From 63884e696b16e3ee15ab559034169f4dba3c3cc3 Mon Sep 17 00:00:00 2001 From: Herbert Kruitbosch Date: Tue, 28 Nov 2017 15:39:28 +0100 Subject: [PATCH] readme --- README.md | 120 +++++++++++++++++- .../management/commands/settings_template.py | 2 +- 2 files changed, 119 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 15e27c0..1c0d7bd 100755 --- a/README.md +++ b/README.md @@ -102,6 +102,122 @@ secure. Then you can use django-admin to complete the settings with SAML2 metadata, inclusing a private key and x509 certificate. Run the following and **append** the output to `rugwebsite/settings.py` - PYTHONPATH=. DJANGO_SETTINGS_MODULE=settings django-admin init-saml2-settings --country NL --city Groningen --organisation 'University of Groningen' --organisation-unit 'Research and Innovation Support' --common-name 'cosmo.service.rug.nl/rugwebsite' --state Groningen --support-name 'Research and Innovation Support' --support-email 'ris@list.rug.nl' --technical-name 'Research and Innovation Support' --technical-email 'ris@list.rug.nl' --base-url 'cosmo.service.rug.nl' --entity-id 'www.rug.nl/cosmo' + PYTHONPATH=. DJANGO_SETTINGS_MODULE=settings django-admin init-saml2-settings --country NL --city Groningen \ + --organisation 'University of Groningen' --organisation-unit 'Research and Innovation Support' \ + --common-name 'cosmo.service.rug.nl' --state Groningen \ + --support-name 'Research and Innovation Support' --support-email 'ris@list.rug.nl' \ + --technical-name 'Research and Innovation Support' --technical-email 'ris@list.rug.nl' \ + --base-url 'https://cosmo.service.rug.nl' --entity-id 'https://www.rug.nl/cosmo' -You can change these settings if you like. \ No newline at end of file +You can change these settings if you like. Make sure to choose these correctly for your situation: + + * entity-id + * common-name + * base-url, including http or https and a prefix to all paths, make sure base-url + "/sso/saml/metadata?provider=RuG" + is a working url. + * support-name, support-email, technical-name, technical-email + +### Database and static files + + Create the database + + PYTHONPATH=. DJANGO_SETTINGS_MODULE=settings django-admin migrate + + And collect all static files (javascript, css, etc). Recall what the absolute path of rugwebsite/static is. + + PYTHONPATH=. DJANGO_SETTINGS_MODULE=settings django-admin collectstatic + +### Host the website using Gunicorn + +Create a `rugwebsite/wsgi.py` + + import os, sys + + sys.path.insert(0, 'absolute-path-to/rugwebsite/venv/lib/python3.5/site-packages/') + sys.path.insert(0, 'absolute-path-to/rugwebsite/venv/lib64/python3.5/site-packages/') + sys.path.insert(0, 'absolute-path-to/rugwebsite/') + + from django.core.wsgi import get_wsgi_application + os.environ.setdefault("DJANGO_SETTINGS_MODULE", "settings") + + application = get_wsgi_application() + +You can test-run the website with gunicorn like, but it won't host the static files (javascript, css, etc). Decide on +what port it should run, for example `8890`. + + absolute-path-to/rugwebsite/venv/bin/gunicorn --bind 127.0.0.1:8890 wsgi + +you can run this in a `sceen`, but it might be better to create a service like, in centos you create a +`/usr/lib/systemd/system/yourwebsite.service` like this + + [Unit] + Description=your website gunicorn deamon description + After=network.target + + [Service] + PIDFile=/run/gunicorn/yourwebsitepid + User=cosmo + Group=cosmo + RuntimeDirectory=gunicorn + WorkingDirectory=/home/cosmo/rug-website/ + ExecStart=absolute-path-to/rugwebsite/venv/bin/gunicorn --pid /run/gunicorn/yourwebsitepid --bind 127.0.0.1:8890 wsgi + ExecReload=/bin/kill -s HUP $MAINPID + ExecStop=/bin/kill -s TERM $MAINPID + PrivateTmp=true + + [Install] + WantedBy=multi-user.target + +You can start your service using `sudo service yourwebsite start` (or `restart`, `status`, `stop`, ...) + +### nginx proxy + +You can use nginx to proxy your website, and add https-support (instead of plain http), but also to server the static +files efficiently. Make sure nginx is installed and configure the website, for example by creating the +`/etc/nginx/conf.d/yourwebsite.conf` file on centos: + +# Make sure the port matches +upstream yourwebsiteupstream { + server 127.0.0.1:8890; +} + +# Forward http to https +server { + listen 80; + server_name cosmo.service.rug.nl; + return 301 https://$host$request_uri; +} + +server { + client_max_body_size 64M; + proxy_connect_timeout 300; + proxy_send_timeout 300; + proxy_read_timeout 300; + send_timeout 300; + listen 443 ssl; + server_name cosmo.service.rug.nl; + ssl_certificate /etc/nginx/conf.d/cosmo.service.rug.nl.pem; + ssl_certificate_key /etc/nginx/conf.d/cosmo.service.rug.nl.key; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; + ssl_prefer_server_ciphers on; + ssl_dhparam /etc/nginx/conf.d/dhparams.pem; + + location = /favicon.ico { access_log off; log_not_found off; } + location /static/ { + alias absolute-path-to/rugwebsite/static/; + } + + location / { + proxy_pass http://yourwebsiteupstream/; + proxy_set_header Host cosmo.service.rug.nl; + proxy_set_header X-Forwarded-For $remote_addr; + + # This setting is important, it allows SAML2 to verify the provider url, whithout getting into trouble because + # the https-part is handled by nginx, and hence not seen by the django SAML2 code. + proxy_set_header X_FORWARDED_PROTO https; + } +} + +Restart nginx to load the settings `sudo service nginx restart` (or `reload`, to only reload the settings instaed of a +full restart) diff --git a/rugwebsite/management/commands/settings_template.py b/rugwebsite/management/commands/settings_template.py index 9eb44ab..bd9f1e6 100644 --- a/rugwebsite/management/commands/settings_template.py +++ b/rugwebsite/management/commands/settings_template.py @@ -99,7 +99,7 @@ SAML_PROVIDERS = [{{ "organization": {{ "en-US": {{ "name": ORGANISATION, - "displayname": ORGANISATION, + "displayname": ORGANISATION + " / " + ORGANISATION_UNIT, "url": BASE_URL }} }},