[OAK-3508] External login module should reduce LDAP lookups for pre-authenticated users

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.0.22, 1.2, 1.4
• Fix Version/s: 1.0.23, 1.2.16, 1.4
• Component/s: auth-external
• Assignee: Tobias Bocanegra
• Reporter: Tobias Bocanegra
• Created: 13/Oct/15 00:19
• Updated: 09/Jun/16 07:30
• Resolved: 13/Oct/15 23:43

Description

consider the following JAAS setup:

• sufficient SSO Login Module
• optional Default Login Module
• sufficient External Login Module

This causes each login() to reach the external login module (which is desired) but causes an IDP lookup for each login, even if the user is already synced with the repository.

ideally the login module could pass the ExternalIdentityRef to the sync handler and to a tentative sync. the lastSyncTime should be respected in this case.

Issue Links

• is required by: OAK-4417 Missing LoginModule Test and Documentation for OAK-3508