Existing OAuth users API OIDC Authentication by GPortas · Pull Request #11671 · IQSS/dataverse

GPortas · 2025-07-23T16:20:35Z

What this PR does / why we need it:

Introduces a mechanism that allows linking incoming bearer tokens with the following existing OAuth accounts: Google, ORCID, and GitHub.

This mechanism is enabled through the new api-bearer-auth-use-oauth-user-on-id-match feature flag.

The behavior of api-bearer-auth-use-shib-user-on-id-match has also been modified, now expecting the Shibboleth IdP provider id comes from the claim named idp instead of Shib-Identity-Provider, since the idp claim is common to both Shibboleth and OIDC IdPs within the scope of CILogon.

Which issue(s) this PR closes:

Closes Support old OIDC users with the new OIDC API authentication #11645

Special notes for your reviewer:

This branch is including the changes from #11622.

Suggestions on how to test this:

Open the QA server Single Page Application (SPA) at: https://qa.dataverse.org/spa
On CILogon, Log in using one of the supported OAuth providers: Google, ORCID, or GitHub.
To test the behavior for an existing account, ensure that the Google, ORCID, or GitHub account you use was already registered in Harvard Dataverse.

Does this PR introduce a user interface change? If mockups are available, please link/include them here:

No

Is there a release notes update needed for this change?:

Yes, attached.

Additional documentation:

None

…ing OAuth users WIP

coveralls · 2025-07-23T20:11:13Z

coverage: 23.257% (+2.5%) from 20.726%
when pulling 5cca889 on 11645-old-oidc-users-api-auth
into 20aaf5a on develop.

…dc-users-api-auth

…UserByOIDCBearerToken

…dc-users-api-auth

…nged the expected received idp claim name for both Shib and OAuth users

…-use-oauth-user-on-id-match turned on

GPortas · 2025-07-26T04:49:42Z

Waiting for #11622 to be merged

…dc-users-api-auth

pdurbin

Tests are passing but I didn't do any testing myself (we definitely need it).

@GPortas I'm approving this but I'm leaving a couple small comments in this review.

pdurbin · 2025-08-21T15:57:53Z

      - Allows the use of a Shibboleth user account when an identity match is found during API bearer authentication. This feature enables automatic association of an incoming IdP identity with an existing Shibboleth user account, bypassing the need for additional user registration steps. This feature only works when the feature flag ``api-bearer-auth`` is also enabled. **Caution: Enabling this flag could result in impersonation risks if (and only if) used with a misconfigured IdP.**
      - ``Off``
+    * - api-bearer-auth-use-oauth-user-on-id-match
+      - Allows the use of an OAuth user account (GitHub, Google, or ORCID) when an identity match is found during API bearer authentication. This feature enables automatic association of an incoming IdP identity with an existing OAuth user account, bypassing the need for additional user registration steps. This feature only works when the feature flag ``api-bearer-auth`` is also enabled. **Caution: Enabling this flag could result in impersonation risks if (and only if) used with a misconfigured IdP.**


I'm confused. What is the impersonation risk? 🤔

If the OIDC claims include an identity provider ID and a user ID that match an authenticated user in Dataverse, but the provider that issued the claims is not actually the one that originally created that user, this would represent an impersonation issue. However, as mentioned in the docs, this scenario can only occur if the IdP is misconfigured.

Co-authored-by: Philip Durbin <philip_durbin@harvard.edu>

github-actions · 2025-08-22T10:16:49Z

📦 Pushed preview images as

ghcr.io/gdcc/dataverse:11645-old-oidc-users-api-auth

ghcr.io/gdcc/configbaker:11645-old-oidc-users-api-auth

🚢 See on GHCR. Use by referencing with full name as printed above, mind the registry name.

ofahimIQSS · 2025-08-25T19:38:03Z

tested using github account - looks good to me. Merging.

Stash: new feature flag that enables API OIDC authentication of exist…

4697002

…ing OAuth users WIP

GPortas changed the base branch from develop to 11605-existing-external-users-api-auth July 23, 2025 16:21

GPortas force-pushed the 11645-old-oidc-users-api-auth branch from d6b36ef to 4697002 Compare July 23, 2025 16:23

GPortas added 2 commits July 23, 2025 18:06

Added: ORCIDUserLookupParams logic and new naming

12a079d

Changed: vars naming in lookupUserByOIDCBearerToken

182fef3

This comment has been minimized.

Sign in to view

GPortas added 3 commits July 24, 2025 13:34

Fixed: log message typo

b88fcc4

Merge branch 'develop' of github.com:IQSS/dataverse into 11645-old-oi…

39b1de1

…dc-users-api-auth

Refactor: naming tweaks

9f5c713

GPortas changed the base branch from 11605-existing-external-users-api-auth to develop July 24, 2025 12:47

Fixed: API_BEARER_AUTH_USE_OAUTH_USER_ON_ID_MATCH condition in lookup…

1168c01

…UserByOIDCBearerToken

This comment has been minimized.

Sign in to view

GPortas added 5 commits July 25, 2025 15:14

Merge branch 'develop' of github.com:IQSS/dataverse into 11645-old-oi…

948b149

…dc-users-api-auth

Added: tweaks for API_BEARER_AUTH_USE_OAUTH_USER_ON_ID_MATCH, and cha…

bce5d50

…nged the expected received idp claim name for both Shib and OAuth users

Added: unit test for lookupUserByOIDCBearerToken with api-bearer-auth…

fb0e559

…-use-oauth-user-on-id-match turned on

Added: missing tests to AuthenticationServiceBeanTest

12b62c4

Added: docs for api-bearer-auth-use-oauth-user-on-id-match

2ce4dc5

This comment has been minimized.

Sign in to view

Added: release notes for #11645

5a43070

GPortas added Size: 10 A percentage of a sprint. 7 hours. Original size: 10 SPA.Q3.2025.9 Deploy External User Auth to the Harvard Dataverse SPA GREI Re-arch Issues related to the GREI Dataverse rearchitecture SPA These changes are required for the Dataverse SPA labels Jul 26, 2025

GPortas moved this to Ready for Review ⏩ in IQSS Dataverse Project Jul 26, 2025

GPortas marked this pull request as ready for review July 26, 2025 04:49

GPortas added the Status: Waiting for Related Issues/PRs This issue depends upon the completion of one or more issues/PRs label Jul 26, 2025

This comment has been minimized.

Sign in to view

Merge branch 'develop' of github.com:IQSS/dataverse into 11645-old-oi…

fe537ee

…dc-users-api-auth

GPortas requested a review from qqmyers July 28, 2025 16:47

GPortas removed the Status: Waiting for Related Issues/PRs This issue depends upon the completion of one or more issues/PRs label Jul 28, 2025

This comment has been minimized.

Sign in to view

cmbz added the FY26 Sprint 3 (2025-07-30 - 2025-08-13) label Jul 31, 2025

cmbz added the FY26 Sprint 4 FY26 Sprint 4 (2025-08-13 - 2025-08-27) label Aug 14, 2025

pdurbin self-assigned this Aug 20, 2025

pdurbin moved this from Ready for Review ⏩ to In Review 🔎 in IQSS Dataverse Project Aug 20, 2025

pdurbin approved these changes Aug 21, 2025

View reviewed changes

github-project-automation Bot moved this from In Review 🔎 to Ready for QA ⏩ in IQSS Dataverse Project Aug 21, 2025

pdurbin removed their assignment Aug 21, 2025

GPortas and others added 2 commits August 22, 2025 10:24

Update doc/release-notes/11645-existing-oauth-external-users-api-auth.md

adf0e9f

Co-authored-by: Philip Durbin <philip_durbin@harvard.edu>

Update src/main/java/edu/harvard/iq/dataverse/settings/FeatureFlags.java

5cca889

Co-authored-by: Philip Durbin <philip_durbin@harvard.edu>

This comment has been minimized.

Sign in to view

ofahimIQSS moved this from Ready for QA ⏩ to QA ✅ in IQSS Dataverse Project Aug 25, 2025

ofahimIQSS self-assigned this Aug 25, 2025

ofahimIQSS merged commit ab2c661 into develop Aug 25, 2025
23 checks passed

github-project-automation Bot moved this from QA ✅ to Merged 🚀 in IQSS Dataverse Project Aug 25, 2025

ofahimIQSS deleted the 11645-old-oidc-users-api-auth branch August 25, 2025 19:38

ofahimIQSS removed their assignment Aug 25, 2025

pdurbin added this to the 6.8 milestone Aug 26, 2025

scolapasta moved this from Merged 🚀 to Done 🧹 in IQSS Dataverse Project Aug 26, 2025

cmbz mentioned this pull request Aug 28, 2025

Project: Dataverse Rearchitecture (Single Page Application) IQSS/dataverse-pm#123

Open

Conversation

GPortas commented Jul 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

coveralls commented Jul 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

GPortas commented Jul 26, 2025

Uh oh!

This comment has been minimized.

This comment has been minimized.

pdurbin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pdurbin Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

GPortas Aug 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

github-actions Bot commented Aug 22, 2025

Uh oh!

ofahimIQSS commented Aug 25, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

GPortas commented Jul 23, 2025 •

edited

Loading

coveralls commented Jul 23, 2025 •

edited

Loading

GPortas Aug 22, 2025 •

edited

Loading