prefix

[chagai95]

As you can see we are still not sure exactly how to handle this case, but these are some of the considerations, I'll update here when we have made some decisions. Maybe we can just create a PR then with some of the options that we would like.

[HerHde]

Hmm, using emails and slicing them up, using just the local part seems a bit naive, as many assumptions about email are in general. What if there are duplicates, then, like mail@example.org and mail@example.net?

Furthermore, our Use-Case is that LDAP or OIDC provides the synapse authentication based on the same login name. Slicing would not be helpful for that case, either.

Using the whole email does not work either, as User ID can only contain characters a-z, 0-9, or '=_-./+'.

We could check if the preferred_username is valid (for synapse) and use it then, otherwise throw a warning or fail hard.

[pierreozoux]

@chagai95 I have the same case, and we are migrating with keycloak, so, I actually want to map keycloak username, and not rcUsername...

look at: #10

(I actually did a lot of research to slice emails, normalise username in keycloak...find users with same username, how to avoid new user to create doubles... a big rabbit hole...)

hope it helps!

[HerHde]

@pierreozoux would it be sufficient to use preferred_username for that case?

[pierreozoux]

It is what I did :)

In fact, I used a transformation on preferred_username that I also implemented in Kc, and then synpase use this.

[HerHde]

Ah, sorry. I missed that line and basically, where the attribute is coming from. 😅

I'll review #10 and see how to adapt it for general usage, thank you!