Skip to content

[Fixes #14107] Add configurable sync strategies for Social Account group memberships#14108

Open
Gpetrak wants to merge 4 commits intomasterfrom
ISSUE_14107
Open

[Fixes #14107] Add configurable sync strategies for Social Account group memberships#14108
Gpetrak wants to merge 4 commits intomasterfrom
ISSUE_14107

Conversation

@Gpetrak
Copy link
Copy Markdown
Member

@Gpetrak Gpetrak commented Apr 6, 2026

This PR was created according to this issue: #14107

Checklist

Reviewing is a process done by project maintainers, mostly on a volunteer basis. We try to keep the overhead as small as possible and appreciate if you help us to do so by completing the following items. Feel free to ask in a comment if you have troubles with any of them.

For all pull requests:

  • Confirm you have read the contribution guidelines
  • You have sent a Contribution Licence Agreement (CLA) as necessary (not required for small changes, e.g., fixing typos in the documentation)
  • Make sure the first PR targets the master branch, eventual backports will be managed later. This can be ignored if the PR is fixing an issue that only happens in a specific branch, but not in newer ones.

The following are required only for core and extension modules (they are welcomed, but not required, for contrib modules):

  • There is a ticket in https://github.com/GeoNode/geonode/issues describing the issue/improvement/feature (a notable exemption is, changes not visible to end-users)
  • The issue connected to the PR must have Labels and Milestone assigned
  • PR for bug fixes and small new features are presented as a single commit
  • PR title must be in the form "[Fixes #<issue_number>] Title of the PR"
  • New unit tests have been added covering the changes, unless there is an explanation on why the tests are not necessary/implemented

Submitting the PR does not require you to check all items, but by the time it gets merged, they should be either satisfied or inapplicable.

@Gpetrak Gpetrak added this to the 5.1.0 milestone Apr 6, 2026
@cla-bot cla-bot bot added the cla-signed CLA Bot: community license agreement signed label Apr 6, 2026
@Gpetrak Gpetrak changed the title Add configurable sync strategies for Social Account group memberships [Fixes #14107] Add configurable sync strategies for Social Account group memberships Apr 6, 2026
@Gpetrak Gpetrak requested a review from mattiagiupponi April 6, 2026 11:03
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a configurable synchronization strategy for user groups during social login, allowing for full, safe, or no synchronization via the SOCIALACCOUNT_SYNC_USER_GROUPS_ON_LOGIN setting. A potential logic error was identified in the SAFE_SYNC mode where an empty group list from the provider could cause the synchronization to skip entirely instead of clearing existing local groups.

}

# Default to FULL_SYNC to maintain backward compatibility
SOCIALACCOUNT_SYNC_USER_GROUPS_ON_LOGIN = os.getenv("SOCIALACCOUNT_SYNC_USER_GROUPS_ON_LOGIN", "FULL_SYNC")
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i would add here as a comment the three possibility and what they actually do

groups = extractor.extract_groups(sociallogin.account.extra_data)

# If groups are missing, try roles
if groups == "":
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe if not groups is better, so if the code change and returns False / None or [] here is still compatible

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cla-signed CLA Bot: community license agreement signed enhancement

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Prevent destructive group membership wipes during OIDC synchronization

2 participants