[Institution Rework] [ENG-4203] [ENG-4205] Rework Institution SSO flow with identity and affiliation - CAS Part - #75
Merged
cslzchen merged 4 commits intoJan 19, 2023
Conversation
3 tasks
cslzchen
changed the title
cslzchen
marked this pull request as ready for review
January 16, 2023 19:16
cslzchen
changed the base branch from
feautre/institution-rework
to
feature/institution-rework
January 18, 2023 05:00
* Shib session and attributes parsing * Initial credential construction from shib * API payload creation * Authentication result object * Final credential update from API result * Logs and errors * More JavaDoc
* Normalized format string in all logs * All logs include SSO info (institution, email and identity) * All logs start with their "[Component Name]" * All logs are trimmed (but remains distinguishable and readable) * Error logs now have 3 different types: Error, Exception, Failure In addition, removed the temporary solution that uses `eppn` as both email and identity. This hack was added to solve one special case where an institution changed their email domain.
cslzchen
force-pushed
the
feature/sso-with-identity
branch
from
January 18, 2023 05:15
badbf3c to
57c8a7d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Retrieve SSO identity from Shibboleth authn request and send it to OSF API during institution SSO
API Part: CenterForOpenScience/osf.io#10260
Ticket: https://openscience.atlassian.net/browse/ENG-4205 and https://openscience.atlassian.net/browse/ENG-4203
Changes
CAS now releases
ssoEmailandssoIdentityto OSF APIDisambiguate
email/ssoEmail,mail/mailOther,username,eppnandremoteUserandssoIdentityRewrote/updated the SSO flow (SAML/Shibboleth)
Rewrote/normalized SSO logs for better search and easier debugging. It also helps aggregation when Sentry is integrated in the near future.
QA Notes
DevOps Notes
remoteUsercomes from a few attributes, which could beeppn,uid,persistentId, etc. Need to double check the private settings for this one.