Shibboleth integration #697
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Auto creates user based on info received in configured X-Shib headers * Auto logs in existing user if matches X-Shib-User header * Works with ConfigurationCheckMiddleware for auto login Limitations: * Usernames still limited to 30 characters * Does not hook into login/logout URLs yet
Probably will need some refinement once it can be integrated with SP/IdP * For now, just replace existing login with Shibboleth. Could be made to work alongside existing login if necessary. * Insert 'logged out' message page to prevent bouncing straight back to login.
* Users cannot edit fields (these are sent by Shibboleth, and will be overwritten on next login if changed). * Users cannot change password. * Profile page is now a listing of user details, and regen api key form * Admins still can do all of this for a user.
Lets Django app know we're behind an SSL connection
Ensure the 'welcome' screen still happens, but is triggered by the presence of a uuid rather than the existence of any users (since with Shibboleth auth, there will always be a user at that point). Welcome form now only takes in organisational info, and doesn't do anything around user creation. It will still do important things like generate the UUID.
(It shouldn't be triggered for Shibboleth users as non-exempt URLs will be prevented from anonymous access by nginx)
This is controlled by settings.
Will only attempt user creation (or show the form) if there are no existing users
qubot
force-pushed
the
dev/fix-migration
branch
3 times, most recently
from
764dc9a
to
9198655
Compare
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
For #666 - adds optional Shibboleth authentication via headers sent from web server. Originally from JiscRDSS.
Goes with artefactual/archivematica-storage-service#210
Currently based against the wrong branch, so not ready to merge yet, will rebase when #696 is merged.