Shibboleth: Remote Authentication Phase 1 #3025

pdurbin · 2016-03-16T20:24:36Z

RFI Checklist

1. Related Issues

Shibboleth: Remote Authentication Phase 1 #2939 Shibboleth: Remote Authentication Phase 1 (parent issue for 2939-shib branch)
Shibboleth: Re-test Institution-wide Shibboleth groups and CRUD API operations #1533 Shibboleth: Re-test Institution-wide Shibboleth groups and CRUD API operations
Account Information API Token - Return to Account Pg? #1706 Account Information API Token - Return to Account Pg?
Review what shows in user account info and what can be changed #2046 Review what shows in user account info and what can be changed (Shib users can't change anything)
Shibboleth: update shibboleth2.xml entityID to end with "sp" rather than "shibboleth" #2104 Shibboleth: register with InCommon after updating entityID
API Tokens: Add Done Button To Page #2481 API Tokens: Add Done Button To Page
Shibboleth: multiple email addresses are stored as a single invalid address separated by a semicolon #2512 Shibboleth: multiple email addresses are stored as a single one
Local account creation URL ignores :AllowSignup #2838 Local account creation URL ignores :AllowSignup
Shibboleth: Add superuser API endpoint to migrate Shib user to builtin/local account #2915 Shibboleth: Add superuser API endpoint to migrate Shib user to builtin/local account
Shibboleth: tooling for debugging SAML assertions #2916 Shibboleth: tooling for debugging SAML assertions
Shibboleth: Support "Federated Login Mode" (i.e. feed of Identity Providers from InCommon) #2937 Shibboleth: Support "Federated Login Mode" (i.e. feed of Identity Providers from InCommon)
Shibboleth: Review Text For Converting an Account/Creating an Account #2950 Shibboleth: Review Text For Converting an Account/Creating an Account (the new Account/Shibboleth: Converting from local to non-local #796, related to Shibboleth: persist institution name as affiliation for users #1497 Shibboleth: persist institution name as affiliation for users)
Shibboleth: Institution Log In changes: Help link and extra text #2951 Shibboleth: Institution Log In changes: Help link and extra text (the new UI/UX for Shibboleth login #794)
Shibboleth: successful conversion from builtin/local account message should appear on account page rather than the home page. #2952 Shibboleth: successful conversion from builtin/local account message should appear on account page rather than the home page
Installation Guide: Improve Shibboleth documentation #2953 Installation Guide: Improve Shibboleth documentation
Notifications: Welcome to 4.0 Notification Needs to Change #2966 Notifications: Welcome to 4.0 Notification Needs to Change
User Guide: Add section about remote authentication (experimental) #2975 User Guide: Add section about remote authentication
API: add endpoint for listing users #3009 API: add endpoint for listing users
Shibboleth: Update any mentions of Institution to be Institutional #3011 Shibboleth: Update any mentions of Institution to be Institutional
(no issue) 404 and 403 error message text should now link to support pop up. Done in 51d15f8
(no issue) review dataverseuser.xhtml and see if code related to SearchIncludeFragment can be removed since MyData probably isn't using it. Done in 040a4d4
Support Form: math challenge doesn't work from some pages #3036 Support Form: math challenge doesn't work from some pages
Shibboleth: Add shibboleth api endpoints to api doc. #3037 Shibboleth: Add shibboleth api endpoints to api doc
My Data: Permissions granted by Shib groups do not appear on My Data #3041 My Data: Permissions granted by Shib groups do not appear on My Data
Shibboleth: Convert account page fails due to password validation. #3045 Shibboleth: Convert account page fails due to password validation.
Shib users do not get the "Welcome to Dataverse" message when creating a new account #3080 Shib users do not get the "Welcome to Dataverse" message when creating a new account
Shibboleth UI Improvements: Messaging, Formatting, Etc #3085 Shibboleth UI Improvements: Messaging, Formatting, Etc
API Token: Add as a tab in the my data/notifications/account info page #3086 API Token: Add as a tab in the my data/notifications/account info page
Shibboleth: "Allow me to type the name of my institution" option dropdown looks bad #3091 Shibboleth: "Allow me to type the name of my institution" option dropdown looks bad

2. Pull Request Checklist

Functionality completed as described in Remote Authentication Business Requirements Document (BRD)
Dependencies, risks, assumptions in Remote Authentication Business Requirements Document (BRD) addressed
Unit tests completed
Deployment requirements identified (e.g., SQL scripts, indexing)
Documentation completed
All code checkins completed

3. Review Checklist

After the pull request has been submitted, fill out this section.

Code review completed or waived
Testing requirements completed
Usability testing completed or waived
Support testing completed or waived
Merged with develop branch and resolved conflicts

The basics are in place but code should be cleaned up more and refactored. Started working a bit on user management. Added PROVIDER_ID static field for Shib provider.

…2939

…mpty render logic to the Affiliation and Position fields. Fixed broken tooltip issue on the Edit Account Information pg. [ref #2046]

…d a link to the Contact Dataverse Support popup. Also added this link to the error message text for 404 and 403 errors. [ref #2046 #2951]

… help/info/validation messages. [ref #2950 #2915]

… on Log In pg. [ref #2950]

Redirect to 403 (unauthorized) if you try to hack the URL. Also, only show "user.signup.tip" when you are really about to create.

…dataset pg. [ref #2838]

- Put email addresses throught the same "find single value" logic originally developed in #1608 for multiple first and last names. - Add `@ValidateEmail` to the "email" field on AuthenticatedUser to match BuiltinUser. - Add null check added to EmailValidator to make it testable. - Add `INVALID_EMAIL` and `MISSING_REQUIRED_ATTR` modes for Shib testing in dev. - Remove red warning when TestShib doesn't provide "mail" attribute. - Catch authSvc.createAuthenticatedUser exceptions and handle errors better. - Reformat code (getPrettyFacesHomePageString seems ok).

- Some debugging relates to groups #105 - Some code cleanup.

@mheppler

I believe this is a reversal of an earlier design decision but @mheppler said it should be removed so I'm removing it: #2950 (comment)

Too buggy. Sometimes you can't log in, especially when clearing history.

Also catch exception calling authSvc.authenticate when builtinuser password is not populated. Reformat code.

- Documente API to migrate Shib user to local #2915. - Add Debugging section for #2916. - Document identity federation stuff #2937. - Reference :AllowSignup as part of "remote only" #2838.

Having this endpoint makes documenting the conversion from Shib to builtin for #2915 easier.

This is for #2975. still need to add pictures in.

fixed some inconsistencies and typos

coveralls · 2016-04-27T20:03:32Z

Coverage increased (+0.2%) to 5.168% when pulling 3b5503e on 2939-shib into 5e38c9c on develop.

coveralls · 2016-04-27T20:18:48Z

Coverage increased (+0.2%) to 5.167% when pulling 5dba82d on 2939-shib into 5e38c9c on develop.

coveralls · 2016-04-27T20:19:15Z

Coverage increased (+0.2%) to 5.167% when pulling 5dba82d on 2939-shib into 5e38c9c on develop.

eaquigley · 2016-05-11T16:13:23Z

Good on my end. Passing to @kcondon to merge.

pdurbin · 2016-05-12T12:13:00Z

The merging of several pull requests yesterday has resulted in the message, "This branch has conflicts that must be resolved." I'm stealing this pull request back to resolve merge conflicts.

murphy:dataverse pdurbin$ git merge develop
Auto-merging src/test/java/edu/harvard/iq/dataverse/util/BundleUtilTest.java
CONFLICT (content): Merge conflict in src/test/java/edu/harvard/iq/dataverse/util/BundleUtilTest.java
Auto-merging src/main/webapp/dataverseuser.xhtml
CONFLICT (content): Merge conflict in src/main/webapp/dataverseuser.xhtml
Auto-merging src/main/webapp/dataverse_header.xhtml
Auto-merging src/main/webapp/dataset.xhtml
Auto-merging src/main/java/Bundle.properties
CONFLICT (content): Merge conflict in src/main/java/Bundle.properties
Auto-merging pom.xml
Automatic merge failed; fix conflicts and then commit the result.

Conflicts from #3108 (3089-jsoup): src/main/java/Bundle.properties src/main/webapp/dataverseuser.xhtml src/test/java/edu/harvard/iq/dataverse/util/BundleUtilTest.java - Had to fix welcome notification on signup (no more notification.welcome1 and notification.welcome2) - Apply dataverse.saved.search.success fix from 09454b2

coveralls · 2016-05-12T13:27:53Z

Coverage increased (+0.2%) to 5.167% when pulling fe5b00d on 2939-shib into be5b26e on develop.

pdurbin · 2016-05-12T13:34:27Z

@scolapasta it seems that merging #3108 (3089-jsoup) into develop cause several merge conflicts for this pull request. I just merged "develop" into 2939-shib (this pull request) and resolved conflicts in fe5b00d. That commit message has the details of the nature of the conflict but I'll repeat them here:

Conflicts from #3108 (3089-jsoup):
src/main/java/Bundle.properties
src/main/webapp/dataverseuser.xhtml
src/test/java/edu/harvard/iq/dataverse/util/BundleUtilTest.java

Had to fix welcome notification on signup (no more
notification.welcome1 and notification.welcome2)
Apply dataverse.saved.search.success fix from 09454b2

@scolapasta I'm going to pass this pull request to you to see what you think. If you could also please let me know if you think I should to the refactoring and cleanup I mentioned the other day, I'd appreciate it. I'm feeling a bit guilty about about the state of the code in the "convertShibToBuiltIn" method I added to the API:

dataverse/src/main/java/edu/harvard/iq/dataverse/api/Admin.java

Line 269 in fe5b00d

* @todo Refactor more of this business logic into ShibServiceBean in case

. I hope the todo's there explain how the logic should be centralized (so it can be called from the GUI someday as well) but my biggest concern is the "half converted" stuff... ideally we would write to the "builtinuser" and "authenticateduser" tables in a single (EJB?) transaction. I'm not quite sure how to do this.

pdurbin · 2016-05-16T14:05:03Z

@scolapasta gave me the go ahead to clean up the "convertShibToBuiltIn" code, which I did in a new pull request: #3120.

pdurbin and others added 30 commits February 12, 2016 11:52

Shib: stub out migrate to builtin account #2915 #2939

7ea6a01

The basics are in place but code should be cleaned up more and refactored. Started working a bit on user management. Added PROVIDER_ID static field for Shib provider.

Shib: help should point at guides.dataverse.org #2951 #2939

4121376

user page: when viewing show authenticated not builtin values #2046 #…

b317365

…2939

Cleaned up the Account pg and messaging for Shibboleth users. Added e…

040a4d4

…mpty render logic to the Affiliation and Position fields. Fixed broken tooltip issue on the Edit Account Information pg. [ref #2046]

Shib login page: remove "Help" link #2951

2c0cdec

add extra text below "Institution Log In" #2951 #2939

bf2f824

Revised text for Shibboleth users on the Account Information pg, adde…

51d15f8

…d a link to the Contact Dataverse Support popup. Also added this link to the error message text for 404 and 403 errors. [ref #2046 #2951]

Cleaned up layout of the Shib and Account Information pgs and updated…

204831d

… help/info/validation messages. [ref #2950 #2915]

Fixed HTML rendering issue with help text in Institution Log In block…

aa5391a

… on Log In pg. [ref #2950]

editMode honors :AllowSignup boolean #2838 #2939

f328110

Redirect to 403 (unauthorized) if you try to hack the URL. Also, only show "user.signup.tip" when you are really about to create.

Fixed styling for the warning msg in the Request Access popup on the …

901e804

…dataset pg. [ref #2838]

Shib: add more debug logging #2916 #2939

f901d9f

- Some debugging relates to groups #105 - Some code cleanup.

all users can have an affiliation #2950 #2939

66c4777

Shib: don't tell users IdP didn't give affiliation #2950 #2939

58ed4f8

I believe this is a reversal of an earlier design decision but @mheppler said it should be removed so I'm removing it: #2950 (comment)

add tests for non-ASCII email validation #2998

8471c02

redirect Shib users to page they clicked #1551 #2939

96adc39

Shib: disable redirect fix in 96adc39 in #1551 #2939

2d5130c

Too buggy. Sometimes you can't log in, especially when clearing history.

Shib: after convert, show user page #2952 #2939

e911234

Also catch exception calling authSvc.authenticate when builtinuser password is not populated. Reformat code.

improved Shibboleth docs #2953 #2939

21bd0e8

- Documente API to migrate Shib user to local #2915. - Add Debugging section for #2916. - Document identity federation stuff #2937. - Reference :AllowSignup as part of "remote only" #2838.

API: add endpoint for listing users #3009 #2939

0b212f8

Having this endpoint makes documenting the conversion from Shib to builtin for #2915 easier.

Added Institutional Log In section for shibboleth

8e7d93a

This is for #2975. still need to add pictures in.

Update account.rst

cdb8cca

fixed some inconsistencies and typos

handle http://api.randomuser.me downtime #2939

a906486

Shib refactor getRandomUser (no-op) #2939

fe0d14d

Shib: move getAffiliation from backing to service bean #2939

c76e67d

Shib: refactor to exercise getAffiliation from API #2939

0d1cc9b

Shib refactor: move builtin2shib to AdminIT #2939

b54ef59

Shib: move English text to bundle #2939

1b74d2e

Shib: refactor and make more testable #2939

0672ddd

API Token: add to header #3086

3b5503e

pdurbin added 2 commits April 27, 2016 16:11

API Token: put "not found" message in bundle and update #2939

962997e

consistent capitalization of "API Token" #3086

5dba82d

pdurbin mentioned this pull request Apr 27, 2016

API Token: Add as a tab in the my data/notifications/account info page #3086

Closed

This was referenced Apr 28, 2016

Support for Integration With ORCID via API #829

Closed

404 Not Found - Browser Gets Forwarded to /404.xhtml #2367

Closed

eaquigley assigned kcondon and unassigned eaquigley May 11, 2016

pdurbin assigned pdurbin and unassigned kcondon May 12, 2016

pdurbin added Status: Dev and removed Status: QA labels May 12, 2016

pdurbin assigned scolapasta and unassigned pdurbin May 12, 2016

scolapasta merged commit ce4f43e into develop May 13, 2016

pdurbin removed the Status: Dev label May 13, 2016

scolapasta added this to the 4.4 milestone May 13, 2016

pdurbin mentioned this pull request May 16, 2016

Refactor superuser API endpoint to migrate Shib user to builtin/local account #3120

Merged

11 tasks

pdurbin mentioned this pull request May 25, 2016

Shibboleth: restore Institution Log In functionality to dataverse.harvard.edu #2117

Closed

pdurbin deleted the 2939-shib branch May 31, 2016 14:44

pdurbin mentioned this pull request Jun 21, 2018

Having some trouble when a user tries logging in using both Shib AND OAuth...I think... #4769

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Shibboleth: Remote Authentication Phase 1 #3025

Shibboleth: Remote Authentication Phase 1 #3025

pdurbin commented Mar 16, 2016 •

edited

Loading

coveralls commented Apr 27, 2016

coveralls commented Apr 27, 2016

coveralls commented Apr 27, 2016

eaquigley commented May 11, 2016

pdurbin commented May 12, 2016 •

edited

Loading

coveralls commented May 12, 2016

pdurbin commented May 12, 2016

pdurbin commented May 16, 2016

Shibboleth: Remote Authentication Phase 1 #3025

Shibboleth: Remote Authentication Phase 1 #3025

Conversation

pdurbin commented Mar 16, 2016 • edited Loading

RFI Checklist

1. Related Issues

2. Pull Request Checklist

3. Review Checklist

coveralls commented Apr 27, 2016

coveralls commented Apr 27, 2016

coveralls commented Apr 27, 2016

eaquigley commented May 11, 2016

pdurbin commented May 12, 2016 • edited Loading

coveralls commented May 12, 2016

pdurbin commented May 12, 2016

pdurbin commented May 16, 2016

pdurbin commented Mar 16, 2016 •

edited

Loading

pdurbin commented May 12, 2016 •

edited

Loading