Skip to main content

SATOSA Frontend based on idetity python oidcop

Project description

SATOSA oidcop frontend

CI build License PyPI Downloads Downloads per week Python version Conventional commits

SATOSA Frontend based on idpyoidc by Identity Python (previously identity python oidcop).

Features

Endpoints:

  • provider discovery
  • jwks uri
  • authorization
  • token
  • userinfo
  • registration
  • registration_read endpoint
  • introspection endpoint
  • token exchange

Requirements

Setup

pip install satosa_oidcop

Configuration

Anyone can migrate its oidcop configuration, from flask_op or django-oidc-op or whatever, in SATOSA and without any particular efforts. Looking at the example configuration we see that config.op.server_info have a standard SATOSA configuration with the only addition of the following customizations, needed in SATOSA for interoperational needs. These are:

  • autentication
        authentication:
          user:
            acr: urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword
            class: satosa.frontends.oidcop.user_authn.SatosaAuthnMethod
  • userinfo
       userinfo:
         class: satosa.frontends.oidcop.user_info.SatosaOidcUserInfo

authentication inherits oidcop.user_authn.user.UserAuthnMethod and overloads two methods involved in user authentication and verification. These tasks are handled by SATOSA in its authentication backends.

userinfo inherits oidcop.user_info.UserInfo and proposes a way to store the claims of the users when they comes from the backend. The claims are stored in the session database (actually mongodb) and then they will be fetched during userinfo endpoint (and also token endpoint, for having them optionally in id_token claims).

SSO and cookies

oidcop SSO and cookies were not have been implemented because SATOSA does not support logout, because of this they are quite useless at this moment.

Client and Session Storage

MongoDB is the storage, here some brief descriptions for a demo setup. The interface to SATOSA oidcop storage is satosa.frontends.oidcop.storage.base.SatosaOidcStorage and it has three methods:

  • get_client_by_id(self, client_id:str, expired:bool = True)
  • store_session_to_db(self, session_manager, **kwargs)
  • load_session_from_db(self, req_args, http_headers, session_manager, **kwargs)

satosa.frontends.oidcop.storage.mongo.Mongodb overloads them to have I/O operations on mongodb.

Subject type

The client configuration can also include the subject_type key, with permitted values being public and pairwise. If absent, the default is to choose public. This has been driven by backwards compatibility with existing behaviour: oidcop (session_manager.create_session) defaults to public.

For user privacy, we strongly recommend selecting pairwise for new deployments, unless public is absolutely needed (for linking users across related but distinct services).

Demo

Satosa-Saml2Spid is a custom Satosa configuration to deal with many SAML2 and OIDC Relying parties and many eduGain and SPID Identity Provider.

satosa_oidcop

Contributions

Feel free to open issues and pull requests, we build communities!

Developer notes

Storage design

At this time the storage logic is based on oidcop session_manager load/dump/flush methods. Each time a request is handled by an endpoint, the oidcop session manager loads the definition from the storage, only which one are strictly related to the request will be loaded in the in memory storage of oidcop.

Roadmap

Tests

Before you run the tests mind that you've to start a local mongod instance, e.g. with:

sudo docker run \
  --rm \
  -e ALLOW_EMPTY_PASSWORD=yes \
  -e MONGODB_ENABLE_JOURNAL=false \
  -p 27017:27017 \
  --name mongodb \
  bitnami/mongodb:latest

If you like you can use mongo-express as a management UI over the local mongo instance:

sudo docker run \
  -e ME_CONFIG_MONGODB_SERVER=$MONGOHOST-OR-DOCKER-BRIDGE-LIKE-172.17.0.1 \
  -p 8081:8081 \
  mongo-express

Then run the tests:

pip install pytest pytest-cov
pytest --cov=satosa_oidcop -v --cov-report term --cov-fail-under=95 tests/

Authors

  • Giuseppe De Marco @ Università della Calabria

Credits

  • Roland Hedberg
  • Andrea Ranaldi @ ISPRA Ambiente
  • Pavel Břoušek @ CESNET
  • Identity Python Community

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

satosa_oidcop-2.1.1.tar.gz (29.1 kB view details)

Uploaded Source

Built Distribution

satosa_oidcop-2.1.1-py3-none-any.whl (29.0 kB view details)

Uploaded Python 3

File details

Details for the file satosa_oidcop-2.1.1.tar.gz.

File metadata

  • Download URL: satosa_oidcop-2.1.1.tar.gz
  • Upload date:
  • Size: 29.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/4.0.2 CPython/3.11.4

File hashes

Hashes for satosa_oidcop-2.1.1.tar.gz
Algorithm Hash digest
SHA256 79cbedc7a5e5c56e765a267a9a79a2fcebaae74467fa33cb7cf9b6d6a7d82507
MD5 ee6afc01ae047c2f9d14ac81deaeab03
BLAKE2b-256 d1cd62c2debef91798dec42543fef6c2fbff7d6915f98b9d573ae59f46007c29

See more details on using hashes here.

File details

Details for the file satosa_oidcop-2.1.1-py3-none-any.whl.

File metadata

File hashes

Hashes for satosa_oidcop-2.1.1-py3-none-any.whl
Algorithm Hash digest
SHA256 779a6c7bb8822cea50f92d29ce8ae97d89c6f201e385887691967b82a2263e40
MD5 e4b74e8779b564327cad7d146ecb8997
BLAKE2b-256 b0de7cc7cf34d2ffc2c09cacc259d6271e041563a0f38da9298e1b7a952858a5

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page