Scenario:

• When someone goes on login page, there is a "Login with Github" button.
• When user click it, she is redirected to github to authorization
• If user grant access, she is redirected to Tuleap server
  • If user never associated her github account to Tuleap account, she's asked to authenticate on Tuleap using login & password. Once the Tuleap authentication succeed the 2 accounts are associated.
  • If Github identifier is already known (previous bullet) user is automatically authenticated & redirected to the page she supposed to see (return to original page)
• If user doesn't grant access, she is redirected to Tuleap server, Tuleap server display an error and propose standard login.
• User should see his associations in account prefrences + unlink

In this step, there is not yet:

• possibility to create an account
• possibility to use a provider different of Github

Technical notes:

• Technically speaking, the GH information is stored in DB but "hardcoded" (it means that an admin that want to deploy the plugin at this time will have to insert stuff directly in DB)
• If LDAP is activated, there is no openid connect
• One user can pair several providers to one account