From c360d74b534bc94398f880dd7b5ac8aeca2bd386 Mon Sep 17 00:00:00 2001 From: Masaharu Hayashi Date: Mon, 26 Oct 2026 00:43:23 +0000 Subject: [PATCH] =?UTF-8?q?docs:=20WEKO=5FACCOUNTS=5FIDP=5FENTITY=5FID=20?= =?UTF-8?q?=E3=81=AE=20docstring=20=E3=82=92=20SP=20=E3=81=AE=E3=82=A8?= =?UTF-8?q?=E3=83=B3=E3=83=86=E3=82=A3=E3=83=86=E3=82=A3=20ID=20=E3=81=AB?= =?UTF-8?q?=E8=A8=82=E6=AD=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 設定名に反して、WEKO_ACCOUNTS_IDP_ENTITY_ID にはリポジトリの Shibboleth SP の エンティティ ID を設定する(運用手順書・scripts/instance.cfg と同じ)。 docstring が「IdP entity ID」となっており、IdP の値を設定すると weko-group-cache-db が書き込む Redis キーと一致せず、mAP グループの同期が エラーを出さずに行われなくなるため、説明を訂正する。 - config.py: WEKO_ACCOUNTS_IDP_ENTITY_ID の docstring を訂正し、 WEKO_ACCOUNTS_GAKUNIN_DEFAULT_GROUP_MAPPING の設定例のキーを SP の エンティティ ID に変更 - api.py: _get_roles_to_add / create_fqdn_from_entity_id / _is_gakunin_map_configured の docstring を訂正 コードの動作は変更しない。 Co-Authored-By: Claude Opus 5.5 --- modules/weko-accounts/weko_accounts/api.py | 14 ++++++++++---- modules/weko-accounts/weko_accounts/config.py | 13 ++++++++++--- 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/modules/weko-accounts/weko_accounts/api.py b/modules/weko-accounts/weko_accounts/api.py index 081ba676e1..c8174ddf3a 100644 --- a/modules/weko-accounts/weko_accounts/api.py +++ b/modules/weko-accounts/weko_accounts/api.py @@ -338,8 +338,10 @@ def _get_roles_to_add(self): Gets the roles to add based on Shibboleth attributes. Specifically, if the WEKO_ACCOUNTS_SHIB_BIND_GAKUNIN_MAP_GROUPS setting - is True, it determines the roles to add based on the - WEKO_SHIB_ATTR_IS_MEMBER_OF or WEKO_ACCOUNTS_IDP_ENTITY_ID attribute. + is True, it determines the roles to add based on the isMemberOf + attribute. If the attribute is empty, it falls back to + WEKO_ACCOUNTS_GAKUNIN_DEFAULT_GROUP_MAPPING keyed by + WEKO_ACCOUNTS_IDP_ENTITY_ID (the SP entity ID). Returns: list: List of roles to add. @@ -685,8 +687,11 @@ def remove_contribute_role(self, role_id): def create_fqdn_from_entity_id(): """Create a fully qualified domain name (FQDN) from the entity ID. + The entity ID is WEKO_ACCOUNTS_IDP_ENTITY_ID, which holds this + repository's SP entity ID despite its name. + Returns: - str: FQDN derived from the entity ID. + str: FQDN derived from the entity ID, with "." and "-" replaced by "_". """ idp_entity_id = current_app.config.get('WEKO_ACCOUNTS_IDP_ENTITY_ID') if not idp_entity_id: @@ -820,7 +825,8 @@ def is_map_sysadm_role(role_name): def _is_gakunin_map_configured(): """Return whether the required GakuNin mAP settings are configured. - Both the group-pattern dictionary and IdP entity ID must be truthy. + Both the group-pattern dictionary and WEKO_ACCOUNTS_IDP_ENTITY_ID + (the SP entity ID) must be truthy. Returns: bool: ``True`` when both required settings are configured. diff --git a/modules/weko-accounts/weko_accounts/config.py b/modules/weko-accounts/weko_accounts/config.py index 5c6a9de7c9..7641562cf2 100644 --- a/modules/weko-accounts/weko_accounts/config.py +++ b/modules/weko-accounts/weko_accounts/config.py @@ -231,12 +231,19 @@ """Skip shibboleth confirmation page.""" WEKO_ACCOUNTS_IDP_ENTITY_ID = '' -"""IdP entity ID that institution owned.""" +"""Entity ID of this repository's Shibboleth SP (not the IdP's). + +Despite the name, set the SP entity ID here. Its host name is used to build +the Redis key of the GakuNin mAP group cache and to match GakuNin mAP group +IDs. If an IdP entity ID is set, the key does not match the one written by +weko-group-cache-db and the groups are silently not synchronized. +""" WEKO_ACCOUNTS_GAKUNIN_DEFAULT_GROUP_MAPPING = {} +# Keyed by the value of WEKO_ACCOUNTS_IDP_ENTITY_ID (the SP entity ID) as is. # { -# "http://idp.example.org/idp/shibboleth": [ -# "jc_role_sysadm", "jc_role_repoadm", "jc_role_comadm"], +# "https://repo.example.org/shibboleth-sp": [ +# "jc_repo_example_org_ro_cont"], #} WEKO_ACCOUNTS_SHIB_BIND_GAKUNIN_MAP_GROUPS = False