Skip to content

[WIP] Bug fixes and adding OIDC support to saml2 branch #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mboisson wants to merge 6 commits into
base: saml2
Choose a base branch
from
Open

[WIP] Bug fixes and adding OIDC support to saml2 branch #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1cdafa9
use the same 92-local_auth.py file for all auths. change single quote…
mboisson Jun 18, 2026
51d2ba2
slurm_user must be given to the template
mboisson Jun 18, 2026
017396b
BASE_URL must have a trailing /
mboisson Jun 18, 2026
693a1cf
staff_attributes and required_access_attributes are not parth of auth…
mboisson Jun 18, 2026
012de78
ssl attributes are for saml2 auth, move them there
mboisson Jun 19, 2026
c08a4a1
update SAML config and CSRF_TRUSTED_ORIGINS for BASE_URL with trailin…
mboisson Jun 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion manifests/auth/ldap.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@
before => Uv::Venv['metrix_venv'],
}

file { '/var/www/metrix/userportal/settings/92-local_ldap.py':
file { '/var/www/metrix/userportal/settings/92-local_auth.py':
show_diff => false,
content => epp('metrix/92-local_ldap.py',
{
Expand Down
6 changes: 1 addition & 5 deletions manifests/auth/saml2.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,6 @@
String $ssl_public_cert,
String $idp_metadata,
Array[String] $extra_required_attributes = [],
Array[Hash[String, String]] $staff_attributes = [],
Array[Hash[String, String]] $required_access_attributes = [],
) {
ensure_packages(['libffi-devel', 'xmlsec1', 'xmlsec1-openssl'])

Expand All @@ -30,13 +28,11 @@
require => File['/var/www/metrix'],
}

file { '/var/www/metrix/userportal/settings/92-local_saml2.py':
file { '/var/www/metrix/userportal/settings/92-local_auth.py':
show_diff => false,
content => epp('metrix/92-local_saml2.py',
{
'extra_required_attributes' => $extra_required_attributes,
'staff_attributes' => $staff_attributes,
'required_access_attributes' => $required_access_attributes
}
),
owner => 'apache',
Expand Down
6 changes: 1 addition & 5 deletions manifests/init.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,16 +13,11 @@
String $cluster_name,
String $subdomain,
String $slurm_user = 'slurm',
String $ssl_private_key_file = '/etc/ssl/metrix.private.key',
String $ssl_public_cert_file = '/etc/ssl/metrix.public.cert',
Enum['ldap', 'saml2'] $auth_type = 'ldap',
Array[Hash[String, String]] $staff_attributes = [],
Array[Hash[String, String]] $required_access_attributes = [],
Optional[String] $slurm_db_ip = undef,
Optional[Integer] $slurm_db_port = undef,
Optional[String] $ssl_private_key = undef,
Optional[String] $ssl_public_cert = undef,
Optional[String] $idp_metadata = undef,
) {
include metrix::install
case $auth_type {
Expand All @@ -42,6 +37,7 @@
content => epp('metrix/91-local.py',
{
'password' => $password,
'slurm_user' => $slurm_user,
'slurm_password' => $slurm_password,
'cluster_name' => $cluster_name,
'secret_key' => seeded_rand_string(32, $password),
Expand Down
2 changes: 1 addition & 1 deletion manifests/install.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
class metrix::install (
String $source_url = 'https://github.com/guilbaults/TrailblazingTurtle/archive/refs/tags/v${version}.tar.gz',
String $source_url = "https://github.com/guilbaults/TrailblazingTurtle/archive/refs/tags/v${version}.tar.gz",
String $version = '1.7.0',
String $python_version = '3.13',
) {
Expand Down
4 changes: 2 additions & 2 deletions templates/91-local.py.epp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,10 @@ pymysql.install_as_MySQLdb()
SECRET_KEY = '<%= $secret_key %>'
DEBUG = False

BASE_URL = 'https://<%= $subdomain %>.<%= $domain_name %>'
BASE_URL = 'https://<%= $subdomain %>.<%= $domain_name %>/'

ALLOWED_HOSTS = ['127.0.0.1', 'localhost']
CSRF_TRUSTED_ORIGINS = [BASE_URL]
CSRF_TRUSTED_ORIGINS = [BASE_URL.strip('/')]

AUTH_LDAP_SERVER_URI = 'ldaps://ipa.int.<%= $domain_name %>/'
AUTH_LDAP_BIND_DN = 'uid=admin,cn=users,cn=accounts,<%= $base_dn %>',
Expand Down
4 changes: 2 additions & 2 deletions templates/92-local_saml2.py.epp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
AUTHENTICATION_BACKENDS += ['userportal.authentication.staffSaml2Backend']
SAML_CONFIG['service']['sp']['endpoints']['assertion_consumer_service'] = (BASE_URL + '/saml2/acs/', saml2.BINDING_HTTP_POST)
SAML_CONFIG['entityid'] = BASE_URL + '/saml2/metadata/'
SAML_CONFIG['service']['sp']['endpoints']['assertion_consumer_service'] = (BASE_URL + 'saml2/acs/', saml2.BINDING_HTTP_POST)
SAML_CONFIG['entityid'] = BASE_URL + 'saml2/metadata/'
SAML_CONFIG['key_file'] = '/var/www/metrix/saml2-private.key'
SAML_CONFIG['cert_file'] = '/var/www/metrix/saml2-public.pem'
SAML_CONFIG['encryption_keypairs'][0]['key_file'] = '/var/www/metrix/saml2-private.key'
Expand Down