engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: added example how to enroll multiple users to SAML.

Browse source
This commit is contained in:
Marcin Kuzminski 2019-02-21 21:43:58 +01:00
parent 0598233013
commit 6c21c0cd67
2 changed files with 73 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

72
docs/auth/auth-saml-bulk-enroll-users.rst Normal file
View file

@ -0,0 +1,72 @@
.. _auth-saml-bulk-enroll-users-ref:
Bulk enroll multiple existing users
-----------------------------------
RhodeCode Supports standard SAML 2.0 SSO for the web-application part.
Below is an example how to enroll list of all or some users to use SAML authentication.
This method simply enables SAML authentication for many users at once.
From the server RhodeCode Enterprise is running run ishell on the instance which we
want to apply the SAML migration:
```
rccontrol ishell enterprise-1
```
Follow these steps to enable SAML authentication for multiple users.
1) Create a user_id => attribute mapping
`saml2user` is a mapping of external ID from SAML provider such as OneLogin, DuoSecurity, Google.
This mapping consists of local rhodecode user_id mapped to set of required attributes needed to bind SAML
account to internal rhodecode user.
For example, 123 is local rhodecode user_id, and '48253211' is onelogin ID.
For other providers you'd have to figure out what would be the user-id, sometimes it's the email, i.e for Google
In [1]: saml2user = {
...: # OneLogin, uses externalID available to read from in the UI
...: 123: {'id: '48253211'},
...: # for google use email
...: 124: {'id: 'email@domain.com'},
...: }
2) Import the plugin you want to run migration for, pick only one and run the `import` statement
# for duo security
In [2]: from rc_auth_plugins.auth_duo_security import RhodeCodeAuthPlugin
# for onelogin
In [2]: from rc_auth_plugins.auth_onelogin import RhodeCodeAuthPlugin
# generic saml
In [2]: from rc_auth_plugins.auth_duo_security import RhodeCodeAuthPlugin
3) Run the migration based on saml2user mapping. Enter in the ishell prompt
In [3]: for user in User.get_all():
...: existing_identity = ExternalIdentity().query().filter(ExternalIdentity.local_user_id == user.user_id).scalar()
...: attrs = saml2user.get(user.user_id)
...: provider = RhodeCodeAuthPlugin.uid
...: if not existing_identity and attrs:
...: new_external_identity = ExternalIdentity()
...: new_external_identity.external_id = attrs['id']
...: new_external_identity.external_username = '{}-saml-{}'.format(user.username, user.user_id)
...: new_external_identity.provider_name = provider
...: new_external_identity.local_user_id = user_id
...: new_external_identity.access_token = ''
...: new_external_identity.token_secret = ''
...: new_external_identity.alt_token = ''
...: Session().add(ex_identity)
...: Session().commit()
.. note::
saml2user can be really big and hard to maintain in ishell. It's also possible
to load it as a JSON file prepared before and stored on disk. To do so run::
import json
saml2user = json.loads(open('/path/to/saml2user.json','rb').read())

1
docs/auth/auth-saml-generic.rst
View file

@ -15,4 +15,5 @@ Please check for reference two example providers:
auth-saml-duosecurity auth-saml-duosecurity
auth-saml-onelogin auth-saml-onelogin
auth-saml-bulk-enroll-users