Support SAML and OAuth2 logins as consumer #236

New issue

Closed

opened 2020-04-30 12:17:13 +02:00 by nik · 10 comments

nik commented 2020-04-30 12:17:13 +02:00

Owner

Copy link

No description provided.

nik commented 2020-04-30 12:17:24 +02:00

Author

Owner

Copy link

changed title from Support S{-MA-}L and OAuth2 logins as consumer to Support S{+AM+}L and OAuth2 logins as consumer

changed title from **Support S{-MA-}L and OAuth2 logins as consumer** to **Support S{+AM+}L and OAuth2 logins as consumer**

hansegucker commented 2020-04-30 12:18:03 +02:00

Owner

Copy link

We should also support Kerberos.

We should also support Kerberos.

nik commented 2020-04-30 12:22:20 +02:00

Author

Owner

Copy link

I am not in favour of supporting Kerberos directly. There are quite a few approaches:

• To authenticate passwords against Kerberos, use the LDAP SASL proxy scheme to load it off to slapd, or use PAM (feature request to support PAM logins is open)
• To support GSSAPI, rather use the RemoteUserBackend and load authentication off to the webserver, which will provide an HTTP header with the authenticated username

Directly supporting Kerberos is quite complex, and in my opinion does not provide any benefits, so having the user running AlekSIS get a service token and keytab is an unnecessary risk where security can also be handled by components further down the stack.

I am not in favour of supporting Kerberos directly. There are quite a few approaches: * To authenticate passwords against Kerberos, use the LDAP SASL proxy scheme to load it off to slapd, or use PAM (feature request to support PAM logins is open) * To support GSSAPI, rather use the RemoteUserBackend and load authentication off to the webserver, which will provide an HTTP header with the authenticated username Directly supporting Kerberos is quite complex, and in my opinion does not provide any benefits, so having the user running AlekSIS get a service token and keytab is an unnecessary risk where security can also be handled by components further down the stack.

tteichler commented 2020-06-04 20:04:29 +02:00

Owner

Copy link

created merge request !1946 to address this issue

created merge request !1946 to address this issue

tteichler commented 2020-06-04 20:04:30 +02:00

Owner

Copy link

mentioned in merge request !1946

mentioned in merge request !1946

nik commented 2020-06-28 12:02:34 +02:00

Author

Owner

Copy link

removed milestone

removed milestone

nik commented 2020-12-26 22:47:14 +01:00

Author

Owner

Copy link

unassigned @debdolph

unassigned @debdolph

nik commented 2020-12-26 22:48:02 +01:00

Author

Owner

Copy link

assigned to @debdolph

assigned to @debdolph

tteichler commented 2020-12-26 22:48:36 +01:00

Owner

Copy link

mentioned in merge request !2058

mentioned in merge request !2058

hansegucker closed this issue 2021-05-21 16:38:45 +02:00

hansegucker commented 2021-05-21 16:38:52 +02:00

Owner

Copy link

mentioned in commit 6ca32fa347

mentioned in commit 6ca32fa3478a9f5a9060f9b528bc134ec28a73f6

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

master

3960-extend-slideiterator

1625-migrate-to-vuetify-4

remove-vite-legacy-plugin

weblate-frontend

weblate

renovate/selenium-4.x

1644-dahsboard-widget-creation-broken

renovate/node-26.x

renovate/django-health-check-4.x

renovate/django-countries-9.x

1643-calendar-dashboardwidgets-throw-500er-error

renovate/django-dbbackup-5.x

1064-backchannel-logout

sis2-with-sl

fix/adapt-some-urls

1533-notifications-reminders-for-events-todos

1294-expose-free-busy-state-in-ui-for-personal-events

1303-correctly-implement-recurring-todos-with-amends-recurrence-id

1345-introduce-annotate-methods-for-more-person-related-rules

1603-search-index-is-deleted-on-cache-flush

1068-oidc-rp-initiated-registration

1065-oidc-device-code-grant-flow

1599-vite-build-fails-with-too-many-apps

fix/sort-models

1066-oidc-dynamic-client-registration

tmp-ticdesk-dev

ticdesk-search-map

cherry-pick-2b8d2e01

643-one-time-login-links

1461-birthday-calendar-oom

tmp-ticdesk-related-names-for-paweljong

1459-manifest-json-not-found

integrate-disable-into-usecrud

update-container-image-base-to-trixie

check/update-pyproject-toml

check/update-builddeps-package-json

check/update-prettier-ignore

1445-todo-list-broken

1364-track-date-of-beginning-and-end-of-group-membership

1259-generalise-places

use-object-form-reactivity

1435-cruddaylist-does-not-detect-changes-in-existing-intervals

tmp-ticdesk

stable/4.0.0

1366-frontend-for-creating-and-modifying-generic-personrelationships

master-without-vue-3

1376-expand-row-feature-of-v-data-table-doesn-t-work-when-items-include-date-time-objects

release/4.1.0.dev2

1372-fix-import-of-crudlist

1353-adapt-chipselectfield

check/update-eslint-rc-js

check/update-tox-ini

improve-selenium-startup

1268-add-specific-availability-planning-frontend

1343-fix-person-related-permissions

newer-and-rebased-migrate-crud-to-vue-3-and-generalize

1314-fix-handling-of-end-datetime-in-calendar-events-query

migrate-to-uv

tmp-ticdesk-4-0

fix-inline-crud-list-is-create

tmp-split-calendar-event-dialog

release/4.1.0

1260-refactor-account-registration-form-and-generalize-parts-of-it

add-datacheck-fix-in-changelog

1232-group-calendars

1251-registryobjects-are-their-own-parent-registries

1209-introduce-django-rest-framework-serializers

1162-strange-behaviour-with-personal-events

revert-7fe8b8b1

check/delete-eslint-rc-js

check/update-gitignore

stable-3.2

stable-3.1

update/eslint

1158-add-sorting-functionality-to-get_single_events

1055-introduce-sub-school-terms

1082-colorfield-sometimes-returns-8-digit-alpha-color-hex-code

test-build

emit-extracted-items-from-save-event

886-prevent-graphql-query-mutation-name-collisions

release/3.2.1

1038-make-dialogobjectform-send-a-diff-on-edit-instead-of-the-whole-object

release/3.1.6

fix/counter-chip

1021-allow-matching-of-social-accounts-to-local-accounts-by-email

991-set-title-attribute-for-all-unclear-frontend-spots

update-docs-without-release-distribution

850-do-not-restart-vite-serve-on-every-uwsgi-reload

991-use-tooltips-for-all-unclear-frontend-spots

983-add-groups-by-person-query

826-otp-token-emails-don-t-contain-anything-besides-the-token

781-error-if-creating-a-new-school-term-without-a-start-and-end-date

966-allow-setting-of-custom-queryset-when-creating-calendar-feeds

tmp-for-add-simple-course-book-list

release/3.2.0

868-introduce-uuid-field-for-extensiblemodel

958-introduce-parent-model-resource

954-evaluate-strawberry-and-strawberry-django

948-error-handling-with-personal-event-creation-is-not-usable

fix-custom-events-fss

923-introduce-vue-styleguidist

899-move-person-type-fields-into-constant

892-remove-model-extension-api

manage-holidays

831-data-management-for-the-model-room

fix/oauth-toolkit-migration

release-3.0

stable-2.12

819-fix-some-minor-issues-in-graphql-queries

fix-container-image

stable-2.11

stable-2.10

stable-2.13

806-expose-string-representation-of-models-via-graphql-api

800-move-generic-components-from-aleksis-app-plank-to-core

debug-foo

oidc-docs

migrate-to-vue3

789-remove-syncable-fields

remove/ical-feed

194-enable-async-framework-channels

726-dynamically-build-vue-forms

766-selfclosing-components-in-vue_base-html-break-the-page

492-follow-up-view_persons_rule-not-usable-due-to-use-of-queryset_rules_filter

751-include-fields-of-non-extensible-model-in-syncable-fields

kort-core

feature/vuejs

717-docker-improve-image-size-by-fixing-cleanup-layer

build-improvements

697-3-0-meta-issue-for-graphql-back-end-and-vue-js-frontend

185-create-notifications-for-announcement

stable-2.7

update/translation-files-13

update/translation-files-12

599-add-oauth-oidc-tests

i10n-ru-ua

tmp/cbes

do-release-2.9

docs/notifications

180-add-template-management

fix-import

653-remove-cachalot

635-test-e-mail-button

397-dedicated-public-dashboard

396-external-link-widet-auto-discovery

511-allow-custom-redirect-uri-schemes

update/translation-files-8

585-barcode-widget-for-person-fields

dot-1.6.2

281-corporate-design-for-html-mails

592-oauth2-broken-in-2-4

574-rewrite-password-change-templates

reduce-docker-steps

571-age-calculation-broken

559-oauth-add-feature-to-limit-apps-to-groups

feature/push-notifications

feature/i18n-maintenance

fix/oauth-skip-auth-detail

523-integrate-sentry-for-performance-and-error-tracing

prepare-release-2.1.dev0

release/2.0

387-jwt-provider-consumer-support

update/translation-files

496-service-worker-safari-does-not-support-broadcastchannel-api

group-members-permissions

prepare-release-2.0b2

fix/trans-conflicts

bp-2.0-use-importlib-instead-of-pkg-resources

update/translation-files-2.0b0-1

test-migration-test

376-prevent-deep-linking-to-media-files

feature/build-icons-automatically

421-update-to-django-3-2

set-sast-config-1

feature/test-selenium-capabilities

arg-apps

feature/review-app

test-docker-app-version

feature/allow-app-source

fix-ci-config

feature/curlylint

feature/gin-index-on-ext-data

backup-over-ssh

feature/keep_local_password_ldap

340-correctly-implement-the-ckeditor

143-mark-menu-entries-as-active-with-sub-sub-menu-entries

feature/django-notifs

2021-update-copyright

catch-error

update/poetry

selenium

269-photo-cropping-broken-2

269-photo-cropping-broken

fix-docker-build

has-person

update-poetry-lockfile

pages-staging

mix/conn-dne

236-support-saml-and-oauth2-logins-as-consumer

feature/custom-auth-backends-dev

dev

fix-isort

214-add-notification-dashboard-widget-anything-to-notify-of-upcoming-birthdays

157-include-django-letsagree

215-add-geolocation-of-persons

267-lint-add-spell-check

291-rename-template-references

270-ci-replace-kaniko-with-buildah

217-add-support-for-defining-group-types

feature/docker-extras

153-use-complex-name-field-with-i18n-support

debug-docker-build

feature/material-admin

pages-jonglieren

179-group-contact

169-support-nextcloud-talk-for-notifications

develop-dashboard-feeds

134-merge-dashboard-ajax

5.3.0

5.2.0

5.1.0

5.0.3

5.0.2

5.0.1

5.0.0

5.0.0b3

5.0.0b2

5.0.0b1

5.0.0b0

4.1.0.dev2

4.0.4

4.1.0.dev1

4.1.0.dev0

4.0.3

4.0.2

4.0.1

4.0.0

4.0.0.dev16

3.2.2

3.1.7

4.0.0.dev15

4.0.0.dev14

4.0.0.dev13

4.0.0.dev12

4.0.0.dev11

3.1.6

3.2.1

4.0.0.dev10

4.0.0.dev9

4.0.0.dev8

4.0.0.dev7

4.0.0.dev6

4.0.0.dev5

4.0.0.dev4

4.0.0.dev3

4.0.0.dev2

4.0.0.dev1

3.2.0

3.1.5

3.1.4

3.1.3

3.1.2

3.1.1

3.1

3.0

2.12.4

3.0b3

3.0b2

2.10.3

2.11.2

2.12.3

3.0b1

3.0b0

3.0.dev3

2.12.2

3.0.dev2

2.12.1

2.12

2.11.1

2.11

2.10.2

3.0.dev1

2.10.2.dev0

3.0.dev0

2.10.1

2.10

2.7.6

2.7.5

2.9

2.8.2.dev2

2.8.2.dev1

2.8.2.dev0

2.8.1

2.8.1.dev0

2.8

2.7.4

2.7.3

2.7.2

2.7.1

2.7

2.6

2.5

2.4

2.3.2

2.3.1

2.3

2.2.1

2.2

2.1.1

2.1

2.1.dev0

2.0

2.0rc7

2.0rc6

2.0rc5

2.0rc4

2.0rc3

2.0rc2

2.0rc1

2.0b2

2.0b1

2.0b0

2.0a4

2.0a3

2.0a2

2.0a1

1.0a3.1

1.0a3

1.0a2

1.0a1

1.0a0

0.1

Labels

Clear labels   

Security

  

TeX

Needs LaTeX template

  

auto-update

  

board

done

  

board

ready

  

board

todo

  

check

delete-eslint-rc-js

  

check

update-builddeps-package-json

  

check

update-eslint-rc-js

  

check

update-gitignore

  

check

update-merge-request-template

  

check

update-prettier-ignore

  

check

update-pyproject-toml

  

check

update-renovate-json

  

check

update-tox-ini

  

part

backend

Backend (view code, models, logic, etc.)

  

part

ci

  

part

docs

Issue or addition to the documentation

  

part

frontend

Frontend (templates, etc.)

  

part

i18n

Translation or internationalisation issue

  

part

non-technical

Non-technical (policy, maintenance, etc.) issue or discussion

  

part

packaging

Issue concerning the packaging of AlekSIS and components

  

prio

1

Priority High

  

prio

2

Priority Medium

  

prio

3

Priority Low

  

release-mr-5.x

  

size

large

  

size

medium

  

size

small

  

source

customer

Requested by a customer or affiliated user

  

source

customer::fsmw

  

source

customer::fss

  

source

customer::teckids

  

source

downstream

Issue or merge request from other projects using AlekSIS or parts of it

  

type

breaking

  

type

bug

Bug

  

type

feature

New feature

  

type

refactoring

  

workflow

blocked

Issue is blocked by another issue

  

workflow

confirmed

The bug is reproducible and will be fixed

  

workflow

current-todo

  

workflow

discussing

Needs to be discussed before implementation

  

workflow

new-app

Requires new AlekSIS app, which has to be created

  

workflow

wontfix

The bug is not reproducible or the feature was decided against

No labels

Security

TeX

auto-update

board

done

board

ready

board

todo

check

delete-eslint-rc-js

check

update-builddeps-package-json

check

update-eslint-rc-js

check

update-gitignore

check

update-merge-request-template

check

update-prettier-ignore

check

update-pyproject-toml

check

update-renovate-json

check

update-tox-ini

part

backend

part

ci

part

docs

part

frontend

part

i18n

part

non-technical

part

packaging

prio

1

prio

2

prio

3

release-mr-5.x

size

large

size

medium

size

small

source

customer

source

customer::fsmw

source

customer::fss

source

customer::teckids

source

downstream

type

breaking

type

bug

type

feature

type

refactoring

workflow

blocked

workflow

confirmed

workflow

current-todo

workflow

discussing

workflow

new-app

workflow

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

aleksis/AlekSIS-Core#236

No description provided.