@@ -86,10 +86,7 @@ def B(*args, **kwargs):
8686from common .djangoapps .edxmako .shortcuts import render_to_string
8787from common .djangoapps .third_party_auth .utils import (
8888 get_associated_user_by_email_response ,
89- get_user_from_email ,
90- is_enterprise_customer_user ,
9189 is_oauth_provider ,
92- is_saml_provider ,
9390 user_exists ,
9491)
9592from common .djangoapps .track import segment
@@ -780,80 +777,18 @@ def associate_by_email_if_oauth(auth_entry, backend, details, user, strategy, *a
780777 return association_response
781778
782779
783- @partial .partial
784780def associate_by_email_if_saml (auth_entry , backend , details , user , strategy , * args , ** kwargs ):
785781 """
786- This pipeline step associates the current social auth with the user with the
787- same email address in the database. It defers to the social library's associate_by_email
788- implementation, which verifies that only a single database user is associated with the email.
782+ Deprecated — enterprise SAML email association moved to
783+ enterprise.tpa_pipeline.enterprise_associate_by_email.
789784
790- This association is done ONLY if the user entered the pipeline belongs to SAML provider .
785+ Retained as a no-op for backwards compatibility with custom pipeline configs .
791786 """
792- from openedx .features .enterprise_support .api import enterprise_is_enabled
793-
794- def get_user ():
795- """
796- This is the helper method to get the user from system by matching email.
797- """
798- user_details = {'email' : details .get ('email' )} if details else None
799- return get_user_from_email (user_details or {})
800-
801- @enterprise_is_enabled ()
802- def associate_by_email_if_enterprise_user ():
803- """
804- If the learner arriving via SAML is already linked to the enterprise customer linked to the same IdP,
805- they should not be prompted for their edX password.
806- """
807- try :
808- enterprise_customer_user = is_enterprise_customer_user (current_provider .provider_id , current_user )
809- logger .info (
810- '[Multiple_SSO_SAML_Accounts_Association_to_User] Enterprise user verification:' # noqa: UP032
811- 'User Email: {email}, User ID: {user_id}, Provider ID: {provider_id},'
812- ' is_enterprise_customer_user: {enterprise_customer_user}' .format (
813- email = current_user .email ,
814- user_id = current_user .id ,
815- provider_id = current_provider .provider_id ,
816- enterprise_customer_user = enterprise_customer_user ,
817- )
818- )
819-
820- if enterprise_customer_user :
821- # this is python social auth pipeline default method to automatically associate social accounts
822- # if the email already matches a user account.
823- association_response , user_is_active = get_associated_user_by_email_response (
824- backend , details , user , * args , ** kwargs )
825-
826- if not user_is_active :
827- logger .info (
828- '[Multiple_SSO_SAML_Accounts_Association_to_User] User association account is not' # noqa: UP032 # pylint: disable=line-too-long
829- ' active: User Email: {email}, User ID: {user_id}, Provider ID: {provider_id},'
830- ' is_enterprise_customer_user: {enterprise_customer_user}' .format (
831- email = current_user .email ,
832- user_id = current_user .id ,
833- provider_id = current_provider .provider_id ,
834- enterprise_customer_user = enterprise_customer_user
835- )
836- )
837- return None
838-
839- return association_response
840-
841- except Exception as ex : # pylint: disable=broad-except
842- logger .exception ('[Multiple_SSO_SAML_Accounts_Association_to_User] Error in'
843- ' saml multiple accounts association: User ID: %s, User Email: %s:,'
844- 'Provider ID: %s, Exception: %s' , current_user .id , current_user .email ,
845- current_provider .provider_id , ex )
846-
847- saml_provider , current_provider = is_saml_provider (strategy .request .backend .name , kwargs )
848-
849- if saml_provider :
850- # get the user by matching email if the pipeline user is not available.
851- current_user = user if user else get_user ()
852-
853- # Verify that the user linked to enterprise customer of current identity provider and an active user
854- associate_response = associate_by_email_if_enterprise_user () if current_user else None
855- if associate_response :
856- return associate_response
787+ logger .warning (
788+ "associate_by_email_if_saml is deprecated and is now a no-op. "
789+ "Enterprise SAML email association has moved to "
790+ "enterprise.tpa_pipeline.enterprise_associate_by_email."
791+ )
857792
858793
859794def user_details_force_sync (auth_entry , strategy , details , user = None , * args , ** kwargs ): # pylint: disable=keyword-arg-before-vararg
0 commit comments