Package: satosacontrib.perun
satosacontrib.perunMicroservices forSATOSAauthentication
proxy, made by the Perun team.BackendsSeznam backendA backend for SATOSA which implements login
usingSeznam OAuth.Use theexample configand fill in your client
ID and client secret.MicroservicesAuthSwitcher LiteThis request microservice takes ACRs (AuthnContextClassRefs in SAML, acr_values in OIDC)
from a frontend
and sets them as requested ACRs for the backends. It relies
onSATOSA!419Context attributes microserviceThe microservice adds the target IdP data to attributes:display namelogotarget issuerTheMetaInfoIssuermicroservice needs to be run beforehand with the
followingpatch.
Anotherpatchis
also needed for the satosa package until they are incorporated into the upstream.Is banned microserviceThe microservice connects to database storing user bans and redirects banned users to
configured URL.Requires a MongoDB database (specified in config).Persist authorization params microserviceThis request microservice retrieves configured parameters from GET or POST request (if
available) and
stores the values to internal context state.Forward authorization params microserviceThis request microservice retrieves configured parameters from GET or POST request (if
available) and
forwards them through a context parameter. Optionally,default_valuescan be
provided in the config file. These will be forwarded for configured SP and/or IdP if
not provided in the GET/POST request. If the parameter with preconfigured
default value is sent via GET/POST request anyway, the value form the request will be
used instead of the default.Session started with microserviceThis Satosa microservice checks, if configured attribute's value is present
in "session_started_with" values (retrieved by Persist authorization params
microservice).
If so, adds attribute with configured name. The value is expected to be converted
to boolean by Attribute typing microservice.Compute eligibility microserviceThe microservice obtains dict with format { eligiblility_type: <unix_timestamp> }
from the internal data and runs a function configured for the
given eligibility type. The config is of formattype: function_path.The function should have a following signature:example_func(data: InternalData, *args, **kwargs) -> timestamp | bool, and it either
returnsFalseor
a new timestamp, in which case the time in the dictionary is
updated in internal data. It strongly relies on the PerunAttributes microservice to fill
the dict
beforehand. If you want to update eligibility in the IDM, use the UpdateUserExtSource
microservice.NameID Attribute microserviceThis microservice copies SAML NameID to an internal attribute with preconfigured name (
and format).It has two modes of operation. The deprecated way of configuring the microservice
requires the config to
includenameid_attribute: saml2_nameid_persistent, wheresaml2_nameid_persistentstands for the name of the SAML NameID
attribute in format:urn:oasis:names:tc:SAML:2.0:nameid-format:persistent. The new way
of configuring this
microservice expects a dictionary namednameid_attributescontaining items
likesaml2_nameid_format: saml2_nameid_attribute. In case of the newer configuration,
both the format and attribute need
to be configured correctly in order for the NameID attribute to be copied to the
internal attribute.If one of the ways to use the microservice is configured, it will be used. If both ways
are configured, the newer way of
configuration - dictionary, will be used.Demonstrations of both ways of configuration are shown in the example config.Attribute typing microserviceConverts boolean attributes specified in config underboolean_attributesto bool type.
It does this by having list of possible values for bothtrueandfalse. Unknown values are converted to None.Auth event logging microserviceCaptures and logs authentication and authorization events. It extracts data from incoming requests
and records this information in a database.Requires a PostgreSQL database.Cardinality single microserviceConvert single-valued attributes specified inconfig["attributes"]from lists to strings.Is eligible microserviceObtains dict with format { eligiblility_type: <unix_timestamp> } and compares the eligibility timestamp
of each type with preconfigured thresholds. All applicable eligibility
intervals for each eligibility_type are included in the result.Thresholds are defined in config undersupported_eligibility_types: type: suffixes:.
To get a clearer idea, see example config.Targeted attributes are specified in the configuration under thetarget_attributesparameter.
If it isn't provided, it the defaults to usingeduPersonAssuranceinstead.Multi Idp hint microserviceMicroservice designed to process multi-valued identity provider hints (idphint) in authentication requests.
It maps entity IDs based onentity_id_mappingin config, generates a WAYF filter, and updates the discovery service URL accordingly.Proxy statistics microserviceCollects and logs statistics related to authentication and authorization events.
It interacts with a database to store data about IDPs, SPs, and user logins.Depends on external PostgreSQL db. Needs package driverpsycopg2-binary.
If driver is changed in the config, corresponding package needs to be installed instead.Requester client ID microservicesSendRequesterClientIDreads the current requester ID and puts it into a query parameter for next authentication.ForwardRequesterClientIDreads requester client ID from a query parameter
and puts it into state for the SAML backend to send as SAML requester ID.Perun MicroservicesSubpackage of microservices connecting to perun. These have to be allowed (or not
denied) for
a given combination of requester/target_entity in order to run.Additional IdentifiersTakes user attributes by config, checks values with regexes and creates hashes by
specified algorithm. Values prepared to hash are parsed into List of List of strings and
serialized with json. User ext source and user is found by mathing this hashes.
If not even one hash can be created, user will be redirected to error page.
If user is not found, he will be redirected to registration page.This microservice does not update the user in Perun with new values. To update save
freshly computed values for the
current user, you need to runupdate_user_ext_sourcemicroservice.RFC - eduTEAMS Identifier GenerationDifferences between our soulution and RFC:the selections are represented as list of list of attributes values serialized to JSONall identifiers are hashed by same hash function and with same saltThe user’s home IdP entity-id does not need to be part of selectionhashed values can be scoped but does not have to beAttributesThis Satosa microservice fetches user attributes by its names listed
as keys ofattrMapconfig property and sets them as Attributes
values to keys specified as attrMap values. Old values of
Attributes are replaced.It strongly relays on PerunIdentity microservice to obtain perun
user id. Configure it properly before using this microservice.It offers two modes: PARTIAL and FULL, configurable via themodesetting in the config, with FULL being the default.
FULL mode includes allattrMapattributes, while PARTIAL mode includes them only if they're false/empty in bothattrMapor given data.EntitlementCalculates Perun user's entitlements by joiningeduPersonEntitlements,forwardedEduPersonEntitlements, resource capabilities and facility capabilities.Without thegroup_entitlement_disabledattribute set, user's entitlements are
computed based on all user's groups on facility.Whengroup_entitlement_disabledis set, resources
which have this attribute set totrueare excluded from the computation.
This means that for a group to be included in the computation,
it needs to be assigned through at least one resource without this attribute set totrue.Ensure memberThis Satosa microservice checks member status of the user and calls registration if needed.
Register page is set inconfig['register_url'].Perun userRegisters a new perunuser endpoint which looks for user's credentials in external service defined byconfig["proxy_extsource_name"].
Found user is registered and if the registration was successful, also loaded.If a user wasn't found in the external system. Redirects user to a registration page if possible,
otherwise raises SATOSAError.Registration page url is taken from config'sregistration_page_url. Failure to initiate registration results in unauthorized access.SP AuthorizationProvides group based access control.Without theproxy_access_control_disabledattribute set, this microservice denies access
to users who are not members of any group assigned to any resource on the current
facility.If theproxy_access_control_disabledattribute is defined in config, resources which
have this attribute set to true are excluded. Groups assigned to these resources are
not counted towards user's groups on the current facility. This means, that the user
has to be a member of at least one group assigned to a resource without this
attribute set.This feature allows computing entitlements while excluding groups which should not be
allowed to access the current service.Update user ext sourceThis microservice updatesuserExtSourceattributes when the user logs in.Addons for SATOSA-oidcop frontendUserinfo perun updatesSATOSA by default caches user data in subsequent calls of the userinfo endpoint.
Thanks to this addon the data is loaded from Perun IDM on each call so they are always
up to date.Requires a configuration for the entitlement microservice in/etc/satosa/plugins/microservices/perun_entitlement_idm.yaml.How to use:add this to the configuration file of satosa-oidcop frontend, under the keyadd_on:userinfo_perun_updates:function:satosacontrib.perun.addons.userinfo_perun_updates.add_supportkwargs:{}Extended introspection responseImplementsRFC 9470which states that two attributes(acr and auth_time) should be in introspection endpoint. This addon gets them from session manager.How to use:add this to the configuration file of satosa-oidcop frontend, under the keyadd_on:extended_introspection_response:function:satosacontrib.perun.addons.extended_introspection_response.add_supportkwargs:{}