Skip to content

Commit 74094be

Browse files
author
Masaharu Hayashi
committed
update shibboleth configuration
1 parent cf03850 commit 74094be

File tree

9 files changed

+569
-623
lines changed

9 files changed

+569
-623
lines changed

‎modules/weko-accounts/weko_accounts/config.py‎

Lines changed: 35 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@
3838
WEKO_ACCOUNTS_SECURITY_REGISTER_USER_TEMPLATE = 'weko_accounts/register_user.html'
3939
"""Default template for user registration."""
4040

41+
WEKO_ACCOUNTS_SECURITY_LOGIN_LOCAL_SHIB_TEMPLATE = 'weko_accounts/' \
42+
'login_shibuser_pattern_0.html'
43+
"""Shibboleth template for login."""
44+
4145
WEKO_ACCOUNTS_SECURITY_LOGIN_SHIB_USER_TEMPLATE = 'weko_accounts/' \
4246
'login_shibuser_pattern_1.html'
4347
"""Shibboleth template for login."""
@@ -76,9 +80,15 @@
7680
}
7781
"""IdP attribute map."""
7882

83+
# WEKO_ACCOUNTS_ATTRIBUTE_MAP = {
84+
# 'shib_eppn': 'eppn',
85+
# 'shib_role_authority_name': 'eduPersonAffiliation',
86+
# 'shib_mail': 'mail',
87+
# 'shib_user_name': 'DisplayName'
88+
# }
7989
WEKO_ACCOUNTS_ATTRIBUTE_MAP = {
8090
'shib_eppn': 'eppn',
81-
'shib_role_authority_name': 'eduPersonAffiliation',
91+
'shib_role_authority_name': 'HTTP_WEKOSOCIETYAFFILIATION',
8292
'shib_mail': 'mail',
8393
'shib_user_name': 'DisplayName'
8494
}
@@ -143,12 +153,18 @@
143153
}
144154
"""Extra Default role."""
145155

156+
# WEKO_ACCOUNTS_SHIB_ROLE_RELATION = {
157+
# '管理者': 'System Administrator',
158+
# '学認IdP': WEKO_ACCOUNTS_GAKUNIN_ROLE['defaultRole'],
159+
# '機関内のOrthros': WEKO_ACCOUNTS_ORTHROS_INSIDE_ROLE['defaultRole'],
160+
# '機関外のOrthros': WEKO_ACCOUNTS_ORTHROS_OUTSIDE_ROLE['defaultRole'],
161+
# 'その他': WEKO_ACCOUNTS_EXTRA_ROLE['defaultRole']
162+
# }
146163
WEKO_ACCOUNTS_SHIB_ROLE_RELATION = {
147164
'管理者': 'System Administrator',
148-
'学認IdP': WEKO_ACCOUNTS_GAKUNIN_ROLE['defaultRole'],
149-
'機関内のOrthros': WEKO_ACCOUNTS_ORTHROS_INSIDE_ROLE['defaultRole'],
150-
'機関外のOrthros': WEKO_ACCOUNTS_ORTHROS_OUTSIDE_ROLE['defaultRole'],
151-
'その他': WEKO_ACCOUNTS_EXTRA_ROLE['defaultRole']
165+
'図書館員': 'Repository Administrator',
166+
'教員': 'Contributor',
167+
'教官': 'Contributor'
152168
}
153169
"""Role relation."""
154170

@@ -190,7 +206,7 @@
190206
"""Default rate limit per endpoint for one user in the WEKO API."""
191207

192208

193-
WEKO_ACCOUNTS_SKIP_CONFIRMATION_PAGE = True
209+
WEKO_ACCOUNTS_SKIP_CONFIRMATION_PAGE = False
194210
"""Skip shibboleth confirmation page."""
195211

196212
WEKO_ACCOUNTS_IDP_ENTITY_ID = ''
@@ -233,4 +249,16 @@
233249
"""Length of Shibboleth user name without hash value."""
234250

235251
WEKO_ACCOUNTS_GAKUNIN_MAP_BASE_URL = 'https://cg.gakunin.jp'
236-
"""Base URL for Gakunin mAP."""
252+
"""Base URL for Gakunin mAP."""
253+
254+
WEKO_ACCOUNTS_WAYF_URL ="https://test-ds.gakunin.nii.ac.jp/WAYF";
255+
"""URL for WAYF."""
256+
257+
WEKO_ACCOUNTS_WAYF_ADDITIONAL_IDPS = [{"name":"Orthros-Test","entityID":"https://core-stg.orthros.gakunin.nii.ac.jp/idp"}]
258+
"" "Additional IdPs for WAYF."""
259+
260+
WEKO_ACCOUNTS_DEFAULT_IDP =""
261+
"""Default IdP for WAYF."""
262+
263+
WEKO_ACCOUNTS_SET_SHIB_TEMPLATE = 'weko_accounts/gakunin.html'
264+
""" template for gakunin login."""

‎modules/weko-accounts/weko_accounts/ext.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,11 @@ def init_config(self, app):
100100
app.config['SECURITY_LOGIN_USER_TEMPLATE'] = \
101101
app.config[
102102
'WEKO_ACCOUNTS_SECURITY_LOGIN_SHIB_USER_TEMPLATE']
103+
else:
104+
app.config['SECURITY_LOGIN_USER_TEMPLATE'] = \
105+
app.config[
106+
'WEKO_ACCOUNTS_SECURITY_LOGIN_LOCAL_SHIB_TEMPLATE']
107+
103108

104109
def _enable_logger_activity(self, app):
105110
"""

‎modules/weko-accounts/weko_accounts/templates/weko_accounts/gakunin.html‎

Lines changed: 279 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,279 @@
1+
<div class="text-center">
2+
<label style="margin-bottom: 15px;">{{_('Institutional Login for institutions in Japan.')}}</label>
3+
<img src="https://www.gakunin.jp/themes/custom/gakunin/logo.svg" width="100px" style="vertical-align: sub;">
4+
</div>
5+
<!-- EMBEDDED-WAYF-START -->
6+
<script type="text/javascript">
7+
<!--
8+
// To use this JavaScript, please access:
9+
// https://ds.gakunin.nii.ac.jp/WAYF/embedded-wayf.js/snippet.html
10+
// and copy/paste the resulting HTML snippet to an unprotected web page that
11+
// you want the embedded WAYF to be displayed
12+
13+
14+
//////////////////// ESSENTIAL SETTINGS ////////////////////
15+
16+
// URL of the WAYF to use
17+
// [Mandatory]
18+
//var wayf_URL = "https://ds.gakunin.nii.ac.jp/WAYF";
19+
var wayf_URL = "{{ wayf_url }}";
20+
21+
// EntityID of the Service Provider that protects this Resource
22+
// [Mandatory]
23+
var wayf_sp_entityID = "{{ sp_entityID }}";
24+
25+
// Shibboleth Service Provider handler URL
26+
// [Mandatory, if wayf_use_discovery_service = false]
27+
var wayf_sp_handlerURL = "{{ sp_handlerURL }}";
28+
29+
// URL on this resource that the user shall be returned to after authentication
30+
// [Mandatory]
31+
var wayf_return_url = "{{ return_url }}";
32+
33+
34+
//////////////////// RECOMMENDED SETTINGS ////////////////////
35+
36+
// Width of the embedded WAYF in pixels or "auto"
37+
// This is the width of the content only (without padding and border).
38+
// Add 2 x (10px + 1px) = 22px for padding and border to get the actual
39+
// width of everything that is drawn.
40+
// [Optional, default: "auto"]
41+
var wayf_width = "auto";
42+
43+
// Height of the embedded WAYF in pixels or "auto"
44+
// This is the height of the content only (without padding and border).
45+
// Add 2 x (10px + 1px) = 22px for padding and border to get the actual
46+
// height of everything that is drawn.
47+
// [Optional, default: "auto"]
48+
var wayf_height = "auto";
49+
50+
// Whether to show the checkbox to remember settings for this session
51+
// [Optional, default: true]
52+
var wayf_show_remember_checkbox = true;
53+
54+
// Force the user's Home Organisation selection to be remembered for the
55+
// current browser session. If wayf_show_remember_checkbox is true
56+
// the checkbox will be shown but will be read only.
57+
// WARNING: Only use this feature if you know exactly what you are doing
58+
// This option will cause problems that are difficult to find
59+
// in case they accidentially select a wrong Home Organisation
60+
// [Optional, false]
61+
var wayf_force_remember_for_session = false;
62+
63+
// Logo size
64+
// Choose whether the small or large logo shall be used
65+
// [Optional, default: true]
66+
var wayf_use_small_logo = true;
67+
68+
// Font size
69+
// [Optional, default: 12]
70+
var wayf_font_size = 12;
71+
72+
// Font color
73+
// [Optional, default: #000000]
74+
var wayf_font_color = '#000000';
75+
76+
// Border color
77+
// [Optional, default: #00247D]
78+
var wayf_border_color = '#00247D';
79+
80+
// Background color
81+
// [Optional, default: #F4F7F7]
82+
var wayf_background_color = '#F4F7F7';
83+
84+
// Whether to automatically log in user if he has a session/permanent redirect
85+
// cookie set at central wayf
86+
// [Optional, default: true]
87+
var wayf_auto_login = true;
88+
89+
// Whether to hide the WAYF after the user was logged in
90+
// This requires that the _shib_session_* cookie is set when a user
91+
// could be authenticated, which is the default case when Shibboleth is used.
92+
// For other Service Provider implementations have a look at the setting
93+
// wayf_check_login_state_function that allows you to customize this
94+
// [Optional, default: false]
95+
var wayf_hide_after_login = false;
96+
97+
// Whether or not to show the categories in the drop-down list
98+
// Possible values are: true or false
99+
// [Optional, default: true]
100+
var wayf_show_categories = true;
101+
102+
// Most used Identity Providers will be shown as top category in the drop down
103+
// list if this feature is used.
104+
// [Optional, commented out by default]
105+
// var wayf_most_used_idps = new Array("https://aai-logon.unibas.ch/idp/shibboleth", "https://aai.unil.ch/idp/shibboleth");
106+
107+
// Categories of Identity Provider that shall not be shown
108+
// Possible values are: "hokkaido","tohoku","kanto","chubu","kinki","chugoku","shikoku","kyushu","others", "all"
109+
// Example of how to hide categories
110+
// var wayf_hide_categories = new Array("other", "library");
111+
// [Optional, commented out by default]
112+
// var wayf_hide_categories = new Array();
113+
114+
// EntityIDs of Identity Provider whose category is hidden but that shall be shown anyway
115+
// If this array is not empty, wayf_show_categories will be disabled because
116+
// otherwise, unhidden IdPs may be displayed in the wrong category
117+
// Example of how to unhide certain Identity Providers
118+
// var wayf_unhide_idps = new Array("https://aai-login.uzh.ch/idp/shibboleth");
119+
// [Optional, commented out by default]
120+
// var wayf_unhide_idps = new Array();
121+
122+
// EntityIDs of Identity Provider that shall not be shown at all
123+
// Example of how to hide certain Identity Provider
124+
// var wayf_hide_idps = new Array("https://idp.unige.ch/idp/shibboleth", "https://lewotolo.switch.ch/idp/shibboleth");
125+
// [Optional, commented out by default]
126+
// var wayf_hide_idps = new Array();
127+
128+
129+
//////////////////// ADVANCED SETTINGS ////////////////////
130+
131+
// Use the SAML2/Shibboleth 2 Discovery Service protocol where
132+
// the user is sent back to the Service Provider after selection
133+
// of his Home Organisation.
134+
// This is true by default and it should only be uncommented and set to false
135+
// if there is a good reason why to use the old and deprecated Shibboleth WAYF
136+
// protocol instead.
137+
// [Optional, default: commented out]
138+
// var wayf_use_discovery_service = false;
139+
140+
// Session Initiator URL of the Service Provider
141+
// Examples: "https://econf.switch.ch/Shibboleth.sso/DS", "https://dokeos.unige.ch/Shibboleth.sso/DS"
142+
// This will implicitely be set to wayf_sp_samlDSURL = wayf_sp_handlerURL + "/DS";
143+
// [Optional, if wayf_use_discovery_service = true
144+
// or if wayf_additional_idps is not empty, default: commented out]
145+
// var wayf_sp_samlDSURL = wayf_sp_handlerURL + "/Login";
146+
147+
// Default IdP to preselect when central WAYF couldn't guess IdP either
148+
// This is usually the case the first time ever a user accesses a resource
149+
// [Optional, default: commented out]
150+
// var wayf_default_idp = "https://aai.switch.ch/idp/shibboleth";
151+
var wayf_default_idp = "{{ default_idp }}";
152+
153+
// Set a custom Assertion Consumer URL instead of
154+
// the default wayf_sp_handlerURL + '/SAML/POST'
155+
// Only relevant if wayf_use_discovery_service is false
156+
// Examples: "https://olat.uzh.ch/shib/samlaa",
157+
// This will implicitely be set to wayf_sp_samlACURL = wayf_sp_handlerURL + "/SAML/POST";
158+
// "https://foodle.feide.no/simplesaml/shib13/sp/AssertionConsumerService.php"
159+
// [Optional, commented out by default]
160+
// var wayf_sp_samlACURL = "https://maclh.switch.ch/foo/bar";
161+
162+
// Overwites the text of the checkbox if
163+
// wayf_show_remember_checkbox is set to true
164+
// [Optional, commented out by default]
165+
// var wayf_overwrite_checkbox_label_text = 'Save setting for today';
166+
167+
// Overwrites the text of the submit button
168+
// [Optional, commented out by default]
169+
// var wayf_overwrite_submit_button_text = 'Go';
170+
171+
// Overwrites the intro text above the drop-down list
172+
// [Optional, commented out by default]
173+
// var wayf_overwrite_intro_text = 'Select your Home Organisation to log in';
174+
175+
// Overwrites the category name of the most used IdP category in the drop-down list
176+
// [Optional, commented out by default]
177+
// var wayf_overwrite_most_used_idps_text = 'Most popular';
178+
179+
180+
// Whether to hide the WAYF after the user was logged in
181+
// This requires that the _shib_session_* cookie is set when a user
182+
// could be authenticated
183+
// If you want to hide the embedded WAYF completely, uncomment
184+
// the property and set it to "". This then won't draw anything
185+
// [Optional, default commented out: You are already logged in]
186+
// var wayf_logged_in_messsage = "";
187+
188+
// Provide the name of a JavaScript function that checks whether the user
189+
// already is logged in. The function should return true if the user is logged
190+
// in or false otherwise. If the user is logged in, the Embedded WAYF will
191+
// hide itself or draw a custom message depending on the
192+
// setting wayf_logged_in_messsage
193+
// The function you specify has of course to be implemented by yourself!
194+
// [Optional, commented out by default]
195+
// var wayf_check_login_state_function = function() {
196+
// if (# specify user-is-logged-in condition#)
197+
// return true;
198+
// else
199+
// return false;
200+
// }
201+
202+
// EntityIDs, Names and SSO URLs of Identity Providers from other federations
203+
// that shall be added to the drop-down list
204+
// The IdPs will be displayed in the sequence they are defined
205+
// [Optional, commented out by default]
206+
// var wayf_additional_idps = [ ];
207+
208+
var wayf_additional_idps = {{ wayf_additional_idps|tojson }};
209+
// Example of how to add Identity Provider from other federations
210+
// var wayf_additional_idps = [
211+
//
212+
// {name:"International University X",
213+
// entityID:"urn:mace:switch.ch:SWITCHaai:example.university.org",
214+
// SAML1SSOurl:"https://int.univ.org/shibboleth-idp/SSO"},
215+
//
216+
// {name:"Some Other University",
217+
// entityID:"https://other.univ.edu/idp/shibboleth",
218+
// SAML1SSOurl:"https://other.univ.edu/shibboleth-idp/SSO"},
219+
// ];
220+
221+
// The list which is the target of incremental search is extracted to IdP acquired by DiscpFeed
222+
// URL of DiscpFeed is set up
223+
// var wayf_discofeed_url = "https://point.switch.ch/Shibboleth.sso/DiscoFeed";
224+
// [Optional, commented out by default]
225+
// var wayf_discofeed_url = "";
226+
227+
// The path of Cookie created by SP is set. As for default configuration,
228+
// the path of an access place is set.
229+
// var wayf_sp_cookie_path = "/";
230+
// [Optional, commented out by default]
231+
// var wayf_sp_cookie_path = "";
232+
233+
// Height of the embedded WAYF IdP List in pixels
234+
// [Optional, default: 150]
235+
// var wayf_list_height = 150;
236+
237+
238+
//////////////////// ADDITIONAL CSS CUSTOMIZATIONS ////////////////////
239+
240+
// To further customize the appearance of the Embedded WAYF you could
241+
// define CSS rules for the following CSS IDs that are used within the
242+
// Embedded WAYF:
243+
// #wayf_div - Container for complete Embedded WAYF
244+
// #wayf_logo_div - Container for logo
245+
// #wayf_logo - Image for logo
246+
// #wayf_intro_div - Container of drop-down list intro label
247+
// #wayf_intro_label - Label of intro text
248+
// #IdPList - The form element
249+
// #user_idp - Select element for drop-down list
250+
// #wayf_remember_checkbox_div - Container of checkbox and its label
251+
// #wayf_remember_checkbox - Checkbox for remembering settings for session
252+
// #wayf_remember_checkbox_label - Text of checkbox
253+
// #wayf_submit_button - Submit button
254+
//
255+
// Use these CSS IDs carefully and at own risk because future updates could
256+
// interfere with the rules you created and the IDs may change without notice!
257+
258+
259+
//-->
260+
</script>
261+
262+
<script type="text/javascript" charset="UTF-8">
263+
<!--
264+
document.write('<script type="text/javascript" src="{{ wayf_url }}/embedded-wayf.js?' + (new Date().getTime()) + '"></scr' + 'ipt>');
265+
//-->
266+
</script>
267+
268+
<noscript>
269+
<!--
270+
Fallback to Shibboleth DS session initiator for non-JavaScript users
271+
You should set the value of the target GET parameter to an URL-encoded
272+
absolute URL that points to a Shibboleth protected web page where the user
273+
is logged in into your application.
274+
-->
275+
<p>
276+
<strong>Login:</strong> Javascript is not available for your web browser. Therefore, please <a
277+
href="/Shibboleth.sso/DS?target=">proceed manually</a>.
278+
</p>
279+
</noscript>

0 commit comments

Comments
 (0)