Git Product home page Git Product logo

openconext-myconext's Introduction

MyConext

JAVA CI codecov.io

An IdP for OpenConext. A user can create and manage his own identity. Authentication uses a magic-link by default, and FIDO2 or a password can be added later.

Getting started

System Requirements

  • Java 11
  • Maven 3
  • MongoDB 3.4.x
  • Yarn 1.x
  • NodeJS
  • Ansible

Building and running

The myconext-server

This project uses Spring Boot and Maven. To run locally, type:

cd myconext-server

mvn spring-boot:run -Dspring-boot.run.profiles=dev

When developing, it's convenient to just execute the applications main-method, which is in Application. Don't forget to set the active profile to dev.

The account-gui

The myconext client is build with Svelte and to get initially started:

cd account-gui
yarn install
yarn dev

Browse to the application homepage.

The myconext-gui

The IdP is also build with Svelte and to get initially started:

cd myconext-gui
yarn install
yarn start

There is no home page, you'll need to visit an SP and choose eduID to login.

Build

To deploy production bundles

mvn deploy

Mail

The default mail configuration sends mails to port 1025. Install https://mailpit.axllent.org/ and capture all emails send. You can see all mails delivered at http://0.0.0.0:8025/ when mailpit is installed.

brew install mailpit

Crypto

The myconext application uses a private RSA key and corresponding certificate to sign the SAML requests. We don't want to provide defaults, so in the integration tests the key / certificate pair is generated on the fly. if you want to deploy the application in an environment where the certificate needs to be registered with the Service Provider (Proxy) then you can generate a key pair with the following commands:

cd myconext/myconext-server/src/main/resources
openssl genrsa -traditional -out myconext.pem 2048
openssl req -subj '/O=Organization, CN=OIDC/' -key myconext.pem -new -x509 -days 365 -out myconext.crt

Add the key pair to the application.yml file:

private_key_path: classpath:/myconext.pem
certificate_path: classpath:/myconext.crt

If you need to register the public key in EB then issue this command and copy & paste it in Manage for the correct IdP:

cat myconext.crt |ghead -n -1 |tail -n +2 | tr -d '\n'; echo

Miscellaneous

To get an overview of the git source file's:

cloc --read-lang-def=cloc_definitions.txt --vcs=git

Migration

It's possible to migrate from an existing IdP to this IdP. A new identity will be created, and the eppn wil be copied.

Attribute Manipulation

curl -u oidcng:secret "http://login.test2.eduid.nl/myconext/api/attribute-manipulation?sp_entity_id=https://test.okke&uid=0eaa7fb2-4f94-476f-b3f6-c8dfc4115a87&sp_institution_guid=null"

Attribute Aggregation

curl -u aa:secret "https://login.test2.eduid.nl/myconext/api/attribute-aggregation?sp_entity_id=https://mijn.test2.eduid.nl/shibboleth&[email protected]"

Endpoint to detect duplicate eduID's for SP's that have the same institutionGuid

curl -u aa:secret 'https://login.test2.eduid.nl/myconext/api/system/eduid-duplicates' | jq .

OpenAPI Documentation

http://localhost:8081/myconext/api/swagger-ui/index.html

http://localhost:8081/myconext/api/api-docs

https://login.test2.eduid.nl/myconext/api/swagger-ui/index.html

https://login.test2.eduid.nl/myconext/api/api-docs

IDIN & e-Herkenning

The redirect URI's for local development have to start with https. You can use the reverse proxy of ngrok for this. For example:

ngrok http --domain okke.harsta.eu.ngrok.io 8081

openconext-myconext's People

Contributors

arnoutt avatar danakim avatar dependabot[bot] avatar edwinvandeb avatar florisfokkinga avatar marliesrikken avatar oharsta avatar peterclijsters1 avatar phavekes avatar quartje avatar thijskh avatar tyskai avatar

Stargazers

avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

edwinvandeb thijskh harrykodden arnoutt peterclijsters1 marliesrikken github-workflow-app

openconext-myconext's Issues

Should not require requesterId

This code

OpenConext-myconext/myconext-server/src/main/java/myconext/security/GuestIdpAuthenticationRequestFilter.java

Line 163 in 53c1cee

String encodedServiceName = URLEncoder.encode(serviceNameResolver.resolve(requesterEntityId), "UTF-8");
fails with a NPE when the AuthnRequest does not contain a Scoping element/RequesterID.

When using myconext with EB this will always be present, but when using it without a SAML proxy it's not. So please make it optional, e.g. by falling back to the remote entityID if there's no requesterId.

Override schacHomeOrganization based on e-mail domain

This is a feature request as an addition on 'use_deny_allow_list'.

If the list is used, each allowed e-mail domains should have a configurable schacHomeOrganization. This should override the value provisioned during sign-up.

idp metadata has wrong sso location

The metadata (as found on https://login.eduid.nl/saml/guest-idp/metadata) has

<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://login.eduid.nl/saml/guest-idp/SSO/alias/guest-idp"/>
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://login.eduid.nl/saml/guest-idp/SSO/alias/guest-idp"/>

while it turns out that it only works when you leave out the last /alias/guest-idp of those URLs.

Req: branding

Hi,

In order to be able to use myConext by other organisations (i.e. govroam), our feature request would be to be able to adjust brand-specific graphical elements. The main ones are:

  • logo
  • color scheme
  • title, header and text
  • optionally: site icon

...by either replacing a fixed files that remain persistent after, or can easily be migrated during an upgrade, or by pointing to alternative files in the configuration.

Color scheme:
For the short term, the color scheme would replace:

  • blue by black
  • light blue by grey

Text:

  • may contain hyperlinks
  • multilanguage, in the short term Dutch and English

As a user logging into a service requiring MFA, I want to be told clearly that I must use the eduID app every step

This screen is rather clear: 'to proceed to you must '

image

If the user chooses to ignore this warning or, perhaps, doesn't read all this text, the next screen is less clear.

image

'Login without the eduApp is strongly discouraged.' While it is impossble, like the previous screen said.
'The will not receive your attributes'. Most people have no idea what this means. It means you cannot login to the service.

If the user continues anyway, the next screen is just wrong. It's not the user's institution that denies access.

image

To be clear: the problem is not that logging in doesn't work, but that after ignoring the first warning, the warnings and errors become less clear and accurate.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.