engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: updated bulk external identity set

Browse source
This commit is contained in:
Marcin Kuzminski 2019-02-22 21:06:57 +01:00
parent bf2f76fa87
commit 9c5edb1cf9
1 changed files with 50 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

84
docs/auth/auth-saml-bulk-enroll-users.rst
View file

@ -11,11 +11,9 @@ This method simply enables SAML authentication for many users at once.
From the server RhodeCode Enterprise is running run ishell on the instance which we From the server RhodeCode Enterprise is running run ishell on the instance which we
want to apply the SAML migration: want to apply the SAML migration::
``` rccontrol ishell enterprise-1
rccontrol ishell enterprise-1
```
Follow these steps to enable SAML authentication for multiple users. Follow these steps to enable SAML authentication for multiple users.
@ -26,41 +24,59 @@ Follow these steps to enable SAML authentication for multiple users.
`saml2user` is a mapping of external ID from SAML provider such as OneLogin, DuoSecurity, Google. `saml2user` is a mapping of external ID from SAML provider such as OneLogin, DuoSecurity, Google.
This mapping consists of local rhodecode user_id mapped to set of required attributes needed to bind SAML This mapping consists of local rhodecode user_id mapped to set of required attributes needed to bind SAML
account to internal rhodecode user. account to internal rhodecode user.
For example, 123 is local rhodecode user_id, and '48253211' is onelogin ID. For example, 123 is local rhodecode user_id, and '48253211' is OneLogin ID.
For other providers you'd have to figure out what would be the user-id, sometimes it's the email, i.e for Google For other providers you'd have to figure out what would be the user-id, sometimes it's the email, i.e for Google
The most important this id needs to be unique for each user.
In [1]: saml2user = { .. code-block:: python
...: # OneLogin, uses externalID available to read from in the UI
...: 123: {'id: '48253211'},
...: # for google use email
...: 124: {'id: 'email@domain.com'},
...: }
2) Import the plugin you want to run migration for, pick only one and run the `import` statement In [1]: saml2user = {
# for duo security ...: # OneLogin, uses externalID available to read from in the UI
In [2]: from rc_auth_plugins.auth_duo_security import RhodeCodeAuthPlugin ...: 123: {'id: '48253211'},
# for onelogin ...: # for Google/DuoSecurity email is also an option for unique ID
In [2]: from rc_auth_plugins.auth_onelogin import RhodeCodeAuthPlugin ...: 124: {'id: 'email@domain.com'},
# generic saml ...: }
In [2]: from rc_auth_plugins.auth_duo_security import RhodeCodeAuthPlugin
3) Run the migration based on saml2user mapping. Enter in the ishell prompt
In [3]: for user in User.get_all():
...: existing_identity = ExternalIdentity().query().filter(ExternalIdentity.local_user_id == user.user_id).scalar()
...: attrs = saml2user.get(user.user_id)
...: provider = RhodeCodeAuthPlugin.uid
...: if not existing_identity and attrs:
...: new_external_identity = ExternalIdentity()
...: new_external_identity.external_id = attrs['id']
...: new_external_identity.external_username = '{}-saml-{}'.format(user.username, user.user_id)
...: new_external_identity.provider_name = provider
...: new_external_identity.local_user_id = user_id
...: new_external_identity.access_token = ''
...: new_external_identity.token_secret = ''
...: new_external_identity.alt_token = ''
...: Session().add(ex_identity)
...: Session().commit()
2) Import the plugin you want to run migration for.
From available options pick only one and run the `import` statement
.. code-block:: python
# for Duo Security
In [2]: from rc_auth_plugins.auth_duo_security import RhodeCodeAuthPlugin
# for OneLogin
In [2]: from rc_auth_plugins.auth_onelogin import RhodeCodeAuthPlugin
# generic SAML plugin
In [2]: from rc_auth_plugins.auth_saml import RhodeCodeAuthPlugin
3) Run the migration based on saml2user mapping.
Enter in the ishell prompt
.. code-block:: python
In [3]: for user in User.get_all():
...: existing_identity = ExternalIdentity().query().filter(ExternalIdentity.local_user_id == user.user_id).scalar()
...: attrs = saml2user.get(user.user_id)
...: provider = RhodeCodeAuthPlugin.uid
...: if existing_identity:
...: print('Identity for user `{}` already exists, skipping'.format(user.username))
...: continue
...: if attrs:
...: external_id = attrs['id']
...: new_external_identity = ExternalIdentity()
...: new_external_identity.external_id = external_id
...: new_external_identity.external_username = '{}-saml-{}'.format(user.username, user.user_id)
...: new_external_identity.provider_name = provider
...: new_external_identity.local_user_id = user_id
...: new_external_identity.access_token = ''
...: new_external_identity.token_secret = ''
...: new_external_identity.alt_token = ''
...: Session().add(ex_identity)
...: Session().commit()
...: print('Set user `{}` external identity bound to ExternalID:{}'.format(user.username, external_id))
.. note:: .. note::