Package: eidas-node
eIDAS Specific NodeDjango implementation of member specificConnectorandProxy ServiceforCEF eIDAS Nodeversion 2.4 and later.RequirementsDjango2.2.xDjango AppSettings>= 0.5lxmlxmlsecApache Ignite Python client(optional)ChangesSeeCHANGELOG.mdfor changes.Specific Proxy ServiceSample settings are provided insamples/proxy_service_settings.py.UsageTo use eIDAS Proxy Service, adjust Django settings:Set up  Django template engine and static files.Add'eidas_node.proxy_service.apps.ProxyServiceConfig'toINSTALLED_APPS.SetROOT_URLCONFto'eidas_node.proxy_service.urls'or include it in your URL configuration.Provide mandatory configuration optionsPROXY_SERVICE_REQUEST_TOKEN,PROXY_SERVICE_RESPONSE_TOKEN,PROXY_SERVICE_LIGHT_STORAGE, andPROXY_SERVICE_IDENTITY_PROVIDER(see below).SettingsPROXY_SERVICE_REQUEST_TOKENSettings ofa light token corresponding to an incoming light request.
A dictionary with following items:HASH_ALGORITHM(optional, default'sha256'): A hash algorithm used for token digest.SECRET(required): A token secret shared with eIDAS node.ISSUER(required): An issuer of the light token.LIFETIME(optional, default10): A lifetime of the light token in minutes until is its considered expired.
Set to0for unlimited lifetime.PARAMETER_NAME(optional, default'token'): The name of the HTTP POST parameter to provide encoded light token.PROXY_SERVICE_RESPONSE_TOKENSettings ofa light token corresponding to an outgoing light response.
A dictionary with following items:HASH_ALGORITHM(optional, default'sha256'): A hash algorithm used for token digest.SECRET(required): A token secret shared with eIDAS node.ISSUER(required): An issuer of the light token.PARAMETER_NAME(optional, default'token'): The name of the HTTP POST parameter to provide encoded light token.PROXY_SERVICE_LIGHT_STORAGESettings fora storage of light requests and responses.
A dictionary with following items:BACKEND(optional, default'eidas_node.storage.ignite.IgniteStorage'): The backend class for communication with the light storage.OPTIONS(required): A dictionary with configuration of the selected backend.
TheIgniteStoragebackend expects following options:host: Apache Ignite service host.port: Apache Ignite service port.request_cache_name: The cache to retrieve light requests (e.g.,nodeSpecificProxyserviceRequestCache).response_cache_name: The cache to store light responses (e.g.,specificNodeProxyserviceResponseCache).timeout: A timeout for socket operations.PROXY_SERVICE_IDENTITY_PROVIDERSettings forthe interaction with Identity Provider.
A dictionary with following items:ENDPOINT(required): The URL where the Identity Provider expects authentication requests.REQUEST_ISSUER(required): The issuer of the authentication request registered at Identity Provider.KEY_FILE(optional, defaultNone): The path of a key to decrypt Identity Provider's authentication response.CERT_FILE(optional, defaultNone): The path of a certificate to verify the signature of Identity Provider's authentication response.REQUEST_SIGNATURE(dictionary, required, use{}to disable signing):
Options for signing SAML requests sent to Service Provider:KEY_FILE(required, string): The path to a signing key.CERT_FILE: (required, string): The path to the corresponding certificate.SIGNATURE_METHOD(optional, string, defaultRSA_SHA512): XML signature method.DIGEST_METHOD(optional, string, defaultSHA512): XML digest method.PROXY_SERVICE_EIDAS_NODESettings forthe interaction with eIDAS Node.
A dictionary with following items:PROXY_SERVICE_RESPONSE_URL(required): The URL where eIDAS Node expects authentication responses (e.g.,https://test.example.net/EidasNode/SpecificProxyServiceResponse).RESPONSE_ISSUER(required): The issuer for light responses specified in eIDAS Node configuration.PROXY_SERVICE_TRANSIENT_NAME_ID_FALLBACKOptional boolean, disabled by default.
If enabled,PROXY_SERVICE_AUXILIARY_STORAGEmust be set too.
Ifthe transient name ID formatis requested in the request but a different format is provided in the response, a new random transient ID is generated instead of the provided ID.PROXY_SERVICE_TRACK_COUNTRY_CODEOptional boolean, disabled by default.
If enabled,PROXY_SERVICE_AUXILIARY_STORAGEmust be set too.
Once enabled, the country code of the request is logged along with the status of the corresponding request.PROXY_SERVICE_AUXILIARY_STORAGEAn auxiliary storage to hold some response metadata needed during request processing.
It is required ifPROXY_SERVICE_TRACK_COUNTRY_CODEorPROXY_SERVICE_TRANSIENT_NAME_ID_FALLBACKis enabled.A dictionary with following items:BACKEND(optional, default'eidas_node.storage.ignite.AuxiliaryIgniteStorage'):
The backend class for communication with the light storage.OPTIONS(required): A dictionary with configuration of the selected backend.
TheAuxiliaryIgniteStoragebackend expects following options:host: Apache Ignite service host.port: Apache Ignite service port.cache_name: The cache to store the data.prefix: The prefix for cache keys (optional).timeout: A timeout for socket operations.PROXY_SERVICE_LEVELS_OF_ASSURANCEAn optional mapping ofAuthentication Context Classes(str) toLevels of Assurance(eidas_node.constants.LevelOfAssurance).
The default mapping is empty so other classes than Levels of Assurance are unrecognized and propagated as an error. Example:fromeidas_node.constantsimportLevelOfAssurancePROXY_SERVICE_LEVELS_OF_ASSURANCE={'urn:oasis:names:tc:SAML:2.0:ac:classes:Password':LevelOfAssurance.LOW,}CustomizationYou can customize the authorization flow by subclassing view classes ineidas_node.proxy_service.views, overriding necessary methods and adjusting URL configuration.CZ NIAeidas_node.proxy_service.cznia(ROOT_URLCONF = 'eidas_node.proxy_service.cznia.urls') contains modifications required for CZ NIA (the official identity provider of the Czech Republic) with following settings:PROXY_SERVICE_STRIP_PREFIX(boolean, optional, defaultFalse): If theSubject IDstarts with a'CZ/CZ/'prefix, it is stripped.Specific ConnectorSample settings are provided insamples/connector_settings.py.UsageTo use eIDAS Connector, adjust Django settings:Set up  Django template engine and static files.Add'eidas_node.connector.apps.ConnectorConfig'toINSTALLED_APPS.SetROOT_URLCONFto'eidas_node.connector.urls'or include it in your URL configuration.Provide mandatory configuration optionsCONNECTOR_REQUEST_TOKEN,CONNECTOR_RESPONSE_TOKEN,CONNECTOR_LIGHT_STORAGE, andCONNECTOR_SERVICE_PROVIDER(see below).ViewsSettingROOT_URLCONFtoeidas_node.connector.urlswill provide you with three main views:/CountrySelector:
Accepts aSAML RequestandRelay Statefrom Service Provider and lets user select his/hercountryunless it has already been provided.
The SAML Request is then forwarded to/ServiceProviderRequestendpoint.Method: HTTP POST.POST Parameters:SAMLRequest(required): A SAML request to forward to eIDAS Network.RelayState(required): A relay state.countryor the value set inCONNECTOR_SERVICE_PROVIDER['COUNTRY_PARAMETER'](optional): Citizen country code./ServiceProviderRequest:
Accepts aSAML Request,Relay Stateandcitizen country codefrom Service Provider and forwards the request to eIDAS Network.Method: HTTP POST.POST Parameters:SAMLRequest(required): A SAML request to forward to eIDAS Network.RelayState(required): A relay state.countryor the value set inCONNECTOR_SERVICE_PROVIDER['COUNTRY_PARAMETER'](required): Citizen country code./ConnectorResponse:
Accepts a light token from eIDAS Network and forwards corresponding light response to Service Provider.Method: HTTP POST.POST Parameters:tokenor the value set inCONNECTOR_RESPONSE_TOKEN['PARAMETER_NAME'](required): A light token corresponding to a light response.SettingROOT_URLCONFtoeidas_node.connector.demo.urlswill provide you with two additional views:/DemoServiceProviderRequest:
A demo service provider page for sending preset SAML requests to Specific Connector./DemoServiceProviderResponse:
A demo service provider page for displaying SAML responses from Specific Connector.SettingsCONNECTOR_REQUEST_TOKENSettings ofa light token corresponding to an outgoing light request.
A dictionary with following items:HASH_ALGORITHM(optional, default'sha256'): A hash algorithm used for token digest.SECRET(required): A token secret shared with eIDAS node.ISSUER(required): An issuer of the light token.PARAMETER_NAME(optional, default'token'): The name of the HTTP POST parameter to provide encoded light token.CONNECTOR_RESPONSE_TOKENSettings ofa light token corresponding to an incoming light response.
A dictionary with following items:HASH_ALGORITHM(optional, default'sha256'): A hash algorithm used for token digest.SECRET(required): A token secret shared with eIDAS node.ISSUER(required): An issuer of the light token.PARAMETER_NAME(optional, default'token'): The name of the HTTP POST parameter to provide encoded light token.LIFETIME(optional, default10): A lifetime of the light token in minutes until is its considered expired.
Set to0for unlimited lifetime.CONNECTOR_LIGHT_STORAGESettings fora storage of light requests and responses.
A dictionary with following items:BACKEND(optional, default'eidas_node.storage.ignite.IgniteStorage'): The backend class for communication with the light storage.OPTIONS(required): A dictionary with configuration of the selected backend.
TheIgniteStoragebackend expects following options:host: Apache Ignite service host.port: Apache Ignite service port.request_cache_name: The cache to retrieve light requests (e.g.,specificNodeConnectorRequestCache).response_cache_name: The cache to store light responses (e.g.,nodeSpecificConnectorResponseCache).timeout: A timeout for socket operations in seconds.CONNECTOR_SERVICE_PROVIDERSettings forthe interaction with Service Provider.
A dictionary with following items:ENDPOINT(required): The URL where the Service Provider expects authentication responses.CERT_FILE(optional, defaultNone): The path of a certificate to verify the signature of Service Provider's authentication requests.REQUEST_ISSUER(required): The expected issuer of the Service Provider's authentication request.RESPONSE_ISSUER(required): The issuer of the authentication response registered at Service Provider.COUNTRY_PARAMETER(optional, defaultcountry): The name of a POST parameter containing citizen country code for/CitizenCountrySelectorand/ServiceProviderRequestviews.RESPONSE_SIGNATURE(dictionary, required, use{}to disable signing):
Options for signing SAML responses returned to Service Provider:KEY_FILE(required, string): The path to a signing key.CERT_FILE: (required, string): The path to the corresponding certificate.SIGNATURE_METHOD(optional, string, defaultRSA_SHA512): XML signature method.DIGEST_METHOD(optional, string, defaultSHA512): XML digest method.RESPONSE_ENCRYPTION(dictionary, required, use{}to disable encryption):
Options for encrypting SAML responses returned to Service Provider:CERT_FILE: (required, string): The path to the certificate to encrypt a generated encryption key.ENCRYPTION_METHOD(optional, string, defaultAES256_GCM):XML encryption method.AES256_GCM,AES192_GCM, andAES168_GCMare available with libxmlsec1 >= 1.2.27.AES256_CBC,AES192_CBC,AES168_CBC, andTRIPLEDES_CBCare supported by older libxmlsec1 but should not be used without consideration of possibly severe security risks.KEY_TRANSPORT(optional, string, defaultRSA_OAEP_MGF1P):XML key transport method.RSA(RSA Version 1.5) andRSA_OAEP_MGF1P(RSA-OAEP with MGF1-SHA1 as a mask generation function) are supported.RESPONSE_VALIDITY(int, optional, default 10): The validity of the SAML response in minutes.CONNECTOR_EIDAS_NODESettings forthe interaction with eIDAS Node.
A dictionary with following items:CONNECTOR_REQUEST_URL(required): The URL where eIDAS Node expects authentication requests (e.g.,https://test.example.net/EidasNode/SpecificConnectorRequest).REQUEST_ISSUER(required): The issuer for light requests specified in eIDAS Node configuration.CONNECTOR_ALLOWED_ATTRIBUTESA set containing URI names (strings, e.g.'http://eidas.europa.eu/attributes/naturalperson/PersonIdentifier') of attributes that a service provider can request.
Other attributes are dropped from the authentication request.
All eIDAS natural and legal person attributes are enabled by default.
An empty set disables the filter.CONNECTOR_SELECTOR_COUNTRIESA list of pairs with country code and name to be displayed in citizen country selector (/CitizenCountrySelector).
Default is all 28 countries of EU.CONNECTOR_TRACK_COUNTRY_CODEOptional boolean, disabled by default.
If enabled,CONNECTOR_AUXILIARY_STORAGEmust be set too.
Once enabled, the country code of the request is logged along with the status of the corresponding request.CONNECTOR_AUXILIARY_STORAGEAn auxiliary storage to hold some response metadata needed during request processing.
It is required ifCONNECTOR_TRACK_COUNTRY_CODEis enabled.A dictionary with following items:BACKEND(optional, default'eidas_node.storage.ignite.AuxiliaryIgniteStorage'):
The backend class for communication with the light storage.OPTIONS(required): A dictionary with configuration of the selected backend.
TheAuxiliaryIgniteStoragebackend expects following options:host: Apache Ignite service host.port: Apache Ignite service port.cache_name: The cache to store the data.prefix: The prefix for cache keys (optional).timeout: A timeout for socket operations.CustomizationYou can customize the authorization flow by subclassing view classes ineidas_node.connector.views, overriding necessary methods and adjusting URL configuration.CopyrightThe django-eidas-specific-node project:Copyright 2019 CZ.NIC, z. s. p. o.License:GPL-3+Country flags:Copyright 2013 Panayiotis LipiridisLicense:MIT