Package: perun.proxygui
perun.proxyguiPages used by microservices
insatosacontrib.perun.InstallationThe recommended way to install is via pip:pip3installperun.proxyguiAlternatively, you can clone the repository and run:pip3install.You also need to install the appropriate sqlalchemy driver. For PostgreSQL, you can include thepostgresqlextra, which will installpsycopg2-binary:pip3installperun.proxygui[postgresql]ConfigurationGeneralCopyperun.proxygui.yamlfrom config_templates to/etc/(it needs to reside at/etc/perun.proxygui.yaml) and
adjust to your needs.Theglobal_cfg_filepathoption needs to point to the location of the global microservice config from
thesatosacontrib.perunmodule. You also need
to set the attribute map config.At the very least, you need to copy the config templates:cpconfig_templates/perun.proxygui.yaml/etc/perun.proxygui.yaml
cp../satosacontrib-perun/satosacontrib/perun/config_templates/attribute_typing.yaml/etc/
cp../satosacontrib-perun/satosacontrib/perun/config_templates/microservices_global.yaml/etc/Then change the following line in/etc/perun.proxygui.yaml:global_cfg_filepath:/etc/microservices_global.yamlAnd the following line in/etc/microservices_global.yaml:attrs_cfg_path:/etc/attribute_typing.yamlBackchannel logoutAnalogous to general configuration. Copybackchannel-logout.yamlfrom config_templates to/etc/so the resulting
filepath is/etc/backchannel-logout.yamland adjust to your needs.This configuration is necessary for using/backchannel-logoutendpoint. It
performsOIDC Back-Channel Logout 1.0using
theidpy-oidclibrary.OIDC builds upon OAuth 2.0. Config optionsissuer,client_idandclient_secretare terms explained
inOAuth 2.0 [RFC6749].The endpoint accepts
anOIDC Logout Tokenwhich is a JWT with the necessary information for performing back-channel logout. Therefore, thekey_confsetting must
contain paths to the key pair configured between an OP (our endpoint) which decrypts the JWT and an RP (endpoint caller)
who encrypts the JWT. Optionsprivate_pathandpublic_pathrepresent filepaths to the private/public key.
Settingskey_defsspecify key types andread_onlydetermines whether the keys are read-only. Both come from theidpy-oidclibrary.RunuWSGITo run this Flask app with uWSGI, use the callable perun.proxygui.app:get_app, e.g.module = perun.proxygui.app:get_applocal developmentpython3perun/proxygui/app.pyNow the app is available athttp://localhost:5000/(e.g.http://localhost:5000/banned-users/).local OpenAPI developmentTo create local, temporal OpenAPI scheme from current version run following command:flask--appperun.proxygui.app:get_openapiopenapiwrite--format=yaml"temp_out_file.yaml"TranslationsBabelFirst you need to generate.potfile:pybabel extract -F babel.cfg -o messages.pot .Next step is to generate.pofile:pybabel init -i messages.pot -d perun/proxygui/gui/translations -D messages -l <language_code>replace<language code>with given language code (eg: fr)Then you need to, manually or using a tool likePoedit, write your translations in the generated.pofile and compile it:pybabel compile -d perun/proxygui/gui/translations -D messagesnote that if the.potfile is already created and you want to add new language ignore the first stepAPIMain part of documentationInopenapi.yamlis OpenAPI specification openable in editors (e.g.Swagger Editor)Heuristic pageProvides information about user authentication events gathered by the AuthEventLogging microservice, to confirm their identity e.g. during a MFA reset.Endpoint:/HeuristicGetIDDescription:Used to gather ID of searched userResult:HTTP OK [200]indicating successfull load of search pageEndpoint:/GetHeuristicMethod:GETDescription:Used for showing gathered information about past athentications of user, and showing statistics based on that data.Performed MFA:Gathered logs are checked if MFA was performed while handeling original logging event. Upstream ACRs values are compared to two hardcoded values:https://refeds.org/profile/mfaandhttp://schemas.microsoft.com/claims/multipleauthnInput arguments:ID of searched userResult:HTTP OK [200]indicating successfull load of show pageFuture development notesCurrently, all blueprints need to be prefixed withurl_prefix="/proxygui". To load static files, useurl_for(".static", filename="example.js")command.Adding new endpoint to blueprint and OpenAPI specsStandart way to add new endpoint is to put decorator@target_blueptrint.route(...)before target function.When adding endpoint to OpenAPI that decorator had to be replaced with@openapi_route(route, blueprint)imported fromperun.proxygui.openapi.openapi_data. Next step is to create additional entry indatadictionary, also in that file. That entry has a format of nested dictionary. Example:"/example_endpoint":{#Keyisroutetotheendpoint"desc":"Endpoint description",#OPRIONAL,Fulldescriptionofendpoit"sum":"Endpoint summary",#OPRIONAL,Briefdescriptionofendpoint#(e.g.name,purpose,...)"security":[{"NegotiateAuth":[]}],#OPTIONAL,schemechoosedfromdictionary#definedin`openapi.py`"response":{"status":HTTPStatus.OK,#OPTIONAL"schema":redirect_response#OPTIONALclassnameofdescribingscheme,describedbelow"example":{"_text":"Example resonse"}#Examplethatiscompatiblewithschema},"arguments":[#OPTIONALlistofendpointsarguments{"location":"path",#Exampleofargumentinpath"schema":schemaclass},{"location":"files",#Exampleofrequestargument"schema":file_upload_schema,"description":"argument description"},...],"alt_responses":[#OPTIONAL{#Listofresponsedictionaries}]},schemaschema of endpoint response, in runtime response is check against this sheme (if it is defined, if not, response is not checked at all), when not matched typically respond contains only empty dict. If it is defined, it has two variants (similar scheme is used to define arguments):JSON / jsoify- create simple class from marshmallowSchemaclass, with attributes that aresame as returned JSON from endpoint (basically that class wraps those attributes as JSON dictionary)
Example:classdelete_consent_schema(marshmallow.Schema):deleted=fields.Boolean()message=fields.String()Response / redirect / abort- in case of these responses, scheme in response decorator can be custom (it is ignored when creating endpoint response)String- redo to JSON with already created schemastring_schemawith only atribute_text. Then in response handeling add additionaljson.loads()wrapping functionreturnjsonify({"_text":"Original String text"})