Package: django-shibboleth-remoteuser
Middleware for using Shibboleth with Django.
Requires Django 1.3 or above for RemoteAuthMiddleware.Requirementsshibboleth-sp service installed on your systemshibboleth module enabled or compiled on your web serverDjango >= 1.8 for version > 0.6 or Django > 1.3 for version <= 0.6Installation and configurationEither checkout and runpython setup.py installor install directly
from GitHub usingpip:pipinstallgit+https://github.com/Brown-University-Library/django-shibboleth-remoteuser.gitInsettings.py:Enable the RemoteUserBackend.AUTHENTICATION_BACKENDS+=('shibboleth.backends.ShibbolethRemoteUserBackend',)Add the Django Shibboleth middleware.
You must adddjango.contrib.auth.middleware.ShibbolethRemoteUserMiddlewareto theMIDDLEWARE_CLASSESsetting afterdjango.contrib.auth.middleware.AuthenticationMiddleware.
For example:MIDDLEWARE_CLASSES=(...'django.contrib.auth.middleware.AuthenticationMiddleware','shibboleth.middleware.ShibbolethRemoteUserMiddleware',...)Map Shibboleth attributes to Django User models.
The attributes must be stated in the form they have in the HTTP headers.
Use this to populate the Django User object from Shibboleth attributes.The first element of the tuple states if the attribute is required or not.
If a required element is not found in the parsed Shibboleth headers,
an exception will be raised. For example,(True, "required_attribute"),(False, "optional_attribute).SHIBBOLETH_ATTRIBUTE_MAP={"shib-user":(True,"username"),"shib-given-name":(True,"first_name"),"shib-sn":(True,"last_name"),"shib-mail":(False,"email"),}Set theLOGIN_URLto the login handler of your Shibboleth installation.
In most cases, this will be something like:LOGIN_URL='https://your_domain.edu/Shibboleth.sso/Login'Apache configuration - make sure the Shibboleth attributes are available
to the app.  The app url doesn’t need to require Shibboleth.<Location/app>AuthTypeshibbolethRequireshibboleth</Location>Verify configurationIf you would like to verify that everything is configured correctly,
follow the next two steps below.  It will create a route in your application
at/yourapp/shib/that echos the attributes obtained from Shibboleth.
If you see the attributes you mapped above on the screen, all is good.Add shibboleth to installed apps.INSTALLED_APPS+=('shibboleth',)Add below tourls.pyto enable the included sample view.
This view just echos back the parsed user attributes,
which can be helpful for testing.urlpatterns+=[url(r'^shib/',include('shibboleth.urls',namespace='shibboleth')),]At this point, the django-shibboleth-remoteuser middleware should be complete.OptionalTemplate tagsTemplate tags are included which will allow you to place{{ login_link }}or{{ logout_link }}in your templates for routing users to the
login or logout page. These are available as a convenience and are not required.
To activate, add the following tosettings.py:TEMPLATES=[{...'OPTIONS':{'context_processors':[...'shibboleth.context_processors.login_link','shibboleth.context_processors.logout_link',...],},...},]Permission group mappingIt is possible to map a list of attributes to Django permission groups.django-shibboleth-remoteuserwill generate the groups from the
semicolon-separated values of these attributes. They will be available
in the Django admin interface and you can assign
your application permissions to them.SHIBBOLETH_GROUP_ATTRIBUTES=['Shibboleth-affiliation','Shibboleth-isMemberOf']By default this value is empty and will not affect your group settings.
But when you add attributes toSHIBBOLETH_GROUP_ATTRIBUTESthe user will only associated with those groups. Be aware that the user
will be removed from groups not defined inSHIBBOLETH_GROUP_ATTRIBUTES,
if you enable this setting. Some installations may create a lot of groups.
You may check your group attributes athttps://your_domain.edu/Shibboleth.sso/Sessionbefore activating this feature.Fields identified inSHIBBOLETH_GROUP_ATTRIBUTEScan be a string of group
names with a delimiter. By default the delimiter is;, but this can be
overridden to be one or many delimiters using theSHIBBOLETH_GROUP_DELIMITERSsetting.For example, given:SHIBBOLETH_GROUP_ATTRIBUTES =['Shibboleth-isMemberOf']request headers includes:Shibboleth-isMemberOf:'users;admins,managers'SHIBBOLETH_GROUP_DELIMITERSParsed Groupsdefaultusersandadmins,managers[',']users;adminsandmanagers[',',';']users,admins, andmanagers