Shibboleth: Institution-wide Shibboleth groups

[pdurbin]

As explained in the Shibboleth Functional Requirements Document for Dataverse 4.0, we plan to support Institution-wide Shibboleth groups.

In practice this means creating a groups with names like "All Harvard PIN/Shibboleth Users" or "All testshib.org Shibboleth Users" that pay attention to the "Shib-Identity-Provider" Shibboleth attribute to see if you authenticated via harvard.edu, testshib.org, etc.

You should be able to assign roles to these groups by clicking the "Assign Roles to Users/Groups" button.

[pdurbin]

As of 4a4310b you can log into dvn-build with the "TestShib IdP" and see that you are part of the "All testshib.org Shibboleth Users (&shib/1)" group with the debugging output I added to the screen when Shibboleth is enabled:

These are the commands I used to enable Shibboleth and create the testshib group:

curl -X PUT -d yes $HOST/s/settings/:ShibEnabled

curl -s -X POST -H 'Content-type:application/json' --upload-file data/shibGroupTestShib.json "$HOST/api/groups/shib?key=$ADMIN_KEY"

[pdurbin]

Per @scolapasta I'm giving this to QA but please note that there is something going on with permissions first reported in #1380 such that Shibboleth users aren't seeing the "Add Data" button when they should. "No effect".

This ticket is more about the creation of Shibboleth groups, and assigning roles like this:

Please note that we'd like to automate the addition of Shibboleth groups in #1403

[bencomp]

In the Dataverse.nl situation, all users come through the same IdP: SURFconext. We look at the value of the Organization attribute to determine the user's organisation. Can that attribute be used as well?

[bencomp]

Oh, and 👍 !

[pdurbin]

We look at the value of the Organization attribute to determine the user's organisation. Can that attribute be used as well?

I have a todo in the code that at runtime I should store a hash of "potentially interesting" attributes. I guess this hash should be backed by a table that can be managed by users who have the superuser boolean set to "true".

[kcondon]

@pdurbin I think you meant to pass me #796. I tested that one and then passed along to Mike. Giving you back this one.

[pdurbin]

@kcondon no, a while back I purposely put this in QA per my comment back then: #1401 (comment)

[mheppler]

@pdurbin, no GitHub Issues commenting on vacation.

On Fri, Feb 20, 2015 at 10:24 AM, Philip Durbin notifications@github.com
wrote:

@kcondon https://github.com/kcondon no, a while back I purposely put
this in QA per my comment back then: #1401 (comment)
#1401 (comment)

—
Reply to this email directly or view it on GitHub
#1401 (comment).

[kcondon]

Shib groups can be created and assigned roles. Closing

[pdurbin]

We look at the value of the Organization attribute to determine the user's organisation. Can that attribute be used as well?

@bencomp not as of this writing but I just opened #1515 about this