Fixes #1250

Author: oharsta

myconext-server/src/main/java/myconext/aa/AttributeAggregatorController.java

@@ -22,6 +22,7 @@
 
 import java.util.*;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 
 @RestController
@@ -34,14 +35,14 @@ public class AttributeAggregatorController implements HasUserRepository {
     @Getter
     private final UserRepository userRepository;
     private final Manage manage;
-    private final String schacHomeOrganization;
+    private final List<String> schacHomeOrganizations;
 
     public AttributeAggregatorController(UserRepository userRepository,
                                          Manage manage,
-                                         @Value("${schac_home_organization}") String schacHomeOrganization) {
+                                         @Value("${schac_home_organizations}") String schacHomeOrganization) {
         this.userRepository = userRepository;
         this.manage = manage;
-        this.schacHomeOrganization = schacHomeOrganization;
+        this.schacHomeOrganizations = Stream.of(schacHomeOrganization.split(",")).map(String::trim).toList();
     }
 
     @GetMapping(value = {"attribute-aggregation"})
@@ -53,7 +54,7 @@ public ResponseEntity<List<UserAttribute>> aggregate(@RequestParam("sp_entity_id
         //it might be that the eppn if from the eduID IdP, and then we can look up the user based on that
         int indexOfAt = eduPersonPrincipalName.indexOf("@");
         String schacHome = eduPersonPrincipalName.substring(indexOfAt + 1);
-        if (this.schacHomeOrganization.equals(schacHome)) {
+        if (this.schacHomeOrganizations.contains(schacHome)) {
             String uid = eduPersonPrincipalName.substring(0, indexOfAt);
             userOptional = userRepository.findUserByUid(uid);
         } else if (StringUtils.hasText(eduPersonPrincipalName)) {

myconext-server/src/main/java/myconext/api/AccountLinkerController.java

@@ -65,6 +65,7 @@
 import java.time.temporal.ChronoUnit;
 import java.util.*;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import static myconext.crypto.HashGenerator.hash;
 import static myconext.log.MDCContext.logWithContext;
@@ -130,7 +131,7 @@ public AccountLinkerController(
             Manage manage,
             DisposableEmailProviders disposableEmailProviders,
             @Value("${mijn_eduid_entity_id}") String mijnEduIDEntityId,
-            @Value("${schac_home_organization}") String schacHomeOrganization,
+            @Value("${schac_home_organizations}") String schacHomeOrganizations,
             @Value("${email.magic-link-url}") String magicLinkUrl,
             @Value("${idp_redirect_url}") String idpBaseRedirectUrl,
             @Value("${sp_redirect_url}") String spRedirectUrl,
@@ -163,7 +164,7 @@ public AccountLinkerController(
         this.attributeMapper = attributeMapper;
         this.manage = manage;
         this.disposableEmailProviders = disposableEmailProviders;
-        this.schacHomeOrganization = schacHomeOrganization;
+        this.schacHomeOrganization = Stream.of(schacHomeOrganizations.split(",")).map(String::trim).toList().getFirst();
         this.mijnEduIDEntityId = mijnEduIDEntityId;
         this.magicLinkUrl = magicLinkUrl;
         this.idpBaseRedirectUrl = idpBaseRedirectUrl;

myconext-server/src/main/java/myconext/api/UserController.java

@@ -69,6 +69,7 @@
 import java.time.temporal.ChronoUnit;
 import java.util.*;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
 import static myconext.SwaggerOpenIdConfig.OPEN_ID_SCHEME_NAME;
 import static myconext.crypto.HashGenerator.hash;
@@ -133,7 +134,7 @@ public UserController(UserRepository userRepository,
                           CaptchaVerifier captchaVerifier,
                           @Qualifier("jsonMapper") ObjectMapper objectMapper,
                           @Value("${email.magic-link-url}") String magicLinkUrl,
-                          @Value("${schac_home_organization}") String schacHomeOrganization,
+                          @Value("${schac_home_organizations}") String schacHomeOrganizations,
                           @Value("${email_guessing_sleep_millis}") int emailGuessingSleepMillis,
                           @Value("${sp_redirect_url}") String spBaseUrl,
                           @Value("${idp_redirect_url}") String idpBaseUrl,
@@ -160,7 +161,7 @@ public UserController(UserRepository userRepository,
         this.objectMapper = objectMapper;
         this.captchaVerifier = captchaVerifier;
         this.magicLinkUrl = magicLinkUrl;
-        this.schacHomeOrganization = schacHomeOrganization;
+        this.schacHomeOrganization = Stream.of(schacHomeOrganizations.split(",")).map(String::trim).toList().getFirst();
         this.idpBaseUrl = idpBaseUrl;
         this.spBaseUrl = spBaseUrl;
         this.webAuthnSpRedirectUrl = String.format("%s/security", spBaseUrl);

myconext-server/src/main/java/myconext/remotecreation/RemoteCreationController.java

@@ -58,12 +58,12 @@ public RemoteCreationController(UserRepository userRepository,
                                     Manage manage,
                                     MailBox mailBox,
                                     AttributeMapper attributeMapper,
-                                    @Value("${schac_home_organization}") String schacHomeOrganization) {
+                                    @Value("${schac_home_organizations}") String schacHomeOrganizations) {
         this.userRepository = userRepository;
         this.manage = manage;
         this.mailBox = mailBox;
         this.attributeMapper = attributeMapper;
-        this.schacHomeOrganization = schacHomeOrganization;
+        this.schacHomeOrganization = Stream.of(schacHomeOrganizations.split(",")).map(String::trim).toList().getFirst();
     }
 
     @GetMapping(value = {"/email-eduid-exists"})

myconext-server/src/main/resources/application.yml

@@ -47,7 +47,8 @@ identity-provider-meta-data:
   description: "eduID IdP"
   logo_uri: "https://static.surfconext.nl/media/idp/eduid.png"
 
-schac_home_organization: eduid.nl
+# The first entry is the main schacHome
+schac_home_organizations: "eduid.nl, surfguest.nl"
 
 cron:
   node-cron-job-responsible: True

myconext-server/src/test/java/myconext/aa/AttributeAggregatorControllerTest.java

@@ -10,15 +10,16 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.stream.Stream;
 
 import static io.restassured.RestAssured.given;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
 
 public class AttributeAggregatorControllerTest extends AbstractIntegrationTest {
 
-    @Value("${schac_home_organization}")
-    private String schacHomeOrganization;
+    @Value("${schac_home_organizations}")
+    private String schacHomeOrganizations;
 
     private final String eppn = "1234567890@surfguest.nl";
 
@@ -39,7 +40,8 @@ public void aggregateUserNotFound() {
 
     @Test
     public void aggregateWithEduIDIdP() {
-        String eduIDEppn = String.format("mdoe@%s", this.schacHomeOrganization);
+        String schacHomeOrganization = Stream.of(schacHomeOrganizations.split(",")).map(String::trim).toList().getFirst();
+        String eduIDEppn = String.format("mdoe@%s", schacHomeOrganization);
         List<UserAttribute> userAttributes = doAggregate(
                 "aa", "secret", "http://brand-new-sp", eduIDEppn);
         assertEquals(1, userAttributes.size());