-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'develop' into feature/wordcloud-chartjs
- Loading branch information
Showing
7 changed files
with
94 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -171,3 +171,5 @@ | |
'url': [('https://dig.hum.uu.nl', 'en')], | ||
}, | ||
} | ||
|
||
SAML_GROUP_NAME = 'uu' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,26 @@ | ||
from django.db import migrations | ||
from users.saml import saml_user_group | ||
|
||
def add_saml_users_to_group(apps, schema_editor): | ||
CustomUser = apps.get_model('users', 'CustomUser') | ||
|
||
saml_users = CustomUser.objects.filter(saml = True) | ||
saml_group = saml_user_group() | ||
|
||
if saml_group: | ||
for user in saml_users: | ||
user.groups.add(saml_group) | ||
user.save() | ||
|
||
class Migration(migrations.Migration): | ||
|
||
dependencies = [ | ||
('users', '0004_userprofile'), | ||
] | ||
|
||
operations = [ | ||
migrations.RunPython( | ||
add_saml_users_to_group, | ||
reverse_code=migrations.RunPython.noop | ||
) | ||
] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,7 +1,19 @@ | ||
from djangosaml2.backends import Saml2Backend | ||
from django.contrib.auth.models import Group | ||
from django.conf import settings | ||
|
||
class CustomSaml2Backend(Saml2Backend): | ||
def get_or_create_user(self, *args, **kwargs): | ||
user, created = super().get_or_create_user(*args, **kwargs) | ||
user.saml = True | ||
|
||
saml_group = saml_user_group() | ||
if saml_group: | ||
user.groups.add(saml_group) | ||
|
||
return user, created | ||
|
||
def saml_user_group(): | ||
group_name = getattr(settings, 'SAML_GROUP_NAME', None) | ||
if group_name: | ||
return Group.objects.get_or_create(name=group_name) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,7 +1,13 @@ | ||
# SAML | ||
|
||
In order to login with Solis ID, I-analyzer has SAML integration with ITS. For this, it uses the [djangosaml2 library](https://djangosaml2.readthedocs.io/). More information on working with SAML, setting up a local environment to test the SAML integration, etc. can be found [here](https://github.com/UUDigitalHumanitieslab/dh-info/blob/master/SAML.md) | ||
|
||
The urls exposed by DjangoSaml2 are included as part of our `users` application, e.g., `<hostname>/users/saml2/login`. DjangoSaml2 takes care of consuming the response from the Identity Provider and logging in the user. The `SAML_ATTRIBUTE_MAPPING` variable contains a dictionary of the data coming in from the identity provider, e.g., `uushortid`, and translating that to the corresponding column in the user table, e.g., `username`. Moreover, the setting `SAML_CREATE_UNKNOWN_USER = True` makes sure that we create a user in our database if it's not present yet. | ||
|
||
The only tweaks added on top of the DjangoSaml2 package are: | ||
- the logic to set the `saml` column to `True` for a user logging in with SAML. The `CustomSaml2Backend` overrides DjangoSaml2's `get_or_create_user` function to take care of this. Note that in the future, we could also turn this field into a `CharField` to keep track of multiple identity providers here. | ||
- overriding DjangoSaml2's `LogoutView` to make its `post` method `csrf_exempt`. The response from the ITS Identity Provider does not send the csrf cookie in a way that it can be consumed by Django at the moment. | ||
|
||
### Authorisation | ||
|
||
If you define a `SAML_GROUP_NAME` in settings, SAML users will always be added to a group with that name when they create an account. (The group will be created if it does not exist.) This can be used to give permissions to SAML users. The group is not used to handle authentication, so you can add non-SAML users to it as well. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters