UCL role accounts do not provide employeeid

[MaxwellKeeble]

Hi team. UCL has "role accounts" which are fully provisioned accounts that are not linked to an individual person. When trying to log in as one of those via UCL API, it throws this error:

Could employeeid be made optional?

An example such account is uczxact

[greenfrogs]

Hi Maxwell, good to hear from you again. At the moment it is non-trivial to disable employeeid, we have it marked as a critical field as it is used during the OAuth flow. During the development of uclapi we were given assurances from UCL that employeeid would always be non-null and unique (UPI). In theory we could switch to eppn or cn which should also be unique but we don't know how consistent they are (for example email can change when moving from a student to faculty).

Also we are planning a major upgrade to our production infrastructure between the 11th and 12th September. If we find a workaround solution by then this will be the time we can implement it. But we are concerned people possibly losing access to their accounts if we start checking against a different value.

Maybe @zipy124 @ChristopherHammond13 has a better idea of a workaround.

[greenfrogs]

@MaxwellKeeble could you please login to our staging environment with the account, we have some additional logging enabled for failed logins. We want to try and see if there is an affiliation or group we can add a special rule for.

https://staging.ninja please ignore the certificate error, it is just a temporary bug of our migration.

[MaxwellKeeble]

Hi @greenfrogs, just to confirm (as mentioned in e-mail),

I've logged in with another of our role accounts - uczx001 - just now (approx 2021-09-06 16.40).

It had the same error, hopefully the logs are helpful.

Error 400 - Bad Request.
UCL has sent incomplete headers. If the issues persist please contact the UCL API Team to rectify this. The missing fields are (space delimited): employeeid