Skip to content
This repository was archived by the owner on Sep 28, 2022. It is now read-only.

Commit 8518a6a

Browse files
author
Dominik František Bučík
authored
Merge pull request #204 from dBucik/embl_lsaai
fix: 🐛 Fix displaying for consent for EMBL
2 parents 88fe9a1 + ef47df1 commit 8518a6a

File tree

6 files changed

+101
-29
lines changed

6 files changed

+101
-29
lines changed

‎perun-oidc-server-webapp/src/main/resources/db/mysql/v10.0.0.sql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ALTER TABLE client_details MODIFY jurisdiction VARCHAR(256) DEFAULT NULL;

‎perun-oidc-server-webapp/src/main/resources/db/psql/v10.0.0.sql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ALTER TABLE client_details MODIFY jurisdiction VARCHAR(256) DEFAULT NULL;

‎perun-oidc-server-webapp/src/main/webapp/WEB-INF/views/lsaai/approve.jsp

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,10 @@
3131
</div>
3232
</div>
3333
</c:if>
34-
<c:if test="${not client.acceptedTos}">
34+
<c:if test="${isTestSp or (not client.acceptedTos)}">
3535
<div class="alert alert-warning" role="alert">
36-
<h6>This service has not declared compliance with the <a target="_blank" href="https://lifescience-ri.eu/aai/terms-of-use">Terms of Use for service providers</a> that govern the service's use of Life Science Login.</h6>
36+
<p>You are entering a service that is in the test environment of Life Science Login. The test environment is for service developers to test their relying service’s AAI integration before requesting to move them to the Life Science Login production environment.</p>
37+
<p>The test environment is not intended for common users. You are able to access the service because you have opted in as a test user. You need to refresh your registration every 30 days.</p>
3738
</div>
3839
</c:if>
3940
<form name="confirmationForm" id="allow_consent_form" class="form-group"
@@ -102,17 +103,22 @@
102103
<div class="alert alert-danger" role="alert">
103104
<h6>
104105
This service is${' '}
105-
<c:if test="${jurisdiction eq 'INT'}">provided by an international organization. </c:if>
106-
<c:if test="${jurisdiction ne 'INT'}">in ${jurisdiction}</c:if>
106+
<c:if test="${jurisdiction eq 'INT' or jurisdiction eq 'EMBL'}">provided by an international organization. </c:if>
107+
<c:if test="${jurisdiction ne 'INT' and jurisdiction ne 'EMBL'}">in ${jurisdiction}</c:if>
107108
</h6>
108109
<p>
109-
In order to access the requested services, the Life Science Login needs to transfer your personal data to a country outside EU/EEA.
110-
We cannot guarantee that this country offers an adequately high level of personal data protection as EU/EEA countries.
111-
112-
<c:if test="${not empty(client.policyUri)}">
113-
Please, read the <a target="_blank" href="<c:out value="${client.policyUri}" />">Privacy Policy</a> of the service provider to learn more about its commitments to protect your data.
110+
<c:if test="${jurisdiction eq 'EMBL'}">
111+
In order to access the requested services, the Life Science Login needs to transfer your personal data to an international organization outside EU/EEA jurisdictions.<br/>
112+
<i>Please be aware that upon transfer your personal data will be protected by <a href="https://www.embl.org/documents/document/internal-policy-no-68-on-general-data-protection/" target="_blank">EMBL’s Internal Policy 68 on General Data Protection</a>.</i>
113+
</c:if>
114+
<c:if test="${jurisdiction ne 'EMBL'}">
115+
In order to access the requested services, the Life Science Login needs to transfer your personal data to a country outside EU/EEA.
116+
We cannot guarantee that this country offers an adequately high level of personal data protection as EU/EEA countries.
114117
</c:if>
115118
</p>
119+
<c:if test="${not empty(client.policyUri)}">
120+
<h6>Please, read the <a target="_blank" href="<c:out value="${client.policyUri}" />">Privacy Policy</a> of the service provider to learn more about its commitments to protect your data.</h6>
121+
</c:if>
116122
<div class="form-check">
117123
<input class="form-check-input" type="checkbox" name="transfer" id="transfer" data-np-checked="1">
118124
<label class="form-check-label" for="transfer">To continue, consent to the transfer of your personal data.</label>

‎perun-oidc-server-webapp/src/main/webapp/WEB-INF/views/lsaai/approveDevice.jsp

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,10 @@
3131
</div>
3232
</div>
3333
</c:if>
34-
<c:if test="${not client.acceptedTos}">
34+
<c:if test="${isTestSp or (not client.acceptedTos)}">
3535
<div class="alert alert-warning" role="alert">
36-
<h6>This service has not declared compliance with the <a target="_blank" href="https://lifescience-ri.eu/aai/terms-of-use">Terms of Use for service providers</a> that govern the service's use of Life Science Login.</h6>
36+
<p>You are entering a service that is in the test environment of Life Science Login. The test environment is for service developers to test their relying service’s AAI integration before requesting to move them to the Life Science Login production environment.</p>
37+
<p>The test environment is not intended for common users. You are able to access the service because you have opted in as a test user. You need to refresh your registration every 30 days.</p>
3738
</div>
3839
</c:if>
3940
<form name="confirmationForm" id="allow_consent_form" class="form-group"
@@ -101,25 +102,30 @@
101102
</div>
102103

103104
<c:if test="${not empty jurisdiction}">
104-
<div class="alert alert-danger" role="alert">
105-
<h6>
106-
This service is${' '}
107-
<c:if test="${jurisdiction eq 'INT'}">provided by an international organization. </c:if>
108-
<c:if test="${jurisdiction ne 'INT'}">in ${jurisdiction}</c:if>
109-
</h6>
110-
<p>
111-
In order to access the requested services, the Life Science Login needs to transfer your personal data to a country outside EU/EEA.
112-
We cannot guarantee that this country offers an adequately high level of personal data protection as EU/EEA countries.
113-
105+
<div class="alert alert-danger" role="alert">
106+
<h6>
107+
This service is${' '}
108+
<c:if test="${jurisdiction eq 'INT' or jurisdiction eq 'EMBL'}">provided by an international organization. </c:if>
109+
<c:if test="${jurisdiction ne 'INT' and jurisdiction ne 'EMBL'}">in ${jurisdiction}</c:if>
110+
</h6>
111+
<p>
112+
<c:if test="${jurisdiction eq 'EMBL'}">
113+
In order to access the requested services, the Life Science Login needs to transfer your personal data to an international organization outside EU/EEA jurisdictions.<br/>
114+
<i>Please be aware that upon transfer your personal data will be protected by <a href="https://www.embl.org/documents/document/internal-policy-no-68-on-general-data-protection/" target="_blank">EMBL’s Internal Policy 68 on General Data Protection</a>.</i>
115+
</c:if>
116+
<c:if test="${jurisdiction ne 'EMBL'}">
117+
In order to access the requested services, the Life Science Login needs to transfer your personal data to a country outside EU/EEA.
118+
We cannot guarantee that this country offers an adequately high level of personal data protection as EU/EEA countries.
119+
</c:if>
120+
</p>
114121
<c:if test="${not empty(client.policyUri)}">
115-
Please, read the <a target="_blank" href="<c:out value="${client.policyUri}" />">Privacy Policy</a> of the service provider to learn more about its commitments to protect your data.
122+
<h6>Please, read the <a target="_blank" href="<c:out value="${client.policyUri}" />">Privacy Policy</a> of the service provider to learn more about its commitments to protect your data.</h6>
116123
</c:if>
117-
</p>
118-
<div class="form-check">
119-
<input class="form-check-input" type="checkbox" name="transfer" id="transfer" data-np-checked="1">
120-
<label class="form-check-label" for="transfer">To continue, consent to the transfer of your personal data.</label>
124+
<div class="form-check">
125+
<input class="form-check-input" type="checkbox" name="transfer" id="transfer" data-np-checked="1">
126+
<label class="form-check-label" for="transfer">To continue, consent to the transfer of your personal data.</label>
127+
</div>
121128
</div>
122-
</div>
123129
</c:if>
124130
<div class="outro">
125131
<p>

‎perun-oidc-server/src/main/java/cz/muni/ics/oauth2/web/controller/OAuthConfirmationController.java

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,10 @@
2828
import cz.muni.ics.oauth2.model.SystemScope;
2929
import cz.muni.ics.oauth2.service.ClientDetailsEntityService;
3030
import cz.muni.ics.oauth2.service.SystemScopeService;
31+
import cz.muni.ics.oidc.models.Facility;
32+
import cz.muni.ics.oidc.models.PerunAttributeValue;
3133
import cz.muni.ics.oidc.saml.SamlPrincipal;
34+
import cz.muni.ics.oidc.server.adapters.PerunAdapter;
3235
import cz.muni.ics.oidc.server.configurations.PerunOidcConfig;
3336
import cz.muni.ics.oidc.web.WebHtmlClasses;
3437
import cz.muni.ics.oidc.web.controllers.ControllerUtils;
@@ -108,14 +111,17 @@ public class OAuthConfirmationController {
108111
private PerunOidcConfig perunOidcConfig;
109112
private WebHtmlClasses htmlClasses;
110113

114+
private PerunAdapter perunAdapter;
115+
111116
@Autowired
112117
public OAuthConfirmationController(ClientDetailsEntityService clientService,
113118
SystemScopeService scopeService,
114119
ScopeClaimTranslationService scopeClaimTranslationService,
115120
UserInfoService userInfoService,
116121
RedirectResolver redirectResolver,
117122
PerunOidcConfig perunOidcConfig,
118-
WebHtmlClasses htmlClasses) {
123+
WebHtmlClasses htmlClasses,
124+
PerunAdapter perunAdapter) {
119125

120126
this.clientService = clientService;
121127
this.scopeService = scopeService;
@@ -124,6 +130,7 @@ public OAuthConfirmationController(ClientDetailsEntityService clientService,
124130
this.redirectResolver = redirectResolver;
125131
this.perunOidcConfig = perunOidcConfig;
126132
this.htmlClasses = htmlClasses;
133+
this.perunAdapter = perunAdapter;
127134
}
128135

129136
public OAuthConfirmationController(ClientDetailsEntityService clientService) {
@@ -200,15 +207,37 @@ public String confirmAccess(Map<String, Object> model, HttpServletRequest req, A
200207
if (perunOidcConfig.getTheme().equalsIgnoreCase(LSAAI)) {
201208
model.put("getsOfflineAccess", authRequest.getScope().contains("offline_access"));
202209
model.put("jurisdiction", getJurisdiction(client));
210+
model.put("isTestSp", isTestSp(client));
203211
return "lsaai/approve";
204212
}
205213
return THEMED_APPROVE;
206214
}
207215

216+
private boolean isTestSp(ClientDetailsEntity client) {
217+
if (client == null || !StringUtils.hasText(client.getClientId())) {
218+
return true;
219+
}
220+
Facility facility = perunAdapter.getFacilityByClientId(client.getClientId());
221+
if (facility == null || facility.getId() == null) {
222+
return true;
223+
}
224+
225+
PerunAttributeValue attrValue = perunAdapter.getFacilityAttributeValue(facility.getId(), "urn:perun:facility:attribute-def:def:isTestSp");
226+
if (attrValue == null) {
227+
return false;
228+
} else if (attrValue.valueAsBoolean()) {
229+
return attrValue.valueAsBoolean();
230+
}
231+
return false;
232+
}
233+
208234
private String getJurisdiction(ClientDetailsEntity client) {
209235
if (!StringUtils.hasText(client.getJurisdiction()) || euEaa.contains(client.getJurisdiction())) {
210236
return "";
211237
} else if (client.getJurisdiction().length() > 2) {
238+
if ("EMBL".equalsIgnoreCase(client.getJurisdiction())) {
239+
return "EMBL";
240+
}
212241
return "INT";
213242
}
214243

‎perun-oidc-server/src/main/java/cz/muni/ics/oauth2/web/endpoint/DeviceEndpoint.java

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,10 @@
2424
import cz.muni.ics.oauth2.service.DeviceCodeService;
2525
import cz.muni.ics.oauth2.service.SystemScopeService;
2626
import cz.muni.ics.oauth2.token.DeviceTokenGranter;
27+
import cz.muni.ics.oidc.models.Facility;
28+
import cz.muni.ics.oidc.models.PerunAttributeValue;
2729
import cz.muni.ics.oidc.saml.SamlPrincipal;
30+
import cz.muni.ics.oidc.server.adapters.PerunAdapter;
2831
import cz.muni.ics.oidc.server.configurations.PerunOidcConfig;
2932
import cz.muni.ics.oidc.server.userInfo.PerunUserInfo;
3033
import cz.muni.ics.oidc.web.WebHtmlClasses;
@@ -137,6 +140,8 @@ public class DeviceEndpoint {
137140
private final ScopeClaimTranslationService scopeClaimTranslationService;
138141
private final UserInfoService userInfoService;
139142

143+
private final PerunAdapter perunAdapter;
144+
140145
@Autowired
141146
public DeviceEndpoint(ClientDetailsEntityService clientService,
142147
SystemScopeService scopeService,
@@ -145,7 +150,8 @@ public DeviceEndpoint(ClientDetailsEntityService clientService,
145150
PerunOidcConfig perunOidcConfig,
146151
WebHtmlClasses htmlClasses,
147152
ScopeClaimTranslationService scopeClaimTranslationService,
148-
UserInfoService userInfoService)
153+
UserInfoService userInfoService,
154+
PerunAdapter perunAdapter)
149155
{
150156
this.clientService = clientService;
151157
this.scopeService = scopeService;
@@ -155,6 +161,7 @@ public DeviceEndpoint(ClientDetailsEntityService clientService,
155161
this.htmlClasses = htmlClasses;
156162
this.scopeClaimTranslationService = scopeClaimTranslationService;
157163
this.userInfoService = userInfoService;
164+
this.perunAdapter = perunAdapter;
158165
}
159166

160167
@PostMapping(value = ENDPOINT_URL, consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE,
@@ -447,15 +454,37 @@ private String getApproveDeviceViewName(ModelMap model, SamlPrincipal p, HttpSer
447454
if (perunOidcConfig.getTheme().equalsIgnoreCase("lsaai")) {
448455
model.put("getsOfflineAccess", dc.getScope().contains("offline_access"));
449456
model.put("jurisdiction", getJurisdiction(client));
457+
model.put("isTestSp", isTestSp(client));
450458
return "lsaai/" + APPROVE_DEVICE;
451459
}
452460
return THEMED_APPROVE_DEVICE;
453461
}
454462

463+
private boolean isTestSp(ClientDetailsEntity client) {
464+
if (client == null || !StringUtils.hasText(client.getClientId())) {
465+
return true;
466+
}
467+
Facility facility = perunAdapter.getFacilityByClientId(client.getClientId());
468+
if (facility == null || facility.getId() == null) {
469+
return true;
470+
}
471+
472+
PerunAttributeValue attrValue = perunAdapter.getFacilityAttributeValue(facility.getId(), "urn:perun:facility:attribute-def:def:isTestSp");
473+
if (attrValue == null) {
474+
return false;
475+
} else if (attrValue.valueAsBoolean()) {
476+
return attrValue.valueAsBoolean();
477+
}
478+
return false;
479+
}
480+
455481
private String getJurisdiction(ClientDetailsEntity client) {
456482
if (!StringUtils.hasText(client.getJurisdiction()) || euEaa.contains(client.getJurisdiction())) {
457483
return "";
458484
} else if (client.getJurisdiction().length() > 2) {
485+
if ("EMBL".equalsIgnoreCase(client.getJurisdiction())) {
486+
return "EMBL";
487+
}
459488
return "INT";
460489
}
461490

0 commit comments

Comments
 (0)