From 86da48d0c37939a411bd0603f45669f0d0da2ebd Mon Sep 17 00:00:00 2001 From: Arthur Schiwon Date: Thu, 9 Nov 2023 23:01:47 +0100 Subject: [PATCH] feat(user_saml): group information for SAML integration tests Signed-off-by: Arthur Schiwon --- user_saml-dirsrv/Dockerfile | 5 ++++ user_saml-dirsrv/conf/entries.ldif | 26 +++++++++++++++++++ .../shibboleth-idp/conf/attribute-filter.xml | 8 ++++++ .../conf/attribute-resolver.xml | 24 +++++++++++++++-- .../shibboleth-idp/conf/ldap.properties | 5 +++- 5 files changed, 65 insertions(+), 3 deletions(-) diff --git a/user_saml-dirsrv/Dockerfile b/user_saml-dirsrv/Dockerfile index 682cc699..78b231c0 100644 --- a/user_saml-dirsrv/Dockerfile +++ b/user_saml-dirsrv/Dockerfile @@ -23,6 +23,11 @@ RUN /usr/libexec/dirsrv/dscontainer -r & \ dsconf localhost backend create --suffix dc=idptestbed --be-name ci_root; \ mv /var/opt/98nextcloud-schema.ldif /etc/dirsrv/slapd-localhost/schema/; \ dsconf localhost schema reload; \ + dsconf localhost plugin memberof enable; \ + dsconf localhost plugin memberof set --autoaddoc inetOrgPerson; \ + dsctl localhost restart; \ + dsconf localhost plugin memberof status; \ + dsconf localhost plugin memberof show; \ dsconf localhost backend import "dc=idptestbed" /var/opt/entries.ldif; \ rm /var/opt/entries.ldif; diff --git a/user_saml-dirsrv/conf/entries.ldif b/user_saml-dirsrv/conf/entries.ldif index 3ba1998a..efda14b0 100644 --- a/user_saml-dirsrv/conf/entries.ldif +++ b/user_saml-dirsrv/conf/entries.ldif @@ -1,3 +1,4 @@ +# Structure dn: dc=idptestbed objectClass: top @@ -23,10 +24,13 @@ objectClass: top objectClass: organizationalunit ou: People +# Users + dn: uid=student1,ou=People,dc=idptestbed objectClass: organizationalPerson objectClass: person objectClass: top +objectClass: inetuser objectClass: inetOrgPerson objectClass: nextcloudUser givenName: Stud @@ -41,6 +45,7 @@ dn: uid=student2,ou=People,dc=idptestbed objectClass: organizationalPerson objectClass: person objectClass: top +objectClass: inetuser objectClass: inetOrgPerson objectClass: nextcloudUser givenName: Stud @@ -55,6 +60,7 @@ dn: uid=staff1,ou=People,dc=idptestbed objectClass: organizationalPerson objectClass: person objectClass: top +objectClass: inetuser objectClass: inetOrgPerson objectClass: nextcloudUser givenName: St @@ -63,3 +69,23 @@ sn: aff cn: St aff mail: staff1@idptestbed.edu userPassword: password + + +# Groups + +dn: cn=Students,ou=Groups,dc=idptestbed +objectClass: groupOfNames +cn: Students +member: uid=student1,ou=People,dc=idptestbed +member: uid=student2,ou=People,dc=idptestbed + +dn: cn=Professors,ou=Groups,dc=idptestbed +objectClass: groupOfNames +cn: Professors +member: uid=staff1,ou=People,dc=idptestbed + +dn: cn=Astrophysics,ou=Groups,dc=idptestbed +objectClass: groupOfNames +cn: Astrophysics +member: uid=student1,ou=People,dc=idptestbed +member: uid=staff1,ou=People,dc=idptestbed diff --git a/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-filter.xml b/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-filter.xml index 92513ef3..124772bd 100644 --- a/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-filter.xml +++ b/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-filter.xml @@ -37,6 +37,14 @@ + + + + + + + + diff --git a/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-resolver.xml b/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-resolver.xml index 0e4a0cd5..0defc801 100644 --- a/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-resolver.xml +++ b/user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-resolver.xml @@ -129,10 +129,15 @@ - + - + + + + + + + + + + + cn + + diff --git a/user_saml_shibboleth-idp/shibboleth-idp/conf/ldap.properties b/user_saml_shibboleth-idp/shibboleth-idp/conf/ldap.properties index b78ca1f2..11bc78a8 100644 --- a/user_saml_shibboleth-idp/shibboleth-idp/conf/ldap.properties +++ b/user_saml_shibboleth-idp/shibboleth-idp/conf/ldap.properties @@ -21,13 +21,14 @@ idp.authn.LDAP.trustStore = %{idp.home}/credentials/ldap-s ## Return attributes during authentication ## NOTE: this is not used during attribute resolution; configure that directly in the ## attribute-resolver.xml configuration via a DataConnector's element -idp.authn.LDAP.returnAttributes = cn,businessCategory,mail +idp.authn.LDAP.returnAttributes = cn,mail,quota,groups ## DN resolution properties ## # Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator # for AD: CN=Users,DC=example,DC=org idp.authn.LDAP.baseDN = ou=people,dc=idptestbed +idp.authn.LDAP.groupBaseDN = ou=groups,dc=idptestbed #idp.authn.LDAP.subtreeSearch = false idp.authn.LDAP.userFilter = (uid={user}) # bind search configuration @@ -42,11 +43,13 @@ idp.authn.LDAP.dnFormat = uid=%s,ou=people,dc=idptestbed # LDAP attribute configuration, see attribute-resolver.xml idp.attribute.resolver.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL} idp.attribute.resolver.LDAP.baseDN = %{idp.authn.LDAP.baseDN} +idp.attribute.resolver.LDAP.groupBaseDN = %{idp.authn.LDAP.groupBaseDN} idp.attribute.resolver.LDAP.bindDN = %{idp.authn.LDAP.bindDN} idp.attribute.resolver.LDAP.bindDNCredential = %{idp.authn.LDAP.bindDNCredential} idp.attribute.resolver.LDAP.useStartTLS = %{idp.authn.LDAP.useStartTLS:true} idp.attribute.resolver.LDAP.trustCertificates = %{idp.authn.LDAP.trustCertificates} idp.attribute.resolver.LDAP.searchFilter = (uid=$requestContext.principalName) +idp.attribute.resolver.LDAP.groupFilter = (&(objectclass=groupOfNames)(member=uid=$requestContext.principalName,ou=People,*)) # LDAP pool configuration, used for both authn and DN resolution #idp.pool.LDAP.minSize = 3