Skip to content

Commit 8743a9f

Browse files
blagojabozinovskiblagojabozinovski
authored
Merge pull request #130 from keitaroinc/config-declarations-decorator
Add config declarations
2 parents 156aa70 + 0222247 commit 8743a9f

2 files changed

Lines changed: 172 additions & 0 deletions

File tree

‎ckanext/saml2auth/config_declaration.yaml‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
version: 1
2+
groups:
3+
- annotation: ckanext-saml2auth settings
4+
options:
5+
- key: ckanext.saml2auth.idp_metadata.location
6+
example: local
7+
default: remote
8+
description: |
9+
Specifies the metadata location type.
10+
Options: local or remote
11+
required: true
12+
- key: ckanext.saml2auth.idp_metadata.local_path
13+
example: /opt/metadata/idp.xml
14+
default:
15+
description: |
16+
Path to a local file accessible on the server the service runs on.
17+
Ignore this config if the idp metadata location is set to: remote
18+
required: false
19+
- key: ckanext.saml2auth.idp_metadata.remote_url
20+
example: https://kalmar2.org/simplesaml/module.php/aggregator/?id=kalmarcentral2&set=saml2
21+
default:
22+
description: |
23+
A remote URL serving aggregate metadata
24+
Ignore this config if the idp metadata location is set to: local
25+
required: false
26+
- key: ckanext.saml2auth.idp_metadata.remote_cert
27+
example: /opt/metadata/kalmar2.cert
28+
default:
29+
description: |
30+
Path to a local file accessible on the server the service runs on
31+
Ignore this config if the idp metadata location is set to: local and metadata is public
32+
required: false
33+
- key: ckanext.saml2auth.user_firstname
34+
example: name
35+
default: firstname
36+
description: |
37+
Corresponding SAML user field for firstname
38+
required: false
39+
- key: ckanext.saml2auth.user_lastname
40+
example: surname
41+
default: lastname
42+
description: |
43+
Corresponding SAML user field for lastname
44+
required: false
45+
- key: ckanext.saml2auth.user_email
46+
example: emailadress
47+
default: email
48+
description: |
49+
Corresponding SAML user field for email
50+
required: true
51+
- key: ckanext.saml2auth.user_fullname
52+
example: fullname
53+
default: fullname
54+
description: |
55+
Corresponding SAML user field for fullname
56+
(Optional: Can be used as an alternative to firstname + lastname)
57+
required: false
58+
- key: ckanext.saml2auth.enable_ckan_internal_login
59+
example: True
60+
default: False
61+
description: |
62+
Configuration setting that enables CKAN's internal register/login functionality as well
63+
required: false
64+
type: bool
65+
- key: ckanext.saml2auth.sysadmins_list
66+
example: mail@domain.com mail2@domain.com mail3@domain.com
67+
default:
68+
description: |
69+
List of email addresses from users that should be created as sysadmins (system administrators)
70+
Note that this means that CKAN sysadmins will _only_ be managed based on this config option and will override existing user permissions in the CKAN database
71+
If not set then it is ignored and CKAN sysadmins are managed through normal means
72+
required: false
73+
- key: ckanext.saml2auth.allow_unknown_attributes
74+
example: False
75+
default: True
76+
description: |
77+
Indicates that attributes that are not recognized (they are not configured in attribute-mapping),
78+
will not be discarded.
79+
required: false
80+
type: bool
81+
- key: ckanext.saml2auth.sp.name_id_format
82+
example: urn:oasis:names:tc:SAML:2.0:nameid-format:transient
83+
default: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
84+
description: |
85+
A list of string values that will be used to set the <NameIDFormat> element of the metadata of an entity.
86+
required: false
87+
- key: ckanext.saml2auth.sp.name_id_policy_format
88+
example: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
89+
default:
90+
description: |
91+
A string value that will be used to set the Format attribute of the <NameIDPolicy> element of the metadata of an entity.
92+
required: false
93+
- key: ckanext.saml2auth.entity_id
94+
example: urn:gov:gsa:SAML:2.0.profiles:sp:sso:gsa:catalog-dev
95+
default: urn:mace:umu.se:saml:ckan:sp
96+
description: |
97+
Entity ID (also know as Issuer)
98+
Define the entity ID.
99+
required: false
100+
- key: ckanext.saml2auth.want_response_signed
101+
example: False
102+
default: True
103+
description: |
104+
Indicates if SAML responses must be signed.
105+
required: false
106+
type: bool
107+
- key: ckanext.saml2auth.want_assertions_signed
108+
example: True
109+
default: False
110+
description: |
111+
Indicates if SAML assertions must be signed.
112+
required: false
113+
type: bool
114+
- key: ckanext.saml2auth.want_assertions_or_response_signed
115+
example: True
116+
default: False
117+
description: |
118+
If set to true, either the SAML response or the assertion must be signed.
119+
required: false
120+
type: bool
121+
- key: ckanext.saml2auth.key_file_path
122+
example: /path/to/mykey.pem
123+
default:
124+
description: |
125+
Path to the private key file used to sign SAML requests or decrypt assertions.
126+
required: false
127+
- key: ckanext.saml2auth.cert_file_path
128+
example: /path/to/mycert.pem
129+
default:
130+
description: |
131+
Path to the public certificate file used to verify signatures or encrypt assertions.
132+
required: false
133+
- key: ckanext.saml2auth.attribute_map_dir
134+
example: /path/to/dir/attributemaps
135+
default:
136+
description: |
137+
Directory path containing SAML attribute mapping configuration files.
138+
required: false
139+
- key: ckanext.saml2auth.requested_authn_context
140+
example: http://idmanagement.gov/ns/assurance/aal/3?hspd12=true
141+
default:
142+
description: |
143+
Specifies authentication context class references requested during login.
144+
You can provide multiple values separated by spaces.
145+
required: false
146+
- key: ckanext.saml2auth.requested_authn_context_comparison
147+
example: exact
148+
default: exact
149+
description: |
150+
Comparison method for RequestedAuthnContext.
151+
Options: exact, minimum, maximum, better
152+
required: false
153+
- key: ckanext.saml2auth.logout_requests_signed
154+
example: True
155+
default: False
156+
description: |
157+
Indicates whether this service provider will sign logout requests.
158+
required: false
159+
type: bool
160+
- key: ckanext.saml2auth.logout_expected_binding
161+
example: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
162+
default: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
163+
description: |
164+
The expected SAML binding method for logout requests.
165+
required: false
166+
- key: ckanext.saml2auth.default_fallback_endpoint
167+
example: home.index
168+
default: user.me
169+
description: |
170+
The default endpoint to redirect to if no RelayState is provided in the SAML response.
171+
required: false

‎ckanext/saml2auth/plugin.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
log = logging.getLogger(__name__)
3838

3939

40+
@toolkit.blanket.config_declarations
4041
class Saml2AuthPlugin(plugins.SingletonPlugin):
4142
plugins.implements(plugins.IConfigurer)
4243
plugins.implements(plugins.IBlueprint)

0 commit comments

Comments
 (0)