Skip to content

Latest commit

 

History

History
75 lines (60 loc) · 3.06 KB

deic_setup_notes.md

File metadata and controls

75 lines (60 loc) · 3.06 KB

MediaCMS: Document Changes for DEIC

Configuration Changes

The following changes are required in deploy/docker/local_settings.py:

# default workflow
PORTAL_WORKFLOW = 'private'

# Authentication Settings
# these two are necessary so that users cannot register through system accounts. They can only register through identity providers
REGISTER_ALLOWED = False
USERS_CAN_SELF_REGISTER = False

USE_RBAC = True
USE_SAML = True
USE_IDENTITY_PROVIDERS = True

# Proxy and SSL Settings
USE_X_FORWARDED_HOST = True
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
SECURE_SSL_REDIRECT = True
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True

# SAML Configuration
SOCIALACCOUNT_ADAPTER = 'saml_auth.adapter.SAMLAccountAdapter'
ACCOUNT_USERNAME_VALIDATORS = "users.validators.less_restrictive_username_validators"
SOCIALACCOUNT_PROVIDERS = {
    "saml": {
        "provider_class": "saml_auth.custom.provider.CustomSAMLProvider",
    }
}
SOCIALACCOUNT_AUTO_SIGNUP = True
SOCIALACCOUNT_EMAIL_REQUIRED = False

# if set to strict, user is created with the email from the saml provider without
# checking if the email is already on the system
# however if this is ommited, and user tries to login with an email that already exists on
# the system, then they get to the ugly form where it suggests they add a username/email/name

ACCOUNT_PREVENT_ENUMERATION = 'strict'

SAML Configuration Steps

Step 1: Add SAML Identity Provider

  1. Navigate to Admin panel
  2. Select "Identity Provider"
  3. Configure as follows:
    • Provider: saml # ensure this is set with lower case!
    • Provider ID: wayf.wayf.dk
    • IDP Config Name: Deic (or preferred name)
    • Client ID: wayf_dk (important: defines the URL, e.g., https://deic.mediacms.io/accounts/saml/wayf_dk)
    • Site: Set the default one

Step 2: Add SAML Configuration

Can be set through the SAML Configurations tab:

  1. IDP ID: Must be a URL, e.g., https://wayf.wayf.dk
  2. IDP Certificate: x509cert from your SAML provider
  3. SSO URL: https://wayf.wayf.dk/saml2/idp/SSOService2.php
  4. SLO URL: https://wayf.wayf.dk/saml2/idp/SingleLogoutService.php
  5. SP Metadata URL: The metadata URL set for the SP, e.g., https://deic.mediacms.io/saml/metadata. This should point to the URL of the SP and is autogenerated

Step 3: Set the other Options

  1. Email Settings:
    • verified_email: When enabled, emails from SAML responses will be marked as verified
    • Remove from groups: When enabled, user is removed from a group after login, if they have been removed from the group on the IDP
  2. Global Role Mapping: Maps the role returned by SAML (as set in the SAML Configuration tab) with the role in MediaCMS
  3. Group Role Mapping: Maps the role returned by SAML (as set in the SAML Configuration tab) with the role in groups that user will be added
  4. Group mapping: This creates groups associated with this IDP. Group ids as they come from SAML, associated with MediaCMS groups
  5. Category Mapping: This maps a group id (from SAML response) with a category in MediaCMS