Permit multiple login options to the same Dataverse account

[pdurbin]

The original design doc at https://github.com/IQSS/dataverse/blob/4.0/doc/Architecture/auth.md was for "allow multiple logins to map to the same internal system user" but at the "merge party" in late September 2014 we decided to do away with this concept in fe8e41a. We'd like to at least explore the possibility of reintroducing the idea of permitting multiple login options to the same Dataverse account. The idea is that you could log in with HarvardKey (Shibboleth) or ORCID or a local account and still be "you" in Dataverse.

[pdurbin]

I think we want this, but when? Closing until we decide to prioritize it.

[pdurbin]

I'm re-opening this because as I mentioned at #6701 (comment) the dream is alive!

Yesterday, I saw this when testing OpenID Connect (OIDC), a next generation repository technology contributed by @poikilotherm in pull request #6433 for Dataverse 4.19: https://ngr.coar-repositories.org/technology/openid-connect/

That is to say, in theory, I should be able to log into https://data-beta.fz-juelich.de with any of HarvardKey, ORCID, and GitHub and still be "me" in Dataverse.

This is incredibly exciting! If it works, it has the potential to solve many headaches:

• 4.6.1 Account creation confirmation email 4.6.1 Account creation confirmation email #3704
• Convert User: Cannot convert user from remote to local if preserving email address Convert User: Cannot convert user from remote to local if preserving email address #3834
• Having some trouble when a user tries logging in using both Shib AND OAuth...I think... Having some trouble when a user tries logging in using both Shib AND OAuth...I think... #4769
• ...

But does it work? Someone should test it. 😄

[poikilotherm]

I tested this with our installation of Unity IDM, maintained by @apw1388

First let's associate my ORCID account with my company account in the IDM:

Then login to Jülich DATA BETA with ORCID and still have the same user account:

I'm so happy I can keep promises I made in http://guides.dataverse.org/en/4.19/installation/oidc.html

[poikilotherm]

I'd vote to close this, as this is probably way easier to solve on the OIDC provider level.

[pdurbin]

I'm a little nervous that our docs are not at all clear on how to achieve this, though.

Maybe a line or two near a future version of https://guides.dataverse.org/en/6.3/installation/config.html#auth-modes-local-vs-remote-vs-both would help?

[pdurbin]

In the future, with the React SPA ( https://github.com/IQSS/dataverse-frontend ) we plan to solve this by having OIDC in the mix.

See the auth doc at https://groups.google.com/g/dataverse-community/c/2hfhWIHQddE/m/hATuWGGSAAAJ for details.

Closing.