{"action":"created","issue":{"url":"https://api.github.com/repos/IQSS/dataverse/issues/3338","repository_url":"https://api.github.com/repos/IQSS/dataverse","labels_url":"https://api.github.com/repos/IQSS/dataverse/issues/3338/labels{/name}","comments_url":"https://api.github.com/repos/IQSS/dataverse/issues/3338/comments","events_url":"https://api.github.com/repos/IQSS/dataverse/issues/3338/events","html_url":"https://github.com/IQSS/dataverse/issues/3338","id":175818934,"number":3338,"title":"support OAuth2 (ORCID, Google, and GitHub) authentication within dataverse","user":{"login":"pameyer","id":10261853,"avatar_url":"https://avatars.githubusercontent.com/u/10261853?v=3","gravatar_id":"","url":"https://api.github.com/users/pameyer","html_url":"https://github.com/pameyer","followers_url":"https://api.github.com/users/pameyer/followers","following_url":"https://api.github.com/users/pameyer/following{/other_user}","gists_url":"https://api.github.com/users/pameyer/gists{/gist_id}","starred_url":"https://api.github.com/users/pameyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pameyer/subscriptions","organizations_url":"https://api.github.com/users/pameyer/orgs","repos_url":"https://api.github.com/users/pameyer/repos","events_url":"https://api.github.com/users/pameyer/events{/privacy}","received_events_url":"https://api.github.com/users/pameyer/received_events","type":"User","site_admin":false},"labels":[{"id":317519223,"url":"https://api.github.com/repos/IQSS/dataverse/labels/Component:%20Account%20&%20User%20Info","name":"Component: Account & User Info","color":"c7def8","default":false},{"id":414097218,"url":"https://api.github.com/repos/IQSS/dataverse/labels/in%20progress","name":"in progress","color":"ededed","default":false},{"id":457026522,"url":"https://api.github.com/repos/IQSS/dataverse/labels/SBGrid","name":"SBGrid","color":"ffffff","default":false}],"state":"open","locked":false,"assignee":{"login":"mheppler","id":687227,"avatar_url":"https://avatars.githubusercontent.com/u/687227?v=3","gravatar_id":"","url":"https://api.github.com/users/mheppler","html_url":"https://github.com/mheppler","followers_url":"https://api.github.com/users/mheppler/followers","following_url":"https://api.github.com/users/mheppler/following{/other_user}","gists_url":"https://api.github.com/users/mheppler/gists{/gist_id}","starred_url":"https://api.github.com/users/mheppler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mheppler/subscriptions","organizations_url":"https://api.github.com/users/mheppler/orgs","repos_url":"https://api.github.com/users/mheppler/repos","events_url":"https://api.github.com/users/mheppler/events{/privacy}","received_events_url":"https://api.github.com/users/mheppler/received_events","type":"User","site_admin":false},"assignees":[{"login":"pdurbin","id":21006,"avatar_url":"https://avatars.githubusercontent.com/u/21006?v=3","gravatar_id":"","url":"https://api.github.com/users/pdurbin","html_url":"https://github.com/pdurbin","followers_url":"https://api.github.com/users/pdurbin/followers","following_url":"https://api.github.com/users/pdurbin/following{/other_user}","gists_url":"https://api.github.com/users/pdurbin/gists{/gist_id}","starred_url":"https://api.github.com/users/pdurbin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pdurbin/subscriptions","organizations_url":"https://api.github.com/users/pdurbin/orgs","repos_url":"https://api.github.com/users/pdurbin/repos","events_url":"https://api.github.com/users/pdurbin/events{/privacy}","received_events_url":"https://api.github.com/users/pdurbin/received_events","type":"User","site_admin":false},{"login":"mheppler","id":687227,"avatar_url":"https://avatars.githubusercontent.com/u/687227?v=3","gravatar_id":"","url":"https://api.github.com/users/mheppler","html_url":"https://github.com/mheppler","followers_url":"https://api.github.com/users/mheppler/followers","following_url":"https://api.github.com/users/mheppler/following{/other_user}","gists_url":"https://api.github.com/users/mheppler/gists{/gist_id}","starred_url":"https://api.github.com/users/mheppler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mheppler/subscriptions","organizations_url":"https://api.github.com/users/mheppler/orgs","repos_url":"https://api.github.com/users/mheppler/repos","events_url":"https://api.github.com/users/mheppler/events{/privacy}","received_events_url":"https://api.github.com/users/mheppler/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/IQSS/dataverse/milestones/58","html_url":"https://github.com/IQSS/dataverse/milestone/58","labels_url":"https://api.github.com/repos/IQSS/dataverse/milestones/58/labels","id":2184734,"number":58,"title":"4.6.1 - ORCID and File Replace","description":"","creator":{"login":"djbrooke","id":7773392,"avatar_url":"https://avatars.githubusercontent.com/u/7773392?v=3","gravatar_id":"","url":"https://api.github.com/users/djbrooke","html_url":"https://github.com/djbrooke","followers_url":"https://api.github.com/users/djbrooke/followers","following_url":"https://api.github.com/users/djbrooke/following{/other_user}","gists_url":"https://api.github.com/users/djbrooke/gists{/gist_id}","starred_url":"https://api.github.com/users/djbrooke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djbrooke/subscriptions","organizations_url":"https://api.github.com/users/djbrooke/orgs","repos_url":"https://api.github.com/users/djbrooke/repos","events_url":"https://api.github.com/users/djbrooke/events{/privacy}","received_events_url":"https://api.github.com/users/djbrooke/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":0,"state":"open","created_at":"2016-12-08T19:10:04Z","updated_at":"2016-12-08T19:18:11Z","due_on":null,"closed_at":null},"comments":37,"created_at":"2016-09-08T17:51:47Z","updated_at":"2016-12-15T13:48:48Z","closed_at":null,"body":"On 2016-10-03 @djbrooke and I (this is @pdurbin writing) discussed how this issue doesn't have a description and agreed that I would take a swing at filling it in to explain in expected to be in scope and out of scope for this issue. I'm very open to feedback and will likely be pulling in @pameyer and others to help define requirements. Some iteration on the lists below is expected.\r\n\r\n## In scope\r\n\r\n- DONE The UX for login should not be wildly different from Shibboleth. **Users should be able to click \"Log In\" or \"Sign Up\" and be presented with screens that look like the rest of Dataverse.** #794 may or may not be helpful for reference. Better consistency with Shibboleth will be deferred until #3486.\r\n- DONE Just like local and Shibboleth users (#972), **OAuth/ORCID users must agree to Terms of Use when they log in for the first time**. For a Shibboleth example, see http://guides.dataverse.org/en/4.5/user/account.html#how-to-create-a-new-dataverse-account-using-institutional-log-in . Better consistency with Shibboleth will be deferred until #3486.\r\n- Just like Shibboeth, OAuth/ORCID login must be disabled out of the box but **instructions in the Installation Guide** must be provided for how a sysadmin would configure it. In the Shibboleth case, many setup steps are laid out and once all the various moving pieces (`shibd`, `mod_shib`, etc.) have been configured a boolean is changed to have Shibboleth show up as a login option in the GUI: http://guides.dataverse.org/en/4.5/installation/shibboleth.html#enable-shibboleth\r\n- DONE Sysadmins must be able to listOAuth/ORCID users along side local and Shibboleth users via `http://localhost:8080/api/admin/authenticatedUsers` as documented at http://guides.dataverse.org/en/4.5/api/native-api.html#admin\r\n- DONE User account creation shouldn't require the user to have their email publicly visible through ORCID.  Whether this means a prompt for \"Dataverse repository $X will have the ability to see your email\" during login/account creation or an initial form for capturing email address in parallel with ORCID remains to be determined.  It may or may not make sense to separate this point into a separate issue\r\n- DONE Persist user's affiliation asserted by ORCID (i.e. \"Harvard University\") from like we implemented for Shibboleth in #1497.\r\n- DONE **A local user must be able to convert to a OAuth/ORCID account** similar to how local users can convert to Shibboleth: http://guides.dataverse.org/en/4.5/user/account.html#how-to-use-your-institutional-log-in-for-your-dataverse-account\r\n- DONE A sysadmin must be able to **convert a OAuth/ORCID account to a local account** similar to how they can convert Shibboleth accounts to local accounts: http://guides.dataverse.org/en/4.5/installation/shibboleth.html#converting-shibboleth-users-to-local\r\n- DONE If OAuth/ORCID is enabled, change the Sign Up page to encourage users to use OAuth/ORCID instead, like we implemented for Shibboleth users in #1637\r\n\r\n## Out of scope\r\n\r\n- #923 Allow users to specify their ORCID and/or ISNI ID in their user account \r\n- #2974 \"remote only\" mode\r\n- Using OAuth in a workflow involving getting an API key, as described at https://github.com/IQSS/dataverse/issues/1293#issuecomment-255550790\r\n- #3486 Improve consistency of various remote auth options (Shibboleth vs. OAuth)\r\n- #3487 Permit multiple login options to the same Dataverse account\r\n- Implement \"force log out\" per https://members.orcid.org/api/customize-oauth-login-screen#logout for example."},"comment":{"url":"https://api.github.com/repos/IQSS/dataverse/issues/comments/267331256","html_url":"https://github.com/IQSS/dataverse/issues/3338#issuecomment-267331256","issue_url":"https://api.github.com/repos/IQSS/dataverse/issues/3338","id":267331256,"user":{"login":"pdurbin","id":21006,"avatar_url":"https://avatars.githubusercontent.com/u/21006?v=3","gravatar_id":"","url":"https://api.github.com/users/pdurbin","html_url":"https://github.com/pdurbin","followers_url":"https://api.github.com/users/pdurbin/followers","following_url":"https://api.github.com/users/pdurbin/following{/other_user}","gists_url":"https://api.github.com/users/pdurbin/gists{/gist_id}","starred_url":"https://api.github.com/users/pdurbin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pdurbin/subscriptions","organizations_url":"https://api.github.com/users/pdurbin/orgs","repos_url":"https://api.github.com/users/pdurbin/repos","events_url":"https://api.github.com/users/pdurbin/events{/privacy}","received_events_url":"https://api.github.com/users/pdurbin/received_events","type":"User","site_admin":false},"created_at":"2016-12-15T13:48:48Z","updated_at":"2016-12-15T13:48:48Z","body":"Yesterday I gave a code walk through of the 3338-oauth-login branch to @scolapasta @sekmiller @raprasad @mheppler @bmckinney and @pameyer. The agenda/notes/todo doc is \"2016-12-14 Code walkthrough for 3338-oauth-login branch\" at https://docs.google.com/document/d/1i5J5KZatT79ez1y4HIsZOqot0BFrM0t3soQyqOzwtsY/edit?usp=sharing\r\n\r\nHere are the action items that came out:\r\n\r\n- (Phil) Spend 20 minutes trying to add shib to authenticationproviderrow\r\n- (Gustavo) Think about adding a \"logo\" column to the authenticationproviderrow table.\r\n\r\nRaman noted that it would be nice if the primary key of authenticationproviderrow table were a number instead of a string but we don't plan to change this at this time."}}
{"actor":{"display_login":"pdurbin"}}