Răsfoiți Sursa

HUE-1676 [core] Make SAML entity ID configurable

Abraham Elmahrek 12 ani în urmă
părinte
comite
87a90d6

+ 30 - 26
desktop/conf.dist/hue.ini

@@ -244,42 +244,46 @@
     ## authenticate_url=https://api.twitter.com/oauth/authorize
 
 
-  ###########################################################################
-  # Settings to configure SAML
-  ###########################################################################
+###########################################################################
+# Settings to configure SAML
+###########################################################################
+
+[libsaml]
+  # Xmlsec1 binary path. This program should be executable by the user running Hue.
+  ## xmlsec_binary=/usr/local/bin/xmlsec1
 
-  [libsaml]
-    # Xmlsec1 binary path. This program should be executable by the user running Hue.
-    ## xmlsec_binary=/usr/local/bin/xmlsec1
+  # Entity ID for Hue acting as service provider.
+  # Can also accept a pattern where '<base_url>' will be replaced with server URL base.
+  ## entity_id="<base_url>/saml2/metadata/"
 
-    # Create users from SSO on login.
-    ## create_users_on_login=true
+  # Create users from SSO on login.
+  ## create_users_on_login=true
 
-    # Required attributes to ask for from IdP.
-    # This requires a comma separated list.
-    ## required_attributes=uid
+  # Required attributes to ask for from IdP.
+  # This requires a comma separated list.
+  ## required_attributes=uid
 
-    # Optional attributes to ask for from IdP.
-    # This requires a comma separated list.
-    ## optional_attributes=
+  # Optional attributes to ask for from IdP.
+  # This requires a comma separated list.
+  ## optional_attributes=
 
-    # IdP metadata in the form of a file. This is generally an XML file containing metadata that the Identity Provider generates.
-    ## metadata_file=
+  # IdP metadata in the form of a file. This is generally an XML file containing metadata that the Identity Provider generates.
+  ## metadata_file=
 
-    # Private key to encrypt metadata with.
-    ## key_file=
+  # Private key to encrypt metadata with.
+  ## key_file=
 
-    # Signed certificate to send along with encrypted metadata.
-    ## cert_file=
+  # Signed certificate to send along with encrypted metadata.
+  ## cert_file=
 
-    # A mapping from attributes in the response from the IdP to django user attributes.
-    ## user_attribute_mapping={'uid':'username'}
+  # A mapping from attributes in the response from the IdP to django user attributes.
+  ## user_attribute_mapping={'uid':'username'}
 
-    # Have Hue initiated authn requests be signed and provide a certificate.
-    ## authn_requests_signed=false
+  # Have Hue initiated authn requests be signed and provide a certificate.
+  ## authn_requests_signed=false
 
-    # Have Hue initiated logout requests be signed and provide a certificate.
-    ## logout_requests_signed=false
+  # Have Hue initiated logout requests be signed and provide a certificate.
+  ## logout_requests_signed=false
 
 ###########################################################################
 # Settings to configure your Hadoop cluster.

+ 4 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -257,6 +257,10 @@
   # Xmlsec1 binary path. This program should be executable by the user running Hue.
   ## xmlsec_binary=/usr/local/bin/xmlsec1
 
+  # Entity ID for Hue acting as service provider.
+  # Can also accept a pattern where '<base_url>' will be replaced with server URL base.
+  ## entity_id="<base_url>/saml2/metadata/"
+
   # Create users from SSO on login.
   ## create_users_on_login=true
 

+ 6 - 0
desktop/libs/libsaml/src/libsaml/conf.py

@@ -43,6 +43,12 @@ XMLSEC_BINARY = Config(
   type=str,
   help=_t("Xmlsec1 binary path. This program should be executable by the user running Hue."))
 
+ENTITY_ID = Config(
+  key="entity_id",
+  default="<base_url>/saml2/metadata/",
+  type=str,
+  help=_t("Entity ID for Hue acting as service provider. Can also accept a pattern where '<base_url>' will be replaced with server URL base."))
+
 CREATE_USERS_ON_LOGIN = Config(
   key="create_users_on_login",
   default=True,

+ 4 - 1
desktop/libs/libsaml/src/libsaml/saml_settings.py

@@ -30,12 +30,15 @@ BASE_URL = "%(protocol)s%(host)s:%(port)d" % {
   'port':  desktop.conf.HTTP_PORT.get()
 }
 
+ENTITY_ID = libsaml.conf.ENTITY_ID.get().replace('<base_url>', BASE_URL)
+
+
 SAML_CONFIG = {
   # full path to the xmlsec1 binary programm
   'xmlsec_binary': libsaml.conf.XMLSEC_BINARY.get(),
 
   # your entity id, usually your subdomain plus the url to the metadata view
-  'entityid': "%s/saml2/metadata/" % BASE_URL,
+  'entityid': ENTITY_ID,
 
   # directory with attribute mapping
   'attribute_map_dir': libsaml.conf.ATTRIBUTE_MAP_DIR.get(),