Imported all shibboleth stuff from openstack-test05
This commit is contained in:
Egon Rijpkema
parent
c6c947ce3c
commit
167d755724
8
keystone/.gitignore
vendored
8
keystone/.gitignore
vendored
@ -1,8 +0,0 @@
|
||||
# ---> Vim
|
||||
[._]*.s[a-w][a-z]
|
||||
[._]s[a-w][a-z]
|
||||
*.un~
|
||||
Session.vim
|
||||
.netrwhist
|
||||
*~
|
||||
|
||||
@ -13,16 +13,36 @@ RUN set -x \
|
||||
&& apt-get -y update \
|
||||
&& apt-get -y install \
|
||||
&& apt-get -y install keystone python-openstackclient \
|
||||
&& apt-get -y install libapache2-mod-shib2 \
|
||||
&& apt-get -y clean
|
||||
|
||||
# set admin token TODO: make this a secret
|
||||
# in volume of met env
|
||||
COPY keystone.conf /etc/keystone/keystone.conf
|
||||
|
||||
COPY apache-keystone.conf /etc/apache2/sites-available/keystone.conf
|
||||
|
||||
COPY shibboleth2.xml /etc/shibboleth/shibboleth2.xml
|
||||
COPY attribute-map.xml /etc/shibboleth/attribute-map.xml
|
||||
COPY attribute-policy.xml /etc/shibboleth/attribute-policy.xml
|
||||
|
||||
COPY sso_callback_template.html /etc/keystone/sso_callback_template.html
|
||||
|
||||
RUN mkdir /var/run/shibboleth
|
||||
|
||||
COPY run.sh /etc/run.sh
|
||||
|
||||
RUN mkdir /etc/keystone/fernet-keys
|
||||
|
||||
RUN chown keystone: /etc/keystone/fernet-keys
|
||||
|
||||
RUN a2enmod shib2
|
||||
|
||||
COPY bootstrap.sh /etc/bootstrap.sh
|
||||
|
||||
CMD apachectl -DFOREGROUND
|
||||
# Testing only!!!
|
||||
RUN mkdir -p /var/www/html/secure
|
||||
RUN apt-get -y install php libapache2-mod-php
|
||||
COPY test.php /var/www/html/secure/test.php
|
||||
|
||||
CMD /etc/run.sh
|
||||
|
||||
126
keystone/apache-keystone.conf
Normal file
126
keystone/apache-keystone.conf
Normal file
@ -0,0 +1,126 @@
|
||||
LoadModule ssl_module modules/mod_ssl.so
|
||||
|
||||
Listen 5000
|
||||
Listen 35357
|
||||
|
||||
<Location /secure>
|
||||
AuthType shibboleth
|
||||
ShibRequestSetting requireSession 1
|
||||
require valid-user
|
||||
</Location>
|
||||
|
||||
Alias "/secure" "/var/www/html/secure"
|
||||
|
||||
<VirtualHost *:5000>
|
||||
ServerName https://merlin.hpc.rug.nl:5000
|
||||
SSLEngine on
|
||||
SSLCertificateFile "/certs/merlin.hpc.rug.nl.crt"
|
||||
SSLCertificateKeyFile "/certs/merlin.hpc.rug.nl.key"
|
||||
UseCanonicalName On
|
||||
WSGIScriptAlias / /usr/bin/keystone-wsgi-public
|
||||
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
|
||||
WSGIProcessGroup keystone-public
|
||||
WSGIApplicationGroup %{GLOBAL}
|
||||
WSGIPassAuthorization On
|
||||
LimitRequestBody 114688
|
||||
|
||||
# Added for federation.
|
||||
WSGIScriptAliasMatch ^(/v3/OS-FEDERATION/identity_providers/.*?/protocols/.*?/auth)$ /usr/local/bin/keystone-wsgi-public/$1
|
||||
|
||||
<IfVersion >= 2.4>
|
||||
ErrorLogFormat "%{cu}t %M"
|
||||
</IfVersion>
|
||||
|
||||
ErrorLog /var/log/apache2/keystone.log
|
||||
CustomLog /var/log/apache2/keystone_access.log combined
|
||||
|
||||
<Directory /usr/bin>
|
||||
<IfVersion >= 2.4>
|
||||
Require all granted
|
||||
</IfVersion>
|
||||
<IfVersion < 2.4>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</IfVersion>
|
||||
</Directory>
|
||||
|
||||
<Location /Shibboleth.sso>
|
||||
SetHandler shib
|
||||
</Location>
|
||||
|
||||
<Location /v3/OS-FEDERATION/identity_providers/nikhefwave/protocols/mapped/auth>
|
||||
ShibRequestSetting requireSession 1
|
||||
AuthType shibboleth
|
||||
ShibExportAssertion Off
|
||||
Require valid-user
|
||||
|
||||
<IfVersion < 2.4>
|
||||
ShibRequireSession On
|
||||
ShibRequireAll On
|
||||
</IfVersion>
|
||||
</Location>
|
||||
|
||||
<Location ~ "/v3/auth/OS-FEDERATION/websso/mapped">
|
||||
AuthType shibboleth
|
||||
Require valid-user
|
||||
ShibRequestSetting requireSession 1
|
||||
ShibRequireSession On
|
||||
ShibExportAssertion Off
|
||||
</Location>
|
||||
<Location ~ "/v3/auth/OS-FEDERATION/identity_providers/nikhefwave/protocols/mapped/websso/">
|
||||
AuthType shibboleth
|
||||
Require valid-user
|
||||
</Location>
|
||||
|
||||
</VirtualHost>
|
||||
|
||||
<VirtualHost *:35357>
|
||||
ServerName https://merlin.hpc.rug.nl:35357
|
||||
SSLEngine on
|
||||
SSLCertificateFile "/certs/merlin.hpc.rug.nl.crt"
|
||||
SSLCertificateKeyFile "/certs/merlin.hpc.rug.nl.key"
|
||||
UseCanonicalName On
|
||||
WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
|
||||
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
|
||||
WSGIProcessGroup keystone-admin
|
||||
WSGIApplicationGroup %{GLOBAL}
|
||||
WSGIPassAuthorization On
|
||||
LimitRequestBody 114688
|
||||
|
||||
<IfVersion >= 2.4>
|
||||
ErrorLogFormat "%{cu}t %M"
|
||||
</IfVersion>
|
||||
|
||||
ErrorLog /var/log/apache2/keystone.log
|
||||
CustomLog /var/log/apache2/keystone_access.log combined
|
||||
|
||||
<Directory /usr/bin>
|
||||
<IfVersion >= 2.4>
|
||||
Require all granted
|
||||
</IfVersion>
|
||||
<IfVersion < 2.4>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</IfVersion>
|
||||
</Directory>
|
||||
</VirtualHost>
|
||||
|
||||
Alias /identity /usr/bin/keystone-wsgi-public
|
||||
<Location /identity>
|
||||
SetHandler wsgi-script
|
||||
Options +ExecCGI
|
||||
|
||||
WSGIProcessGroup keystone-public
|
||||
WSGIApplicationGroup %{GLOBAL}
|
||||
WSGIPassAuthorization On
|
||||
</Location>
|
||||
|
||||
Alias /identity_admin /usr/bin/keystone-wsgi-admin
|
||||
<Location /identity_admin>
|
||||
SetHandler wsgi-script
|
||||
Options +ExecCGI
|
||||
|
||||
WSGIProcessGroup keystone-admin
|
||||
WSGIApplicationGroup %{GLOBAL}
|
||||
WSGIPassAuthorization On
|
||||
</Location>
|
||||
30
keystone/attribute-map.xml
Normal file
30
keystone/attribute-map.xml
Normal file
@ -0,0 +1,30 @@
|
||||
<?xml version="1.0"?>
|
||||
|
||||
|
||||
|
||||
<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
||||
<Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" id="persistent-id">
|
||||
<AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$Name" defaultQualifiers="true"/>
|
||||
</Attribute>
|
||||
<Attribute name="eduPersonPrincipalName" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="eppn"/>
|
||||
|
||||
<!-- Added for nikhef -->
|
||||
<Attribute name="openstackGroupEntitlements" id="openstackGroupEntitlements" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"/>
|
||||
|
||||
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-user"/>
|
||||
<Attribute name="urn:oid:2.5.4.4" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-surName"/>
|
||||
<Attribute name="urn:oid:2.5.4.42" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-givenName"/>
|
||||
<Attribute name="urn:oid:2.5.4.3" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-commonName"/>
|
||||
<Attribute name="urn:oid:2.16.840.1.113730.3.1.241" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-displayName"/>
|
||||
<Attribute name="urn:oid:0.9.2342.19200300.100.1.3" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-email"/>
|
||||
<Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.9" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-HomeOrg"/>
|
||||
<Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.10" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-HomeOrgType"/>
|
||||
<Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.14" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-PersonalUnqiueCode"/>
|
||||
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-Affiliation"/>
|
||||
<Attribute name="urn:oid:1.3.6.1.4.1.1466.115.121.1.15" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-ScopedAffiliation"/>
|
||||
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-Entitlement"/>
|
||||
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-eduPersonPN"/>
|
||||
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-memberOf"/>
|
||||
<Attribute name="urn:oid:0.9.2342.19200300.100.1.1" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-uid"/>
|
||||
<Attribute name="urn:oid:2.16.840.1.113730.3.1.39" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="Shib-language"/>
|
||||
</Attributes>
|
||||
71
keystone/attribute-policy.xml
Normal file
71
keystone/attribute-policy.xml
Normal file
@ -0,0 +1,71 @@
|
||||
<afp:AttributeFilterPolicyGroup
|
||||
xmlns="urn:mace:shibboleth:2.0:afp:mf:basic"
|
||||
xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml"
|
||||
xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"
|
||||
xmlns:afp="urn:mace:shibboleth:2.0:afp"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
||||
|
||||
<!-- Shared rule for affiliation values. -->
|
||||
<afp:PermitValueRule id="eduPersonAffiliationValues" xsi:type="OR">
|
||||
<Rule xsi:type="AttributeValueString" value="faculty"/>
|
||||
<Rule xsi:type="AttributeValueString" value="student"/>
|
||||
<Rule xsi:type="AttributeValueString" value="staff"/>
|
||||
<Rule xsi:type="AttributeValueString" value="alum"/>
|
||||
<Rule xsi:type="AttributeValueString" value="member"/>
|
||||
<Rule xsi:type="AttributeValueString" value="affiliate"/>
|
||||
<Rule xsi:type="AttributeValueString" value="employee"/>
|
||||
<Rule xsi:type="AttributeValueString" value="library-walk-in"/>
|
||||
</afp:PermitValueRule>
|
||||
|
||||
<!--
|
||||
Shared rule for all "scoped" attributes, but you'll have to manually apply it inside
|
||||
an AttributeRule for each attribute you want to check.
|
||||
-->
|
||||
<afp:PermitValueRule id="ScopingRules" xsi:type="basic:ANY"/>
|
||||
<!-- # Hacked for Nikhef federation
|
||||
<afp:PermitValueRule id="ScopingRules" xsi:type="AND">
|
||||
<Rule xsi:type="NOT">
|
||||
<Rule xsi:type="AttributeValueRegex" regex="@"/>
|
||||
</Rule>
|
||||
<Rule xsi:type="saml:AttributeScopeMatchesShibMDScope"/>
|
||||
</afp:PermitValueRule>
|
||||
-->
|
||||
<afp:AttributeFilterPolicy>
|
||||
<!-- This policy is in effect in all cases. -->
|
||||
<afp:PolicyRequirementRule xsi:type="ANY"/>
|
||||
|
||||
<!-- Filter out undefined affiliations and ensure only one primary. -->
|
||||
<afp:AttributeRule attributeID="affiliation">
|
||||
<afp:PermitValueRule xsi:type="AND">
|
||||
<RuleReference ref="eduPersonAffiliationValues"/>
|
||||
<RuleReference ref="ScopingRules"/>
|
||||
</afp:PermitValueRule>
|
||||
</afp:AttributeRule>
|
||||
<afp:AttributeRule attributeID="unscoped-affiliation">
|
||||
<afp:PermitValueRuleReference ref="eduPersonAffiliationValues"/>
|
||||
</afp:AttributeRule>
|
||||
<afp:AttributeRule attributeID="primary-affiliation">
|
||||
<afp:PermitValueRuleReference ref="eduPersonAffiliationValues"/>
|
||||
</afp:AttributeRule>
|
||||
|
||||
<afp:AttributeRule attributeID="eppn">
|
||||
<afp:PermitValueRuleReference ref="ScopingRules"/>
|
||||
</afp:AttributeRule>
|
||||
|
||||
<afp:AttributeRule attributeID="targeted-id">
|
||||
<afp:PermitValueRuleReference ref="ScopingRules"/>
|
||||
</afp:AttributeRule>
|
||||
|
||||
<!-- Require NameQualifier/SPNameQualifier match IdP and SP entityID respectively. -->
|
||||
<afp:AttributeRule attributeID="persistent-id">
|
||||
<afp:PermitValueRule xsi:type="saml:NameIDQualifierString"/>
|
||||
</afp:AttributeRule>
|
||||
|
||||
<!-- Catch-all that passes everything else through unmolested. -->
|
||||
<afp:AttributeRule attributeID="*">
|
||||
<afp:PermitValueRule xsi:type="ANY"/>
|
||||
</afp:AttributeRule>
|
||||
|
||||
</afp:AttributeFilterPolicy>
|
||||
|
||||
</afp:AttributeFilterPolicyGroup>
|
||||
@ -1,6 +1,7 @@
|
||||
[DEFAULT]
|
||||
|
||||
verbose = true
|
||||
log_file = /var/log/keystone/keystone.log
|
||||
|
||||
[database]
|
||||
connection = mysql+pymysql://keystone:keystone@mariadb/keystone
|
||||
@ -8,5 +9,15 @@ connection = mysql+pymysql://keystone:keystone@mariadb/keystone
|
||||
[token]
|
||||
provider = fernet
|
||||
|
||||
[auth]
|
||||
methods = password,token,mapped,openid,saml2
|
||||
|
||||
[federation]
|
||||
trusted_dashboard = http://merlin.hpc.rug.nl/horizon/auth/websso/
|
||||
sso_calback_template = /etc/keystone/sso_calback_template.html
|
||||
|
||||
[mapped]
|
||||
remote_id_attribute = Shib-Identity-Provider
|
||||
|
||||
[identity]
|
||||
default_domain_id = default
|
||||
|
||||
252
keystone/routers.py
Normal file
252
keystone/routers.py
Normal file
@ -0,0 +1,252 @@
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
import functools
|
||||
|
||||
from keystone.common import json_home
|
||||
from keystone.common import wsgi
|
||||
from keystone.federation import controllers
|
||||
|
||||
|
||||
build_resource_relation = functools.partial(
|
||||
json_home.build_v3_extension_resource_relation,
|
||||
extension_name='OS-FEDERATION', extension_version='1.0')
|
||||
|
||||
build_parameter_relation = functools.partial(
|
||||
json_home.build_v3_extension_parameter_relation,
|
||||
extension_name='OS-FEDERATION', extension_version='1.0')
|
||||
|
||||
IDP_ID_PARAMETER_RELATION = build_parameter_relation(parameter_name='idp_id')
|
||||
PROTOCOL_ID_PARAMETER_RELATION = build_parameter_relation(
|
||||
parameter_name='protocol_id')
|
||||
SP_ID_PARAMETER_RELATION = build_parameter_relation(parameter_name='sp_id')
|
||||
|
||||
|
||||
class Routers(wsgi.RoutersBase):
|
||||
"""API Endpoints for the Federation extension.
|
||||
|
||||
The API looks like::
|
||||
|
||||
PUT /OS-FEDERATION/identity_providers/{idp_id}
|
||||
GET /OS-FEDERATION/identity_providers
|
||||
GET /OS-FEDERATION/identity_providers/{idp_id}
|
||||
DELETE /OS-FEDERATION/identity_providers/{idp_id}
|
||||
PATCH /OS-FEDERATION/identity_providers/{idp_id}
|
||||
|
||||
PUT /OS-FEDERATION/identity_providers/
|
||||
{idp_id}/protocols/{protocol_id}
|
||||
GET /OS-FEDERATION/identity_providers/
|
||||
{idp_id}/protocols
|
||||
GET /OS-FEDERATION/identity_providers/
|
||||
{idp_id}/protocols/{protocol_id}
|
||||
PATCH /OS-FEDERATION/identity_providers/
|
||||
{idp_id}/protocols/{protocol_id}
|
||||
DELETE /OS-FEDERATION/identity_providers/
|
||||
{idp_id}/protocols/{protocol_id}
|
||||
|
||||
PUT /OS-FEDERATION/mappings
|
||||
GET /OS-FEDERATION/mappings
|
||||
PATCH /OS-FEDERATION/mappings/{mapping_id}
|
||||
GET /OS-FEDERATION/mappings/{mapping_id}
|
||||
DELETE /OS-FEDERATION/mappings/{mapping_id}
|
||||
|
||||
GET /OS-FEDERATION/projects
|
||||
GET /OS-FEDERATION/domains
|
||||
|
||||
PUT /OS-FEDERATION/service_providers/{sp_id}
|
||||
GET /OS-FEDERATION/service_providers
|
||||
GET /OS-FEDERATION/service_providers/{sp_id}
|
||||
DELETE /OS-FEDERATION/service_providers/{sp_id}
|
||||
PATCH /OS-FEDERATION/service_providers/{sp_id}
|
||||
|
||||
GET /OS-FEDERATION/identity_providers/{idp_id}/
|
||||
protocols/{protocol_id}/auth
|
||||
POST /OS-FEDERATION/identity_providers/{idp_id}/
|
||||
protocols/{protocol_id}/auth
|
||||
GET /auth/OS-FEDERATION/identity_providers/
|
||||
{idp_id}/protocols/{protocol_id}/websso
|
||||
?origin=https%3A//horizon.example.com
|
||||
POST /auth/OS-FEDERATION/identity_providers/
|
||||
{idp_id}/protocols/{protocol_id}/websso
|
||||
?origin=https%3A//horizon.example.com
|
||||
|
||||
|
||||
POST /auth/OS-FEDERATION/saml2
|
||||
POST /auth/OS-FEDERATION/saml2/ecp
|
||||
GET /OS-FEDERATION/saml2/metadata
|
||||
|
||||
GET /auth/OS-FEDERATION/websso/{protocol_id}
|
||||
?origin=https%3A//horizon.example.com
|
||||
|
||||
POST /auth/OS-FEDERATION/websso/{protocol_id}
|
||||
?origin=https%3A//horizon.example.com
|
||||
|
||||
"""
|
||||
|
||||
def _construct_url(self, suffix):
|
||||
return "/OS-FEDERATION/%s" % suffix
|
||||
|
||||
def append_v3_routers(self, mapper, routers):
|
||||
auth_controller = controllers.Auth()
|
||||
idp_controller = controllers.IdentityProvider()
|
||||
protocol_controller = controllers.FederationProtocol()
|
||||
mapping_controller = controllers.MappingController()
|
||||
project_controller = controllers.ProjectAssignmentV3()
|
||||
domain_controller = controllers.DomainV3()
|
||||
saml_metadata_controller = controllers.SAMLMetadataV3()
|
||||
sp_controller = controllers.ServiceProvider()
|
||||
|
||||
# Identity Provider CRUD operations
|
||||
|
||||
self._add_resource(
|
||||
mapper, idp_controller,
|
||||
path=self._construct_url('identity_providers/{idp_id}'),
|
||||
get_action='get_identity_provider',
|
||||
put_action='create_identity_provider',
|
||||
patch_action='update_identity_provider',
|
||||
delete_action='delete_identity_provider',
|
||||
rel=build_resource_relation(resource_name='identity_provider'),
|
||||
path_vars={
|
||||
'idp_id': IDP_ID_PARAMETER_RELATION,
|
||||
})
|
||||
self._add_resource(
|
||||
mapper, idp_controller,
|
||||
path=self._construct_url('identity_providers'),
|
||||
get_action='list_identity_providers',
|
||||
rel=build_resource_relation(resource_name='identity_providers'))
|
||||
|
||||
# Protocol CRUD operations
|
||||
|
||||
self._add_resource(
|
||||
mapper, protocol_controller,
|
||||
path=self._construct_url('identity_providers/{idp_id}/protocols/'
|
||||
'{protocol_id}'),
|
||||
get_action='get_protocol',
|
||||
put_action='create_protocol',
|
||||
patch_action='update_protocol',
|
||||
delete_action='delete_protocol',
|
||||
rel=build_resource_relation(
|
||||
resource_name='identity_provider_protocol'),
|
||||
path_vars={
|
||||
'idp_id': IDP_ID_PARAMETER_RELATION,
|
||||
'protocol_id': PROTOCOL_ID_PARAMETER_RELATION,
|
||||
})
|
||||
self._add_resource(
|
||||
mapper, protocol_controller,
|
||||
path=self._construct_url('identity_providers/{idp_id}/protocols'),
|
||||
get_action='list_protocols',
|
||||
rel=build_resource_relation(
|
||||
resource_name='identity_provider_protocols'),
|
||||
path_vars={
|
||||
'idp_id': IDP_ID_PARAMETER_RELATION,
|
||||
})
|
||||
|
||||
# Mapping CRUD operations
|
||||
|
||||
self._add_resource(
|
||||
mapper, mapping_controller,
|
||||
path=self._construct_url('mappings/{mapping_id}'),
|
||||
get_action='get_mapping',
|
||||
put_action='create_mapping',
|
||||
patch_action='update_mapping',
|
||||
delete_action='delete_mapping',
|
||||
rel=build_resource_relation(resource_name='mapping'),
|
||||
path_vars={
|
||||
'mapping_id': build_parameter_relation(
|
||||
parameter_name='mapping_id'),
|
||||
})
|
||||
self._add_resource(
|
||||
mapper, mapping_controller,
|
||||
path=self._construct_url('mappings'),
|
||||
get_action='list_mappings',
|
||||
rel=build_resource_relation(resource_name='mappings'))
|
||||
|
||||
# Service Providers CRUD operations
|
||||
|
||||
self._add_resource(
|
||||
mapper, sp_controller,
|
||||
path=self._construct_url('service_providers/{sp_id}'),
|
||||
get_action='get_service_provider',
|
||||
put_action='create_service_provider',
|
||||
patch_action='update_service_provider',
|
||||
delete_action='delete_service_provider',
|
||||
rel=build_resource_relation(resource_name='service_provider'),
|
||||
path_vars={
|
||||
'sp_id': SP_ID_PARAMETER_RELATION,
|
||||
})
|
||||
|
||||
self._add_resource(
|
||||
mapper, sp_controller,
|
||||
path=self._construct_url('service_providers'),
|
||||
get_action='list_service_providers',
|
||||
rel=build_resource_relation(resource_name='service_providers'))
|
||||
|
||||
self._add_resource(
|
||||
mapper, domain_controller,
|
||||
path=self._construct_url('domains'),
|
||||
new_path='/auth/domains',
|
||||
get_action='list_domains_for_user',
|
||||
rel=build_resource_relation(resource_name='domains'))
|
||||
self._add_resource(
|
||||
mapper, project_controller,
|
||||
path=self._construct_url('projects'),
|
||||
new_path='/auth/projects',
|
||||
get_action='list_projects_for_user',
|
||||
rel=build_resource_relation(resource_name='projects'))
|
||||
|
||||
# Auth operations
|
||||
self._add_resource(
|
||||
mapper, auth_controller,
|
||||
path=self._construct_url('identity_providers/{idp_id}/'
|
||||
'protocols/{protocol_id}/auth'),
|
||||
get_post_action='federated_authentication',
|
||||
rel=build_resource_relation(
|
||||
resource_name='identity_provider_protocol_auth'),
|
||||
path_vars={
|
||||
'idp_id': IDP_ID_PARAMETER_RELATION,
|
||||
'protocol_id': PROTOCOL_ID_PARAMETER_RELATION,
|
||||
})
|
||||
self._add_resource(
|
||||
mapper, auth_controller,
|
||||
path='/auth' + self._construct_url('saml2'),
|
||||
post_action='create_saml_assertion',
|
||||
rel=build_resource_relation(resource_name='saml2'))
|
||||
self._add_resource(
|
||||
mapper, auth_controller,
|
||||
path='/auth' + self._construct_url('saml2/ecp'),
|
||||
post_action='create_ecp_assertion',
|
||||
rel=build_resource_relation(resource_name='ecp'))
|
||||
self._add_resource(
|
||||
mapper, auth_controller,
|
||||
path='/auth' + self._construct_url('websso/{protocol_id}'),
|
||||
get_post_action='federated_sso_auth',
|
||||
rel=build_resource_relation(resource_name='websso'),
|
||||
path_vars={
|
||||
'protocol_id': PROTOCOL_ID_PARAMETER_RELATION,
|
||||
})
|
||||
self._add_resource(
|
||||
mapper, auth_controller,
|
||||
path='/auth' + self._construct_url(
|
||||
'identity_providers/{idp_id}/protocols/{protocol_id}/websso'),
|
||||
get_post_action='federated_idp_specific_sso_auth',
|
||||
rel=build_resource_relation(resource_name='identity_providers'),
|
||||
path_vars={
|
||||
'idp_id': IDP_ID_PARAMETER_RELATION,
|
||||
'protocol_id': PROTOCOL_ID_PARAMETER_RELATION,
|
||||
})
|
||||
|
||||
# Keystone-Identity-Provider metadata endpoint
|
||||
self._add_resource(
|
||||
mapper, saml_metadata_controller,
|
||||
path=self._construct_url('saml2/metadata'),
|
||||
get_action='get_metadata',
|
||||
rel=build_resource_relation(resource_name='metadata'))
|
||||
20
keystone/rules.json
Normal file
20
keystone/rules.json
Normal file
@ -0,0 +1,20 @@
|
||||
[
|
||||
{
|
||||
"local": [
|
||||
{
|
||||
"group_ids": "{1}",
|
||||
"user": {
|
||||
"name": "{0}"
|
||||
}
|
||||
}
|
||||
],
|
||||
"remote": [
|
||||
{
|
||||
"type": "REMOTE_USER"
|
||||
},
|
||||
{
|
||||
"type": "openstackGroupEntitlements"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
20
keystone/run.sh
Executable file
20
keystone/run.sh
Executable file
@ -0,0 +1,20 @@
|
||||
#!/bin/bash
|
||||
# start nova compute service
|
||||
|
||||
chown keystone: /etc/keystone/fernet-keys
|
||||
chmod 700 /etc/keystone/fernet-keys
|
||||
|
||||
# Start apache
|
||||
a2enmod ssl
|
||||
apachectl -DFOREGROUND &
|
||||
|
||||
chown _shibd: /etc/shibboleth/sp*.pem
|
||||
|
||||
shibd -f -F &
|
||||
|
||||
# If any process fails, kill the rest.
|
||||
# This insures the container stops and systemd will restart it.
|
||||
|
||||
wait -n
|
||||
pkill -P $$
|
||||
|
||||
114
keystone/shibboleth2.xml
Normal file
114
keystone/shibboleth2.xml
Normal file
@ -0,0 +1,114 @@
|
||||
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
|
||||
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
|
||||
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
|
||||
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
|
||||
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
|
||||
clockSkew="180">
|
||||
|
||||
<!--
|
||||
By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
|
||||
are used. See example-shibboleth2.xml for samples of explicitly configuring them.
|
||||
-->
|
||||
|
||||
<!--
|
||||
To customize behavior for specific resources on Apache, and to link vhosts or
|
||||
resources to ApplicationOverride settings below, use web server options/commands.
|
||||
See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help.
|
||||
|
||||
For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml
|
||||
file, and the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo topic.
|
||||
-->
|
||||
|
||||
<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
|
||||
<ApplicationDefaults entityID="https://merlin.hpc.rug.nl"
|
||||
REMOTE_USER="eppn persistent-id targeted-id">
|
||||
|
||||
<!--
|
||||
Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
|
||||
You MUST supply an effectively unique handlerURL value for each of your applications.
|
||||
The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
|
||||
a relative value based on the virtual host. Using handlerSSL="true", the default, will force
|
||||
the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
|
||||
Note that while we default checkAddress to "false", this has a negative impact on the
|
||||
security of your site. Stealing sessions via cookie theft is much easier with this disabled.
|
||||
-->
|
||||
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
|
||||
checkAddress="false" handlerSSL="true" cookieProps="https">
|
||||
|
||||
<!--
|
||||
Configures SSO for a default IdP. To allow for >1 IdP, remove
|
||||
entityID property and adjust discoveryURL to point to discovery service.
|
||||
(Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)
|
||||
You can also override entityID on /Login query string, or in RequestMap/htaccess.
|
||||
-->
|
||||
<SSO entityID="https://osfedpx.nikhef.nl/simplesaml/saml2/idp/metadata.php">
|
||||
SAML2
|
||||
</SSO>
|
||||
|
||||
<!-- SAML and local-only logout. -->
|
||||
<Logout>SAML2 Local</Logout>
|
||||
|
||||
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
|
||||
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
|
||||
|
||||
<!-- Status reporting service. -->
|
||||
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
|
||||
|
||||
<!-- Session diagnostic service. -->
|
||||
<Handler type="Session" Location="/Session" showAttributeValues="false"/>
|
||||
|
||||
<!-- JSON feed of discovery information. -->
|
||||
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
|
||||
</Sessions>
|
||||
|
||||
<!--
|
||||
Allows overriding of error template information/filenames. You can
|
||||
also add attributes with values that can be plugged into the templates.
|
||||
-->
|
||||
<Errors supportContact="root@localhost"
|
||||
helpLocation="/about.html"
|
||||
styleSheet="/shibboleth-sp/main.css"/>
|
||||
|
||||
<!-- Example of remotely supplied batch of signed metadata. -->
|
||||
<MetadataProvider type="XML" uri="https://osfedpx.nikhef.nl/simplesaml/saml2/idp/metadata.php"
|
||||
backingFilePath="federation-metadata.xml" reloadInterval="7200">
|
||||
</MetadataProvider>
|
||||
|
||||
<!-- Example of locally maintained metadata. -->
|
||||
<!--
|
||||
<MetadataProvider type="XML" file="partner-metadata.xml"/>
|
||||
-->
|
||||
|
||||
<!-- Map to extract attributes from SAML assertions. -->
|
||||
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
|
||||
|
||||
<!-- Use a SAML query if no attributes are supplied during SSO. -->
|
||||
<AttributeResolver type="Query" subjectMatch="true"/>
|
||||
|
||||
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
|
||||
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
|
||||
|
||||
<!-- Simple file-based resolver for using a single keypair. -->
|
||||
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
|
||||
|
||||
<!--
|
||||
The default settings can be overridden by creating ApplicationOverride elements (see
|
||||
the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic).
|
||||
Resource requests are mapped by web server commands, or the RequestMapper, to an
|
||||
applicationId setting.
|
||||
|
||||
Example of a second application (for a second vhost) that has a different entityID.
|
||||
Resources on the vhost would map to an applicationId of "admin":
|
||||
-->
|
||||
<!--
|
||||
<ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
|
||||
-->
|
||||
</ApplicationDefaults>
|
||||
|
||||
<!-- Policies that determine how to process and authenticate runtime messages. -->
|
||||
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
|
||||
|
||||
<!-- Low-level configuration about protocols and bindings available for use. -->
|
||||
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
|
||||
|
||||
</SPConfig>
|
||||
22
keystone/sso_callback_template.html
Normal file
22
keystone/sso_callback_template.html
Normal file
@ -0,0 +1,22 @@
|
||||
<!DOCTYPE html>
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<title>Keystone WebSSO redirect</title>
|
||||
</head>
|
||||
<body>
|
||||
<form id="sso" name="sso" action="$host" method="post">
|
||||
Please wait...
|
||||
<br/>
|
||||
<input type="hidden" name="token" id="token" value="$token"/>
|
||||
<noscript>
|
||||
<input type="submit" name="submit_no_javascript" id="submit_no_javascript"
|
||||
value="If your JavaScript is disabled, please click to continue"/>
|
||||
</noscript>
|
||||
</form>
|
||||
<script type="text/javascript">
|
||||
window.onload = function() {
|
||||
document.forms['sso'].submit();
|
||||
}
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
4
keystone/test.php
Normal file
4
keystone/test.php
Normal file
@ -0,0 +1,4 @@
|
||||
<html>
|
||||
<head><title>Shibboleth test</title></head>
|
||||
<body><pre><?php print_r($_SERVER); ?></pre></body>
|
||||
</html>
|
||||
Loading…
Reference in New Issue
Block a user