Skip to content

docs: WEKO_ACCOUNTS_IDP_ENTITY_ID の docstring を SP のエンティティ ID に訂正 #1948

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mhaya wants to merge 1 commit into
base: develop_v2.1.0
Choose a base branch
from
Open

docs: WEKO_ACCOUNTS_IDP_ENTITY_ID の docstring を SP のエンティティ ID に訂正 #1948

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions modules/weko-accounts/weko_accounts/api.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,8 +338,10 @@ def _get_roles_to_add(self):

Gets the roles to add based on Shibboleth attributes.
Specifically, if the WEKO_ACCOUNTS_SHIB_BIND_GAKUNIN_MAP_GROUPS setting
is True, it determines the roles to add based on the
WEKO_SHIB_ATTR_IS_MEMBER_OF or WEKO_ACCOUNTS_IDP_ENTITY_ID attribute.
is True, it determines the roles to add based on the isMemberOf
attribute. If the attribute is empty, it falls back to
WEKO_ACCOUNTS_GAKUNIN_DEFAULT_GROUP_MAPPING keyed by
WEKO_ACCOUNTS_IDP_ENTITY_ID (the SP entity ID).

Returns:
list: List of roles to add.
Expand Down Expand Up @@ -685,8 +687,11 @@ def remove_contribute_role(self, role_id):
def create_fqdn_from_entity_id():
"""Create a fully qualified domain name (FQDN) from the entity ID.

The entity ID is WEKO_ACCOUNTS_IDP_ENTITY_ID, which holds this
repository's SP entity ID despite its name.

Returns:
str: FQDN derived from the entity ID.
str: FQDN derived from the entity ID, with "." and "-" replaced by "_".
"""
idp_entity_id = current_app.config.get('WEKO_ACCOUNTS_IDP_ENTITY_ID')
if not idp_entity_id:
Expand Down Expand Up @@ -820,7 +825,8 @@ def is_map_sysadm_role(role_name):
def _is_gakunin_map_configured():
"""Return whether the required GakuNin mAP settings are configured.

Both the group-pattern dictionary and IdP entity ID must be truthy.
Both the group-pattern dictionary and WEKO_ACCOUNTS_IDP_ENTITY_ID
(the SP entity ID) must be truthy.

Returns:
bool: ``True`` when both required settings are configured.
Expand Down
13 changes: 10 additions & 3 deletions modules/weko-accounts/weko_accounts/config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,12 +231,19 @@
"""Skip shibboleth confirmation page."""

WEKO_ACCOUNTS_IDP_ENTITY_ID = ''
"""IdP entity ID that institution owned."""
"""Entity ID of this repository's Shibboleth SP (not the IdP's).

Despite the name, set the SP entity ID here. Its host name is used to build
the Redis key of the GakuNin mAP group cache and to match GakuNin mAP group
IDs. If an IdP entity ID is set, the key does not match the one written by
weko-group-cache-db and the groups are silently not synchronized.
"""

WEKO_ACCOUNTS_GAKUNIN_DEFAULT_GROUP_MAPPING = {}
# Keyed by the value of WEKO_ACCOUNTS_IDP_ENTITY_ID (the SP entity ID) as is.
# {
# "http://idp.example.org/idp/shibboleth": [
# "jc_role_sysadm", "jc_role_repoadm", "jc_role_comadm"],
# "https://repo.example.org/shibboleth-sp": [
# "jc_repo_example_org_ro_cont"],
#}

WEKO_ACCOUNTS_SHIB_BIND_GAKUNIN_MAP_GROUPS = False
Expand Down
Loading