Bläddra i källkod

HUE-9355 [design] Restrict access based on a list of SAML groups

Romain 5 år sedan
förälder
incheckning
5d6c5383cf
1 ändrade filer med 36 tillägg och 0 borttagningar
  1. 36 0
      docs/designs/authentication/saml.md

+ 36 - 0
docs/designs/authentication/saml.md

@@ -0,0 +1,36 @@
+
+# SAML Authentication with additional group checks
+
+SAML is one of the main solution for offering SSO with LDAP and OpenId Connect. In Hue, this happens with the [SAML2Backend](https://docs.gethue.com/administrator/configuration/server/#saml) [Django Backend](https://docs.djangoproject.com/en/3.0/ref/contrib/auth/).
+
+## Restricting user authentication via a dedicated 'groups' attribute
+
+e.g. In addition to SSO, only allow to authenticate a user if he belongs to a set of SAML groups. (note: if we want to allow the authentication if ANY group is matching instead of ALL the groups we would need an extra parameter).
+
+We could add the list of requires groups in libsaml:
+
+    [libsaml]
+    # Comma separated list of group names which are all required to authenticate successfully.
+    ## required_groups=['admin', 'sales']
+    ## required_groups_attribute='groups'
+
+
+And in the SAML2Backend class, we could override `is_authorized` to take care of the logic:
+
+    def is_authorized(self, attributes, attribute_mapping):
+        """Hook to allow custom authorization policies based on
+        SAML attributes.
+        """
+        return set(required_groups) & set(attributes[REQUIRED_GROUPS_ATTRIBUTES.get()])
+
+Note: this solution is hardcoded with the concept of groups. We might want or not generifying to any other attribute. But if not a concern, it should be good enough for a v1.
+
+Note: we should contribute back some short `def is_authorized` documentation to https://github.com/knaperek/djangosaml2/ as this would be a neat feature to promote.
+
+## Tests
+
+Add tests (with the help of the Mock module) to check if:
+
+* Authentication with group list [] --> rejects
+* Authentication with group list missing one group --> rejetcs
+* Authentication with group list intersecting all the required groups --> succeeds