Activation and Limitation of Shibboleth Users

1 Initial Problem

Currently a ILIAS-Account can be deactivated or a Administrator is able to set a time limitation. Both actions do not affect Shibboleth-Accounts which leads to unclear processes.

Original content:
A Shibboleth user can login even when the access time is limited.
Mantis: http://www.ilias.de/mantis/view.php?id=20169

2 Conceptual Summary

A Shibboleth user should not be able to login when the access time is limited or inactive. He should get a warning message, as with the local login procedure.
Furthermore, it should be possible to manually activate accounts created via shibboleth for administrators. In this case, a newly created account in ILIAS is set to inactive and must be activated by an administrator.

Introduction of two new options under "Administration > Authentication and Registration > Shibboleth":

a) Prohibit logins of inacitve users (Checkbox)
b) Registration with approval (Checkbox) with an additional input of users getting notified (identical to setting in ILIAS Auth)

3 Technical Information

Schmid, Fabian [fschmid]: The implementation will use the same mechanism as the local login. Additionally I recommend to implement the feature Accounts have to be activated by an Admin". All this features will be deactivated by default and after an upgrade to 5.3.

4 Contact

• Author of the Request: stefan-rieger
• Maintainer: Schmid, Fabian [fschmid], sr.solutions
• Implementation of the feature is done by: Schmid, Fabian [fschmid], sr.solutions

5 Funding

If you are interest in funding this feature, please add your name and institution to this list.

• Universitätsbibliothek Tübingen

6 Discussion

JourFixe, ILIAS [jourfixe], July 17, 2017: We highly appreciate this suggestion and schedule the feature for 5.3.

7 Implementation

The new functionality can be activated in Administration -> Authentication and Registration -> Shibboleth by checking the option "New Accounts with Approval":

The administrators defined in "Authentication and Registration -> Notifications" will get an email.

Test Cases

Test cases completed at 2017-08-14 by Schmid, Fabian [fschmid]{user}

• C18639 : Account aktivieren

Approval

Approved at {date} by {user}.