Open etj opened 1 month ago
There are 2 kinds of users:
External users need also to be created internally in CKAN, because many objects have a foreign key toward an user object; anyway an external user should not be able to log in via username/password using CKAN default auth mechanism.
The external system authentication is called via its own procedure. Full login procedure for CKAN system.
targetUrl
will point back to a CKAN URL that will take care to finalize the authentication.
localhost
is always enabled, so you can test your local CKAN instance without any problem.targetURL
provided in the Auth/Login
call. The redirection will carry with it the query param called token
From now on the SSO system is not needed anymore, if not for logging out the user when requested. All the session info should be retained in CKAN as per a "normal" login, since the session is bound to a user internally stored.
Auth has changed from shibboleth to something similar to a propritary API.
Link to docs: https://servicemanual.services.siag.it/#/nuts-and-bolts/user-authentication/?id=ssocivisbzit Swagger: https://sso.civis.bz.it/swagger/index.html
Sample login procedure
Step1: call to
/api/Auth/Login
Params:
targetUrl
: URL for wich the session token is neededacceptedAuthTypes
: list of auth methods requestedserviceUID
: OPENDATAauthLevel
: authentication level i.e. spid is 2. Default is 0onlyauth
: authentication only or also possibility to retrieve user profile data. Default falselang
: it/deforceLogin
: default falseAs a response to the step 1 we get the URL toward the mycivis portal
Step 2: authentication
After the login you'll get the auth token, e.g.
?token=iromuzdn28uudjozimc2olxhxdv5hnigzh34eju9vi3hiqgcod92fckjhu8sicbu
Using the token you can
/api/Auth/Validate/{token}
get the user profile
/api/Auth/Profile/{token}
-- theonlyAuth
param should be set as in the login callStep 3: logout
At the end of the session call
/api/Auth/Logout
The auth server has a host whitelist for the hosts that needs to use the auth services. localhost is always whitelisted, for all the other hosts we'll need to ask whitelisting for the domains calling sso.civis.bz.it