From 244f093fe5d0d44ab622fcff0a373a70187c20b2 Mon Sep 17 00:00:00 2001 From: Dimitris Papagiannis Date: Tue, 8 Aug 2023 12:26:56 +0200 Subject: [PATCH 1/2] Update to use OIDC --- .env_sample | 13 +++++++++ .gitignore | 5 ++++ home/templates/home/login.html | 48 ++++++++++++++-------------------- mlp/settings.py | 35 ++++++++++++++++++++++--- 4 files changed, 68 insertions(+), 33 deletions(-) create mode 100644 .env_sample diff --git a/.env_sample b/.env_sample new file mode 100644 index 0000000..df81708 --- /dev/null +++ b/.env_sample @@ -0,0 +1,13 @@ +DJANGO_SECRET_KEY= +DIR_PATH_DQMIO_STORAGE= +DJANGO_DATABASE_ENGINE=django.db.backends.postgresql +DJANGO_DATABASE_NAME=testmlp +DJANGO_DATABASE_USER=postgres +DJANGO_DATABASE_PASSWORD=postgres +DJANGO_DATABASE_PORT=5432 +DJANGO_DATABASE_HOST=127.0.0.1 +DJANGO_ALLOWED_HOSTS=* +DJANGO_DEBUG=True +SITE_ID=1 +CERN_SSO_REGISTRATION_CLIENT_ID= +CERN_SSO_REGISTRATION_CLIENT_SECRET= \ No newline at end of file diff --git a/.gitignore b/.gitignore index 54649af..43bca51 100644 --- a/.gitignore +++ b/.gitignore @@ -103,3 +103,8 @@ venv/ node_modules/ package.json package-lock.json + + +*.crt +*.key +.env_* diff --git a/home/templates/home/login.html b/home/templates/home/login.html index a90eeec..524533a 100644 --- a/home/templates/home/login.html +++ b/home/templates/home/login.html @@ -19,7 +19,9 @@ border-color: #0033a0; } - .btn-cern:hover, .btn-cern:active, .btn-cern:focus { + .btn-cern:hover, + .btn-cern:active, + .btn-cern:focus { background-color: #0033a0; border-color: #0033a0; } @@ -38,6 +40,7 @@ border-bottom-right-radius: 0; border-bottom-left-radius: 0; } + .form-signin input[type="password"] { margin-bottom: 10px; border-top-left-radius: 0; @@ -51,8 +54,9 @@
{% if user.is_authenticated %} {% else %} @@ -64,7 +68,7 @@

Log in

{% if form.non_field_errors %}
{% for error in form.non_field_errors %} - {{ error|escape }} + {{ error|escape }} {% endfor %}
{% endif %} @@ -72,19 +76,21 @@

Log in

- +
- +
- +
- +
- +
@@ -92,7 +98,8 @@

Log in

- - +
{% endif %} -{% endblock content %} +{% endblock content %} \ No newline at end of file diff --git a/mlp/settings.py b/mlp/settings.py index 3bd46db..934c1fc 100644 --- a/mlp/settings.py +++ b/mlp/settings.py @@ -69,12 +69,9 @@ "allauth", "allauth.account", "allauth.socialaccount", - "allauth.socialaccount.providers.cern", - "allauth.socialaccount.providers.github", + "allauth.socialaccount.providers.openid_connect", ] -SITE_ID = 1 - MIDDLEWARE = [ "django.middleware.security.SecurityMiddleware", "whitenoise.middleware.WhiteNoiseMiddleware", @@ -249,3 +246,33 @@ SITE_ID = config("SITE_ID", default=1, cast=int) ACCOUNT_EMAIL_VERIFICATION = "none" + +SOCIALACCOUNT_PROVIDERS = { + "openid_connect": { + "SERVERS": [ + { + "id": "cern", # 30 characters or less + "name": "CERN", + "server_url": "https://auth.cern.ch/auth/realms/cern", + # Optional token endpoint authentication method. + # May be one of "client_secret_basic", "client_secret_post" + # If omitted, a method from the the server's + # token auth methods list is used + "token_auth_method": "client_secret_post", + "APP": { + "client_id": config("CERN_SSO_REGISTRATION_CLIENT_ID"), + "secret": config("CERN_SSO_REGISTRATION_CLIENT_SECRET"), + }, + }, + ] + } +} + +# This is used to get the public key and decode access tokens +# for users when they login. The URL can be found under the +# jwks_uri key of the JSON pointed to by the server_url of +# CERN's well-known config URL: +# https://auth.cern.ch/auth/realms/cern/.well-known/openid-configuration +CERN_SSO_JWKS_URI = ( + "https://auth.cern.ch/auth/realms/cern/protocol/openid-connect/certs" +) From 224fa2c29d5cfc06320be45cf53ac5c3097b050e Mon Sep 17 00:00:00 2001 From: Dimitris Papagiannis Date: Tue, 8 Aug 2023 12:40:01 +0200 Subject: [PATCH 2/2] Fix for HTTPS redirection --- mlp/settings.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mlp/settings.py b/mlp/settings.py index 934c1fc..dcd0a66 100644 --- a/mlp/settings.py +++ b/mlp/settings.py @@ -276,3 +276,6 @@ CERN_SSO_JWKS_URI = ( "https://auth.cern.ch/auth/realms/cern/protocol/openid-connect/certs" ) + +# Needed for redirections after logging in +SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")