Auto user creation fails when “Get User Groups from External Authentication” is disabled

[Petikuu]

Hi guys,

In ManageIQ Quinteros-2.2, automatic user creation does not work in External (httpd) authentication mode if “Get User Groups from External Authentication (httpd)” is disabled. On first login, if the user does not already exist in the MIQ database, the login fails with:
Usernot created. Contact administrator. Auto-creation only works when “Get User Groups from External Authentication (httpd)” is enabled, but then MIQ overwrites internal group assignments on every login, which is not desired.

Is there an alternative supported workflow for institutions that want:

• external authentication only for username/password
• but want to manage RBAC groups purely inside MIQ, not in AD?

Thank you, Peter

[Fryguy]

When using external auth, we assume that both users and groups will come from the external auth. I have to check what "Get User Groups from External Auth" does now, because it used to actually go out and fetch the groups, but now we expect the groups to be sent along with the payload from the external auth at auth time. There currently isn't a way to only do users but not groups from external, but it's possible we can change the meaning of that checkbox to align with your feature.

[Petikuu]

@Fryguy Thank you for the clarification.
Is there any chance that this feature (external auth without external group mapping + automatic user creation) could be considered or implemented by the end of this year?
This would be extremely helpful for our university environment, as we need to handle a new semester and dynamically assign students to internal MIQ groups.
If this is not realistic, please let me know — I just want to understand what options we have.

[Fryguy]

I doubt we'd get in a feature like that by the end of the year, unless you submitted the pull requests. Please open an issue so we can keep track of it, and I can update that issue with any design details.