Authomatic can be set roles after login

CHANGES.rst

@@ -4,6 +4,9 @@ Changelog
 1.0b2 (unreleased)
 ------------------
 
+- Implementation of IRolesPlugin to set roles to connected user (through provider).
+  [bsuttor]
+
 - Add french translation
   [mpeeters]
 

src/pas/plugins/authomatic/browser/configure.zcml

@@ -18,6 +18,8 @@
       zcml:condition="not-have plone-5"
   />
 
+  <include package="Products.CMFCore" file="permissions.zcml" />
+
   <!-- Control panel -->
   <browser:page
       class=".controlpanel.AuthomaticSettingsEditFormSettingsControlPanel"

src/pas/plugins/authomatic/plugin.py

@@ -47,6 +47,7 @@ def manage_addAuthomaticPlugin(context, id, title='', RESPONSE=None, **kw):
     pas_interfaces.IAuthenticationPlugin,
     pas_interfaces.IPropertiesPlugin,
     pas_interfaces.IUserEnumerationPlugin,
+    pas_interfaces.IRolesPlugin
 )
 class AuthomaticPlugin(BasePlugin):
     """Authomatic PAS Plugin
@@ -287,5 +288,23 @@ def enumerateUsers(
             return sorted(ret, key=itemgetter(sort_by))
         return ret
 
+    @security.private
+    def getRolesForPrincipal(self, user, request=None):
+        """ Fullfill RolesPlugin requirements """
+        identity = self._useridentities_by_userid.get(user.getId(), None)
+        if not identity:
+            return ()
+        keys = [key for key in identity._identities.keys()]
+        provider_id = keys[0]
+
+        if 'roles' in identity._identities[provider_id].keys():
+            roles = identity._identities[provider_id]['roles']
+            if isinstance(roles, list):
+                return tuple(roles)
+            else:
+                return ()
+        else:
+            return ()
+
 
 InitializeClass(AuthomaticPlugin)