{"action":"closed","issue":{"url":"https://api.github.com/repos/openshift/openshift-ansible/issues/900","repository_url":"https://api.github.com/repos/openshift/openshift-ansible","labels_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/900/labels{/name}","comments_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/900/comments","events_url":"https://api.github.com/repos/openshift/openshift-ansible/issues/900/events","html_url":"https://github.com/openshift/openshift-ansible/issues/900","id":117137172,"number":900,"title":"Ensure support for identity provider mappingMethod","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-11-16T14:34:53Z","updated_at":"2016-02-09T16:27:46Z","closed_at":"2016-02-09T16:27:46Z","body":"https://github.com/openshift/origin/pull/5060 added a new configuration field named `mappingMethod` to all identity providers (peer to the `login` and `challenge` fields). The default value is `claim`, which means identities from the provider will map to a user with their preferred username unless it is already mapped to a different identity.\r\n\r\n* **lookup**\r\n  * Administrator wants to manually configure identity/user mappings. Login process should only look up existing mappings, not create them\r\n* **generate**\r\n  * Provision with generation of unique usernames (e.g. \"bob\", \"bob2\")\r\n  * This strategy should not be used in combination with LDAP group sync\r\n* **claim** (default)\r\n  * Provision with deterministic username, fail if username is already mapped to another identity\r\n* **add**\r\n  * Provision with deterministic username, add to existing user if username is already mapped to another identity\r\n  * Needed when multiple identity providers are configured which identity the same set of users and map to the same usernames\r\n\r\nEnsure `mappingMethod` can be set as part of an identity provider JSON snippet (I think it can)\r\n\r\nIn the future, consider setting the `mappingMethod` to `add` for any installations where we set up multiple identity providers that are all addressing the same set of identities."}}