|
2 | 2 |
|
3 | 3 | ## Authentication and authorization
|
4 | 4 |
|
5 |
| -The authentication and authorization of a user have traditionally been performed in one step via the `ISPYBClient` hardware object. The authentication step has either been done through LDAP or delegated to ISPyB. `ISPYBClient` has been replaced by `ISPyBAbstractLIMS` and exists in two variants, one for user-based login (`UserTypeISPyBLims`) and another one for proposal (`ProposalTypeISPyBLims`) both of which support authentication via LDAP or ISPyB. The possibility to authenticate via LIMS will be removed in the future, and authentication has to be delegated to a process dedicated to authentication. The authorization for a user to use a beamline is performed via the user portal or LIMS system. |
| 5 | +The authentication and authorization of a user have traditionally been performed |
| 6 | +in one step via the `ISPYBClient` hardware object. The authentication step has |
| 7 | +either been done through LDAP or delegated to ISPyB. `ISPYBClient` has been |
| 8 | +replaced by `ISPyBAbstractLIMS` and exists in two variants, one for user-based |
| 9 | +login (`UserTypeISPyBLims`) and another one for proposal |
| 10 | +(`ProposalTypeISPyBLims`) both of which support authentication via LDAP or |
| 11 | +ISPyB. The possibility to authenticate via LIMS will be removed in the future, |
| 12 | +and authentication has to be delegated to a process dedicated to authentication. |
| 13 | +The authorization for a user to use a beamline is performed via the user portal |
| 14 | +or LIMS system. |
6 | 15 |
|
7 | 16 | ### Authentication with single sign on
|
8 | 17 |
|
9 |
| -MXCUBE can be configured to use Single sign-on (SSO) through OpenIDConnect for user authentication. The OpenIDConnect configuration is located in the `server.yaml` file, which should contain an `sso` section like the one below. |
| 18 | +MXCUBE can be configured to use Single sign-on (SSO) through OpenIDConnect for |
| 19 | +user authentication. The OpenIDConnect configuration is located in the |
| 20 | +`server.yaml` file, which should contain an `sso` section like the one below. |
10 | 21 |
|
11 | 22 | ```
|
12 | 23 | sso:
|
@@ -45,3 +56,28 @@ Every time the _refresh_ endpoint is called,
|
45 | 56 | the browser session cookie is refreshed,
|
46 | 57 | meaning its expiration timestamp is pushed back in the future
|
47 | 58 | for as much as the value stored in `PERMANENT_SESSION_LIFETIME`.
|
| 59 | + |
| 60 | +### Testing with ISPyBMockupClient |
| 61 | + |
| 62 | +`ISPyBMockupClient` simulates both user type and proposal type login. The |
| 63 | +typical demo/test configuration can be found below. The `loginType` attribute |
| 64 | +is used to switch between the two different behaviours, `user` for user type |
| 65 | +login and `proposal` for proposal type login. |
| 66 | + |
| 67 | +``` |
| 68 | +<object class="ISPyBClientMockup"> |
| 69 | + <object hwrid="/lims_rest" role="lims_rest"/> |
| 70 | + <ws_root> |
| 71 | + https://your.lims.org |
| 72 | + </ws_root> |
| 73 | + <base_result_url> |
| 74 | + https://your.limsresults.org |
| 75 | + </base_result_url> |
| 76 | + <ws_username></ws_username> |
| 77 | + <ws_password></ws_password> |
| 78 | + <loginType>user</loginType> <!-- set to user or proposal --> |
| 79 | + <object role="session" href="/session"/> |
| 80 | +</object> |
| 81 | +``` |
| 82 | + |
| 83 | +_Example test configuration_ |
0 commit comments