Skip to content

Milestone 1: OpenID Connect Client

Jump to bottom Edit New page
Adrian Gropper edited this page Jan 24, 2016 · 10 revisions

Milestone 1 will add an OpenID Connect client for Django Sign-In to create the initial HIE of One droplet. Milestone 1 code will be pulled into this repository and clear installation instructions onto the MyAS droplet must be provided.

Testing of Milestone 1 will be to enable a FreedomBox Admin to add Google Sign In as the first registered OpenID Connect provider using the Django Admin interface. Milestone 1 code must execute without breaking the FreedomBox environment as saved at the end of Milestone 0.

Integration suggestion by the lead FreedomBox maintainer on Jan 20:

On 01/17/2016 02:21 AM, Adrian Gropper wrote:

Hello All,

I have a FreedomBox up and running, and I want to modify the Django project Plinth that comes with my FreedomBox. I want to add one or more models (database tables), and I want to add some view functions and templates.

Eventually, I probably want to make this into a Debian package that can be installed easily by other FreedomBox users. That is ten steps down the road, right now I just want to modify my own single FreedomBox machine.

I have seen the instructions here https://wiki.debian.org/FreedomBox/Manual/Developer, but I still have some rather basic questions:

  1. I think I want to make a new Django app with my models.py, views.py, and template files. Then I want to add it to INSTALLED_APPS in settings.py and I will need to modify a few other files as described in the instructions above. Does this sound like the correct plan?

Yes, to add an App to Plinth, this is the approach. One correction is that you don't have to add the app name to INSTALLED_APPS, Plinth does it automatically based on a file in /etc/plinth/modules-enabled/ . See developer manual on this.

  1. On my FreedomBox, where exactly is the settings.py file that is being used by Plinth? Where are the other files I will need to change? Should I just edit the files, save them, and make a note of what I added?

Django supports two mechanisms for initializing. One mechanism is to the have a settings.py and another is to make a method call directly with essentially the contents of settings.py. The former method is well suited for most projects. Plinth, however, has to take command line arguments and read configuration files before settings can be decided. So, in Plinth, we take the latter approach of making a method call to initialize Django with all settings pass manually.

You can find Django initialization happening in main.py. If you have settings to change, you can do that over there. Names, meaning and working of settings is as usual.

  1. Examples to follow would be nice. Is there a simple and well-built Django app FreedomBox plugin that I can install, play with, and examine? Ideally something which adds at least one Django model and adds a tab to the Plinth admin interface.

You can find several applications in the plinth/modules directory. Each module is a Django app on the lines of what you are building. You can pick, say, quassel IRC application. It shows a bare minimum application that adds menu items into the interface. You can see 'pagekite' and 'dynamicdns' as examples that add multiple page interface. 'firstboot' module is an example for a adding wizard. There are no apps that add models yet. However, you can see example of that in the main project itself as plinth/models.py.

(In case you’re wondering, I’m working on a project called HIE of One https://github.com/HIEofOne/PersonalAS/wiki where I need single-sign-on to FreedomBox first and will add the OAuth2 / UMA authorization server after that. I think eventually many FreedomBox users might appreciate an app that adds single-sign-on in order to have persistent accounts on the FreedomBoxes of their friends.)

Please feel free to ask further questions. You might get faster answers by hanging around on the FreedomBox's IRC channel.

I have seen you request earlier for help on architecture bits. I have spent some time understanding OAuth2, OpenID Connect etc. These standards don't seem to have federation as one of their main goals while it appears to be doable. For your case, it is also important to understand what various health care providers are following as standards. There seem to be quite a few standards in the area. So, I don't understand everything fully.

I believe I will be able to help after more discussion. If it is possible you to attend our FreedomBox monthly voice conference call, you could perhaps explain us your plans and take feedback and architecture inputs from the team. Otherwise, we can also catch up on the IRC.

Overall, I think HIE of One is an application that is very much in the spirit of FreedomBox and could be an application that even non-technical people could relate to. On top of this, having OAuth2/OpenID Connect as way for users to maintain a single account on FreedomBox for services provided elsewhere would be nice.

Architecture Thoughts

https://github.com/rohe/pyoidc might be the right place to start since it's likely to make subsequent UMA enhancements easiest.

HIE of One will have two kinds of users. The true Admins of the FreedomBox are patient and family supports with the right to add and drop OpenID Connect providers, UMA clients and requesting parties. The other kind of users will be UMA Requesting parties with the right to register their OAuth / UMA Clients. I'm not sure what the right approach is in the long run, but for now, I hope we can maintain the IS_STAFF distinction to separate full admins (the patient) from UMA Requesting Parties in future milestones.

A full-featured authentication app like django-allauth might be considered in the future when we can assume an email server is available to enable notification and password reset. Although NOSH already has an invitation mechanism, a FreedomBox based invitation mechanism might be preferable for non-healthcare UMA applications.

Subsequent milestones will add Dynamic OP registration against servers based on MITREid Connect and UMA AS functionality including HTML forms for resource registration and dynamic client registration. Testing of subsequent milestones will be against NOSH which uses MITREid Connect as well as other open source OAuth and UMA projects.

Tools

HIE of One - FreedomBox - HEART Workgroup - UMA Workgroup - The hi:project - PPR - NOSH

Add a custom sidebar

Clone this wiki locally