SATOSA Frontend based on idpyoidc by Identity Python (previously identity python oidcop).
Endpoints:
pip install satosa_oidcop
Anyone can migrate its oidcop configuration, from flask_op or django-oidc-op
or whatever, in SATOSA and without any particular efforts. Looking at the
example configuration we see that
config.op.server_info
have a standard SATOSA configuration with the only
addition of the following customizations, needed in SATOSA for interoperational
needs. These are:
authentication:
user:
acr: urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword
class: satosa.frontends.oidcop.user_authn.SatosaAuthnMethod
userinfo:
class: satosa.frontends.oidcop.user_info.SatosaOidcUserInfo
authentication inherits oidcop.user_authn.user.UserAuthnMethod
and overloads two methods involved in user authentication and verification.
These tasks are handled by SATOSA in its authentication backends.
userinfo inherits oidcop.user_info.UserInfo
and proposes a way to store
the claims of the users when they comes from the backend. The claims are stored
in the session database (actually mongodb) and then they will be fetched during
userinfo endpoint (and also token endpoint, for having them optionally
in id_token claims).
oidcop SSO and cookies were not have been implemented because SATOSA does not support logout, because of this they are quite useless at this moment.
MongoDB is the storage, here
some brief descriptions for a demo setup. The interface to SATOSA oidcop
storage is satosa.frontends.oidcop.storage.base.SatosaOidcStorage
and it has
three methods:
satosa.frontends.oidcop.storage.mongo.Mongodb
overloads them to have I/O
operations on mongodb.
The client configuration can also include the subject_type
key,
with permitted values being public
and pairwise
. If absent, the default is
to choose public
. This has been driven by backwards compatibility
with existing behaviour: oidcop (session_manager.create_session
)
defaults to public
.
For user privacy, we strongly recommend selecting pairwise
for
new deployments, unless public
is absolutely needed
(for linking users across related but distinct services).
Satosa-Saml2Spid is a custom Satosa configuration to deal with many SAML2 and OIDC Relying parties and many eduGain and SPID Identity Provider.
Feel free to open issues and pull requests, we build communities!
At this time the storage logic is based on oidcop session_manager load/dump/flush methods. Each time a request is handled by an endpoint, the oidcop session manager loads the definition from the storage, only which one are strictly related to the request will be loaded in the in memory storage of oidcop.
Before you run the tests mind that you've to start a local mongod instance, e.g. with:
sudo docker run \
--rm \
-e ALLOW_EMPTY_PASSWORD=yes \
-e MONGODB_ENABLE_JOURNAL=false \
-p 27017:27017 \
--name mongodb \
bitnami/mongodb:latest
If you like you can use mongo-express as a management UI over the local mongo instance:
sudo docker run \
-e ME_CONFIG_MONGODB_SERVER=$MONGOHOST-OR-DOCKER-BRIDGE-LIKE-172.17.0.1 \
-p 8081:8081 \
mongo-express
Then run the tests:
pip install pytest pytest-cov
pytest --cov=satosa_oidcop -v --cov-report term --cov-fail-under=95 tests/