SAML is one of the main solution for offering SSO with LDAP and OpenId Connect. In Hue, this happens with the SAML2Backend Django Backend.
e.g. In addition to SSO, only allow to authenticate a user if he belongs to a set of SAML groups. (note: if we want to allow the authentication if ANY group is matching instead of ALL the groups we would need an extra parameter).
We could add the list of requires groups in libsaml:
[libsaml]
# Comma separated list of group names which are all required to authenticate successfully.
## required_groups=['admin', 'sales']
## required_groups_attribute='groups'
And in the SAML2Backend class, we could override is_authorized to take care of the logic:
def is_authorized(self, attributes, attribute_mapping):
"""Hook to allow custom authorization policies based on
SAML attributes.
"""
return set(required_groups) & set(attributes[REQUIRED_GROUPS_ATTRIBUTES.get()])
Note: this solution is hardcoded with the concept of groups. We might want or not generifying to any other attribute. But if not a concern, it should be good enough for a v1.
Note: we should contribute back some short def is_authorized documentation to https://github.com/knaperek/djangosaml2/ as this would be a neat feature to promote.
Add tests (with the help of the Mock module) to check if: