Issues/523 saml auth create email address objects

[kaushikaryan04]

Checklist

• I have read the OpenWISP Contributing Guidelines.
• I have manually tested the changes proposed in this pull request.
• I have written new test cases for new code and/or updated existing tests for changes to existing code.
• I have updated the documentation.

Reference to Existing Issue

Closes #523 .

Description of Changes

• Check if the NameID is an email and use it as the user's email.
• If NameID is not an email, check for the 'email' attribute in the SAML response.
• Create an EmailAddress object using the retrieved email.

Screenshot

[coveralls]

coverage: 98.648% (+0.003%) from 98.645%
when pulling 05f17e9 on kaushikaryan04:issues/523-SAML-auth-create-email-address-objects
into dc8580f on openwisp:master.

[nemesifier]

Thank you very much for your patience @kaushikaryan04.
I've been super busy publishing the new unified documentation website of OpenWISP, now I am back reviewing PRs.

This looks almost ready to merge, but there's a bit of validation we have to do before saving data got from external sources to the DB.

Please see my comments below.

[nemesifier]

Saving this information without validating it is dangerous.

Here we need to run full_clean() and catch any possible exception in case the email we get from the identity provider is invalid for some reason. If the email is invalid wont save/create, log a warning and skip, eg:

try:
    user.full_clean()
except ValidationError:
    logger.exception(f'Failed email validation for {user} during SAML user creation')
else:
    user.save()
    email_address = EmailAddress.objects.create(
       user=user, email=email, verified=True, primary=True
    )

Please add a new test for this error case, you can use mock or any other way to pass an invalid email and catch the validation error, there's similar tests in this and other modules you can base your test on, look for ValidationError in the test suites of the codebase.

[kaushikaryan04]

No problem.The new unified documentation looks great. I will make the suggested changes.

[nemesifier]

Remove (it's redundant, create() already peforms the save operation):

Suggested change

email_address.save()

[pandafy]

Instead of retrieving the email address from the SAML request, can we use the user.email field to get the email address? The field should get automatically populated by djangosaml2 using attribute mapping. Then, we can create the EmailAddress object with that value.

[nemesifier]

Follow up:

• [change] Update delete_old_radiusbatch_users inconsistencies ansible-openwisp2#500
• [change] Update delete_old_radiusbatch_users inconsistencies docker-openwisp#392