Cian-H/invenio-config-iform
1
0
Fork 0
mirror of https://github.com/Cian-H/invenio-config-iform.git synced 2025-12-30 16:52:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Mapping (#6)

Browse Source 
* saml config

* manifest for saml files

* required

* required

* travis added install

* travis added install

* travis added installs

* extras

* extras

* added

* added

* onelogin configs

* onelogin configs

* using ready

* typo

* email sender

* modified config.py

added CORS variables in order to be possible to enable the CORS. also rearanged the config.py variables and thier comments.

* missing import:

in config.py import is needed in order to use flask_babelex func. also this module requires invenio-saml to be installed - added to the install_requires. for now installing it via github.

* install_requires

changed the branch for invenio-saml

* updated setup.py

changed to custom branch of invenio-saml, for testing the changes on those branch.

* Update config.py

In order to register user_profile via login with OAuth client, one must set this value.

* typo

fixed typo in comment.

* removed entityId

removed manully input for service provider, now it will assign automaticly the metadata url to service provider entityID.

* mapping field

a. changed invenio-saml branch, b. changed mapping field names.

* added missing NameIDFormat

* fix missplaced

name and surname was misplaced

* changed branch
This commit is contained in:
mb-wali
2020-06-26 10:39:53 +02:00
committed by GitHub
parent a62ed72989
commit 6a898d0f69
12 changed files with 339 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

224
invenio_config_tugraz/config.py
View File

@@ -8,8 +8,10 @@
"""invenio module that adds tugraz configs."""
# TODO: This is an example file. Remove it if your package does not use any
# extra configuration variables.
from flask_babelex import gettext as _
from invenio_saml.handlers import acs_handler_factory
"""invenio-saml import"""
INVENIO_CONFIG_TUGRAZ_DEFAULT_VALUE = 'foobar'
"""Default value for the application."""
@@ -17,15 +19,18 @@ INVENIO_CONFIG_TUGRAZ_DEFAULT_VALUE = 'foobar'
INVENIO_CONFIG_TUGRAZ_BASE_TEMPLATE = 'invenio_config_tugraz/base.html'
"""Default base template for the demo page."""
# Allowed Hosts
APP_ALLOWED_HOSTS = ['0.0.0.0',
'localhost',
'127.0.0.1',
'invenio-dev01.tugraz.at',
'invenio-test.tugraz.at'
]
"""Allowed Hosts"""
# Invenio-App
# ===========
# See https://invenio-app.readthedocs.io/en/latest/configuration.html
# Allow the statics to build
APP_DEFAULT_SECURE_HEADERS = {
'content_security_policy': {
'default-src': [
@@ -53,12 +58,207 @@ APP_DEFAULT_SECURE_HEADERS = {
'strict_transport_security_preload': False,
}
# Mail server
MAIL_SERVER = '129.27.11.182'
SECURITY_EMAIL_SENDER = 'info@invenio-rdm.tugraz.at'
SECURITY_EMAIL_SUBJECT_REGISTER = 'Welcome to RDM!'
MAIL_SUPPRESS_SEND = False
# Invenio-Mail
# ===========
# See https://invenio-mail.readthedocs.io/en/latest/configuration.html
# Shibboleth config
# set True if SAML is configured.
SHIBBOLETH_ISACTIVE = 'False'
MAIL_SERVER = '129.27.11.182'
"""Domain ip where mail server is running."""
SECURITY_EMAIL_SENDER = "info@invenio-test.tugraz.at"
"""Email address used as sender of account registration emails."""
"""Domain name should match the domain used in web server."""
SECURITY_EMAIL_SUBJECT_REGISTER = _("Welcome to RDM!")
"""Email subject for account registration emails."""
MAIL_SUPPRESS_SEND = False
"""Enable email sending by default."""
# CORS - Cross-origin resource sharing
# ===========
# Uncomment to enable the CORS
#CORS_RESOURCES = '*'
#CORS_SEND_WILDCARD = True
#CORS_EXPOSE_HEADERS = [
# 'ETag',
# 'Link',
# 'X-RateLimit-Limit',
# 'X-RateLimit-Remaining',
# 'X-RateLimit-Reset',
# 'Content-Type',
#]
#REST_ENABLE_CORS = True
# Invenio-saml
# ===========
#
INVENIO_CONFIG_TUGRAZ_SHIBBOLETH = 'True'
"""Set True if SAML is configured"""
USERPROFILES_EXTEND_SECURITY_FORMS = True
"""Set True in order to register user_profile"""
SSO_SAML_IDPS = {
'idp': {
'settings': {
'debug': True,
'idp': {
'entityId': 'https://sso.tugraz.at/idp/shibboleth',
'singleLogoutService': {
'binding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
'url': 'https://sso.tugraz.at/slo/Logout'
},
'singleSignOnService': {
'binding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
'url': 'https://sso.tugraz.at/idp/profile/SAML2/Redirect/SSO'
},
'x509cert': 'MIIDHzCCAgegAwIBAgIUG6ra0BvXswfyErcCDmzw3AV+uI0wDQYJKoZIhvcNAQEFBQAwGDEWMBQGA1UEAxMNc3NvLnR1Z3Jhei5hdDAeFw0xMDAzMjkxNzEzMTZaFw0zMDAzMjkxODEzMTZaMBgxFjAUBgNVBAMTDXNzby50dWdyYXouYXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCEyQxHIM1zxbBnXn60Ksg7B7HcPLPcN7bXLrLPOFXtkZxm0YkHY5Rxignm7wHD7C81U09DFS2eT8qRCcVtVz+kuwdgS54fC/alg9oLxXk4CgKjhtZZ2ECLdTHfUXOA5uOLlpoN1LY6VpIjSYe3UEX3HxfhXx/fPeE8VInGCKnml8Too22G30htB/EU44A2yqrR3LUngJIaq //N0QbeMYitNh02o6xB5+bp6k6noM7DH6S9phe0kCEibaiLaCf7k9LpNnAz9bPtQVth0gdJqoUry/iK1QBTFTEXvvJynFEp0+5Wz/XFmEcFhsaK8OcHd0R9FfpX5Z2fewA2Q0SLKz+bAgMBAAGjYTBfMD4GA1UdEQQ3MDWCDXNzby50dWdyYXouYXSGJGh0dHBzOi8vc3NvLnR1Z3Jhei5hdC9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQUXd76PcSiXR6wFna5qQi+S0W/9Y0wDQYJKoZIhvcNAQEFBQADggEBACgkQqxBtYY1OcuoAUP/P+ukJW7XyofK89qs2dkGClx7s0hR/1zImWgljgfguLJOSfC/CWE1wfNK9bTi4Fu9809PmOoaCxkNmniFRAyaOiBoUz5XIpJniW7wBo+YBpBlXZXi5PmU2DOsfZxo7fs4se32dHO1WqgJodqkK2Wa4HDiigh42trZ9i3uS73uHSSCeIJYQNj84BMJ+ifgj3Zi/TgLS+IX7Ayy2bkDzIzIRnj7ULQ/MgfacGXQXJPHyp+w+YvydQalPAWc43+5DkNacN34K8cE3XjHq1kx/BgYOtQ7M2Xa1oApLzPoHO4D2kaf6FCgGR8Mx7GVAz0aQVxfB8I='
},
'sp': {
'NameIDFormat': 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',
'privateKey': 'MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIHxNp8P2PsV8CAggAMBQGCCqGSIb3DQMHBAjOyik6fsEC3gSCAoC4tFsYAl4GexyXESiRKpOQzHQNFtQtwDEevT1IKgsafSNjOMJZLKrnoejNoxEQUPPPXgGEd83Fmp2cSHm+YVksH06zcsA+RKf5ab6t0bsgcyljGzkHEDQtMRPcaXNlVMbU9VEDOX26MgmlU/pd+GGfE99IbEFc6qN1e7qOnmKSw93Q3o05ubO3wEI76JhOioGGXB3pEn8f4XLDwck0thzYD6H2vdF+kyIdM8w1BgyLdeP0aDkfG1V3rLGhE8246rwVUzRSZv6BCNBZFk7YO1d7j0+BDxnbHFS631zdCgMcd/XS8u6acc3IYr/bQLH4a1y0X3Z+8ks8arEgUtXqYx9wMlp5lajlsr9JDIU5OnuZ2XY+4sqDQsTZPjBpxK8oMjvJNNatnTf+18htkTdovpInlP7xpEjp1L7H74iKY25UsAZ9e+gqHZwILnk418mQ1E4JYU6JRUZspJSFfqwn9FL6DnvhzPIhtzwhr3eL4f4RXWxxe2xCzvWg+GaWuMfZdj77SV4pMOi7vb3HlYY6luShVlYKdSaw+jf6XVy4ZMTWT5wcE1mc3tAJqF18Mi8amOetpZhz16ISOKnO0rKrfmxteNPQn2AB8QquGGn050PTW4m8zFXDBiyg2xvcRLAW/8ych3k+pkEZi4tVCkLcHM56J/XUEKMCxiSok+vbzxfVf1D2vYFFS7Lw1nP5RnLKFdn8XdHQ+lu2diod18wYBQP4eoU+XjjP2zjlpULiWHt7PpCERqGg7H2Z2amIL5rTeqQuyXczw1/xG/VBNn9qe3DXFodvoV6OZb3efNT/eJgOyaPLi2FmB7Kpdp4JIdJgLnaBCwNBXkpGSwb732O/cug8',
'x509cert': 'MIICjjCCAfegAwIBAgIBADANBgkqhkiG9w0BAQ0FADBkMQswCQYDVQQGEwJhdDENMAsGA1UECAwER3JhejEPMA0GA1UECgwGVFVHUkFaMRAwDgYDVQQDDAdpbnZlbmlvMSMwIQYJKoZIhvcNAQkBFhRtb2ppYi53YWxpQHR1Z3Jhei5hdDAeFw0yMDAxMTAyMDIwMTlaFw0yMTAxMDkyMDIwMTlaMGQxCzAJBgNVBAYTAmF0MQ0wCwYDVQQIDARHcmF6MQ8wDQYDVQQKDAZUVUdSQVoxEDAOBgNVBAMMB2ludmVuaW8xIzAhBgkqhkiG9w0BCQEWFG1vamliLndhbGlAdHVncmF6LmF0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5ZrPhRhyDyLTe93rpgqN9MMfnCsg+2QBW4EOuQnMXJzF1dqrFEsexot1FRW83IjqbY+680PmGABQtxUpS4Kinr/pLYbPhQ2WPQRad7mtOn/dD40VVwfG0GfcLrnKe5F4QLfNjervjl8jH/AKPCYwwfSeuw1LNoRjy1uDwkp9cRQIDAQABo1AwTjAdBgNVHQ4EFgQUPv2+wS1RuagCOed7w1FzouBmpP4wHwYDVR0jBBgwFoAUPv2+wS1RuagCOed7w1FzouBmpP4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQA4qvU7gbgE/MoljUW68qMPs8z8Q2Ngttp6F1KOMNO9rgrYWAJh4u6BMt11mlBgBlLLJzG67wXpBr0l78IcOXun4w955te0VRp7aZ0b1uOPt0aUoDOXuBAhZURLZfbsogpWiE6bdB8N0nHTwk2WG2PPIC5Z99UdDivcP5ZeSPAkUw=='
},
'security': {
'authnRequestsSigned': False,
'failOnAuthnContextMismatch': False,
'logoutRequestSigned': False,
'logoutResponseSigned': False,
'metadataCacheDuration': None,
'metadataValidUntil': None,
'nameIdEncrypted': False,
'requestedAuthnContext': False,
'requestedAuthnContextComparison': 'exact',
'signMetadata': False,
'signatureAlgorithm':
'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
'wantAssertionsEncrypted': False,
'wantAssertionsSigned': False,
'wantAttributeStatement': False,
'wantMessagesSigned': False,
'wantNameId': True,
'wantNameIdEncrypted': False,
'digestAlgorithm':
'http://www.w3.org/2001/04/xmlenc#sha256'
},
},
'mappings': {
# invenio # origin
'email': 'urn:oid:0.9.2342.19200300.100.1.3',
'name': 'urn:oid:2.5.4.42',
'surname': 'urn:oid:2.5.4.4',
'external_id': 'urn:oid:1.3.6.1.4.1.5923.1.1.1.6',
# Custom
'org_id': 'urn:oid:CO-ORGUNITID', # orgunitid
'org_name': 'urn:oid:CO-ORGUNITNAME', # orgunitname
'identifier': 'urn:oid:CO-IDENTNR-C-oid' # oid:CO-IDENTNR-C-oid
},
'acs_handler': acs_handler_factory('idp'),
},
# onelogin
'onelogin': {
'settings': {
'debug': True,
'idp': {
'entityId': 'https://app.onelogin.com/saml/metadata/01661574-91ed-4735-a3b9-f4ddebb2cbb8',
'singleLogoutService': {
'binding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
'url': 'https://tugraz-dev.onelogin.com/trust/saml2/http-redirect/slo/1070112'
},
'singleSignOnService': {
'binding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
'url': 'https://tugraz-dev.onelogin.com/trust/saml2/http-post/sso/01661574-91ed-4735-a3b9-f4ddebb2cbb8'
},
'x509cert': 'MIID2DCCAsCgAwIBAgIUWRGl84DFd+GbLYt0BmwyI+FCKVIwDQYJKoZIhvcNAQEFBQAwRDEPMA0GA1UECgwGVFVHUkFaMRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxGjAYBgNVBAMMEU9uZUxvZ2luIEFjY291bnQgMB4XDTIwMDEyODEwNDI1M1oXDTI1MDEyODEwNDI1M1owRDEPMA0GA1UECgwGVFVHUkFaMRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxGjAYBgNVBAMMEU9uZUxvZ2luIEFjY291bnQgMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAve5a++I/VHC22fMk5v8GwCvdIyiziOwGjq0XXyjTg9TyhHJZbfDXa7S0NjK7dK4+d3iaB3MvCpnr+7H2J2Cohracgy2BQz9Z4BqsjDat016zkAPoID9R6osliqocw1jESnyL59OJWftAiA4rFmQs6v/b56vgre8EP6qKbykq6mWvepGyBbfjRsYbFoIDmnW8kJoZtLMDQfTBvEF2veHDt9EbsWP+hyedMYTWCfsbTHhFKNrhRKr3m3k+w6Zsca2zp3A8xiFv0fcl6PglEwEZz2Iwb0ySifaf4ZLDVjSekpCLf29doBJYUeE5TUP8oHfATOcWW+m5D3MXVcMUax+AFwIDAQABo4HBMIG+MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFK4GHoSfnMQKb8RjP2HrGzJ4ICiDMH8GA1UdIwR4MHaAFK4GHoSfnMQKb8RjP2HrGzJ4ICiDoUikRjBEMQ8wDQYDVQQKDAZUVUdSQVoxFTATBgNVBAsMDE9uZUxvZ2luIElkUDEaMBgGA1UEAwwRT25lTG9naW4gQWNjb3VudCCCFFkRpfOAxXfhmy2LdAZsMiPhQilSMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQUFAAOCAQEAUg7UHFju0QA7ubcSLBuvEMUQL9jxtzDi0ndSi8qqtLJSjBalcfll0X/gI+sAMGMd0MW7P3abOVVfGBSlZN01KCPC2WHKRwzyO3sOCatkPrn2SYthQWHD/W7psyFgoDt5lQNijLyZdpvZbRIotxcWpoaTcBzaArd/0MNe1VaGlLK5GeqtbwL+dQD+O3mtSUfF918qeiOHEwI7nfPo7vjUyRT8Ov1loqP5+A0/R1CyL0Dh/tVdIkOHx6EjrIXsb/K6xXPknYZqPApPkZq514ZCEPhAILFU+5R/cQMZMZEacCdKuQ9XMkR8bqnh8xu620SCYiSVPXtVW4bpXKs0nJazBQ=='
},
'sp': {
'privateKey': 'MIICxjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIHxNp8P2PsV8CAggAMBQGCCqGSIb3DQMHBAjOyik6fsEC3gSCAoC4tFsYAl4GexyXESiRKpOQzHQNFtQtwDEevT1IKgsafSNjOMJZLKrnoejNoxEQUPPPXgGEd83Fmp2cSHm+YVksH06zcsA+RKf5ab6t0bsgcyljGzkHEDQtMRPcaXNlVMbU9VEDOX26MgmlU/pd+GGfE99IbEFc6qN1e7qOnmKSw93Q3o05ubO3wEI76JhOioGGXB3pEn8f4XLDwck0thzYD6H2vdF+kyIdM8w1BgyLdeP0aDkfG1V3rLGhE8246rwVUzRSZv6BCNBZFk7YO1d7j0+BDxnbHFS631zdCgMcd/XS8u6acc3IYr/bQLH4a1y0X3Z+8ks8arEgUtXqYx9wMlp5lajlsr9JDIU5OnuZ2XY+4sqDQsTZPjBpxK8oMjvJNNatnTf+18htkTdovpInlP7xpEjp1L7H74iKY25UsAZ9e+gqHZwILnk418mQ1E4JYU6JRUZspJSFfqwn9FL6DnvhzPIhtzwhr3eL4f4RXWxxe2xCzvWg+GaWuMfZdj77SV4pMOi7vb3HlYY6luShVlYKdSaw+jf6XVy4ZMTWT5wcE1mc3tAJqF18Mi8amOetpZhz16ISOKnO0rKrfmxteNPQn2AB8QquGGn050PTW4m8zFXDBiyg2xvcRLAW/8ych3k+pkEZi4tVCkLcHM56J/XUEKMCxiSok+vbzxfVf1D2vYFFS7Lw1nP5RnLKFdn8XdHQ+lu2diod18wYBQP4eoU+XjjP2zjlpULiWHt7PpCERqGg7H2Z2amIL5rTeqQuyXczw1/xG/VBNn9qe3DXFodvoV6OZb3efNT/eJgOyaPLi2FmB7Kpdp4JIdJgLnaBCwNBXkpGSwb732O/cug8',
'x509cert': 'MIICjjCCAfegAwIBAgIBADANBgkqhkiG9w0BAQ0FADBkMQswCQYDVQQGEwJhdDENMAsGA1UECAwER3JhejEPMA0GA1UECgwGVFVHUkFaMRAwDgYDVQQDDAdpbnZlbmlvMSMwIQYJKoZIhvcNAQkBFhRtb2ppYi53YWxpQHR1Z3Jhei5hdDAeFw0yMDAxMTAyMDIwMTlaFw0yMTAxMDkyMDIwMTlaMGQxCzAJBgNVBAYTAmF0MQ0wCwYDVQQIDARHcmF6MQ8wDQYDVQQKDAZUVUdSQVoxEDAOBgNVBAMMB2ludmVuaW8xIzAhBgkqhkiG9w0BCQEWFG1vamliLndhbGlAdHVncmF6LmF0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5ZrPhRhyDyLTe93rpgqN9MMfnCsg+2QBW4EOuQnMXJzF1dqrFEsexot1FRW83IjqbY+680PmGABQtxUpS4Kinr/pLYbPhQ2WPQRad7mtOn/dD40VVwfG0GfcLrnKe5F4QLfNjervjl8jH/AKPCYwwfSeuw1LNoRjy1uDwkp9cRQIDAQABo1AwTjAdBgNVHQ4EFgQUPv2+wS1RuagCOed7w1FzouBmpP4wHwYDVR0jBBgwFoAUPv2+wS1RuagCOed7w1FzouBmpP4wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQA4qvU7gbgE/MoljUW68qMPs8z8Q2Ngttp6F1KOMNO9rgrYWAJh4u6BMt11mlBgBlLLJzG67wXpBr0l78IcOXun4w955te0VRp7aZ0b1uOPt0aUoDOXuBAhZURLZfbsogpWiE6bdB8N0nHTwk2WG2PPIC5Z99UdDivcP5ZeSPAkUw=='
},
'security': {
'authnRequestsSigned': False,
'failOnAuthnContextMismatch': False,
'logoutRequestSigned': False,
'logoutResponseSigned': False,
'metadataCacheDuration': None,
'metadataValidUntil': None,
'nameIdEncrypted': False,
'requestedAuthnContext': False,
'requestedAuthnContextComparison': 'exact',
'signMetadata': False,
'signatureAlgorithm':
'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
'wantAssertionsEncrypted': False,
'wantAssertionsSigned': False,
'wantAttributeStatement': False,
'wantMessagesSigned': False,
'wantNameId': True,
'wantNameIdEncrypted': False,
'digestAlgorithm':
'http://www.w3.org/2001/04/xmlenc#sha256'
},
},
# mappings
"mappings": {
# invenio #origin
"email": "email",
"name": "username",
"surname": "full_name",
"external_id": "external_id",
# Custom
# 'org_id': 'urn:oid:CO-ORGUNITID', # orgunitid
# 'org_name': 'urn:oid:CO-ORGUNITNAME', # orgunitname
# 'identifier': 'urn:oid:CO-IDENTNR-C-oid' # oid:CO-IDENTNR-C-oid
},
# remove this line
'acs_handler': acs_handler_factory('onelogin'),
},
}
# Blueprint and routes default configuration
SSO_SAML_DEFAULT_BLUEPRINT_PREFIX = '/shibboleth'
"""Base URL for the extensions endpoint."""
SSO_SAML_DEFAULT_METADATA_ROUTE = '/metadata/<idp>'
"""URL route for the metadata request."""
"""This is also SP entityID https://domain/shibboleth/metadata/<idp>"""
SSO_SAML_DEFAULT_SSO_ROUTE = '/login/<idp>'
"""URL route for the SP login."""
SSO_SAML_DEFAULT_ACS_ROUTE = '/authorized/<idp>'
"""URL route to handle the IdP login request."""
SSO_SAML_DEFAULT_SLO_ROUTE = '/slo/<idp>'
"""URL route for the SP logout."""
SSO_SAML_DEFAULT_SLS_ROUTE = '/sls/<idp>'
"""URL route to handle the IdP logout request."""