Skip to content

Commit 9dec863

Browse files
svedziokSven Twardziokuniquegsourcery-ai[bot]
authored
docs(admin): describe LS Login configuration (#25)
Co-authored-by: Sven Twardziok <[email protected]> Co-authored-by: Alex Kanitz <[email protected]> Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com>
1 parent c9d33cb commit 9dec863

File tree

2 files changed

+119
-0
lines changed

2 files changed

+119
-0
lines changed

‎docs/guides/guide-admin/services_to_ls_aai.md

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
# Using LS-Login in JupyterHub
2+
3+
* For deploying JupyterHub in de.NBI Cloud using Kubernetes see this [tutorial](https://cloud.denbi.de/wiki/Tutorials/JupyterHub/).
4+
* JupyterHub can be configured to use Life Science Login. Therefore, you need to have a service registered at LS-Login ([HowTo](https://docs.google.com/document/d/17pNXM_psYOP5rWF302ObAJACsfYnEWhjvxAHzcjvfIE/edit?tab=t.0#heading=h.suudoy1bqtvm)).
5+
* In the SPREG tool ([link](https://services.aai.lifescience-ri.eu/spreg)) you have to register the Redirect URIs accordingly to your domain at the SAML/OIDC setting page (`https://{yourdomain}/hub/oauth_callback` - be aware to change `{yourdomain}` accordingly). LS-LOGIN does exact matching of the URL, so adding `/hub/oauth_callback` is required and the domain alone is not sufficient.
6+
* In the SAML/OIDC setting page, you will also find values for Client ID and Client Secret
7+
* To use LS-Login in Jupyterhub, you have to modify the config.yaml file (see also [here](https://z2jh.jupyter.org/en/stable/administrator/authentication.html)):
8+
9+
```yaml
10+
hub:
11+
config:
12+
Authenticator:
13+
allow_all: true
14+
admin_users:
15+
- ADMIN # here you can specify an user as admin
16+
GenericOAuthenticator:
17+
client_id: # add client id from SPREG
18+
client_secret: # add client secret from SPREG
19+
login_service : LS LOGIN
20+
oauth_callback_url: https://{yourdomain}/hub/oauth_callback # change to you domain accordingly
21+
authorize_url: https://login.aai.lifescience-ri.eu/oidc/authorize
22+
token_url: https://login.aai.lifescience-ri.eu/oidc/token
23+
userdata_url: https://login.aai.lifescience-ri.eu/oidc/userinfo
24+
username_claim: preferred_username # used in newer versions
25+
username_key: preferred_username # this variable is deprecated in newer versions
26+
scope:
27+
- openid
28+
- email
29+
- profile
30+
JupyterHub:
31+
authenticator_class: generic-oauth
32+
cull:
33+
enabled: false
34+
```
35+
36+
# Add LS_Login to Hedgedoc
37+
38+
Before configuring Hedgedoc, you need to register your service with LS-Login. Follow the registration process at https://lifescience-ri.eu/ls-login/documentation/how-to-integrate/registration.html
39+
40+
Hedgedoc is configured using environment variables. This guide assumes that a Hedgedoc is already deployed, in our case we used this chart:
41+
42+
https://github.com/CSCfi/helm-charts/tree/main/charts/hedgedoc
43+
44+
Once Hedgedoc is deployed, in order to add LS-AAI login one just needs to add these variables:
45+
46+
- name: CMD_OAUTH2_USER_PROFILE_URL
47+
- value: https://login.aai.lifescience-ri.eu/oidc/userinfo
48+
- name: CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR
49+
- value: preferred_username
50+
- name: CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR
51+
- value: name
52+
- name: CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR
53+
- value: email
54+
- name: CMD_OAUTH2_TOKEN_URL
55+
- value: https://login.aai.lifescience-ri.eu/oidc/token
56+
- name: CMD_OAUTH2_AUTHORIZATION_URL
57+
- value: https://login.aai.lifescience-ri.eu/oidc/authorize
58+
- name: CMD_OAUTH2_CLIENT_ID
59+
- value: _REPLACE BY CLIENT ID_
60+
- name: CMD_OAUTH2_CLIENT_SECRET
61+
- value: _REPLACE BY CLIENT SECRET_
62+
- name: CMD_OAUTH2_PROVIDERNAME
63+
- value: ELIXIR Cloud & AAI
64+
- name: CMD_OAUTH2_SCOPE
65+
- value: openid email profile
66+
67+
The documentation from Hedgedoc about this is at:
68+
69+
https://docs.hedgedoc.org/configuration/#oauth2-login
70+
71+
# Using LS-Login in MinIO
72+
73+
LS-Login can be activated in MinIO either by using the MinIO console using the OIDC configuration or by setting environmental variables ([MinIO OIDC Documentation](https://min.io/docs/minio/linux/operations/external-iam/configure-openid-external-identity-management.html)).
74+
75+
- Config URL (MINIO_IDENTITY_OPENID_CONFIG_URL)
76+
- https://login.aai.lifescience-ri.eu/oidc/.well-known/openid-configuration
77+
- Client ID (MINIO_IDENTITY_OPENID_CLIENT_ID)
78+
- ID of the LS-Login service
79+
- Client secret (MINIO_IDENTITY_OPENID_CLIENT_SECRET)
80+
- Secret of the LS-Login service
81+
- Display Name (MINIO_IDENTITY_OPENID_DISPLAY_NAME)
82+
- A human readable label for the login button (e.g. `LS-Login`)
83+
- Scopes (MINIO_IDENTITY_OPENID_SCOPES)
84+
- Scopes that will be requested from LS-Login (e.g. `openid,email,profile`)
85+
- Role policy (MINIO_IDENTITY_OPENID_ROLE_POLICY)
86+
- Name of a policy in MinIO that will be used to manage access of LS-Login users (e.g. `readonly`).
87+
- Claim User Info (MINIO_IDENTITY_OPENID_CLAIM_USERINFO)
88+
- Allow MinIO to request the userinfo endpoint for additional information (`on`).
89+
90+
MinIO supports two different mechanisms for authorization of users with OIDC ([MinIO OIDC authorization](https://min.io/docs/minio/linux/administration/identity-access-management/oidc-access-management.html#minio-external-identity-management-openid)). It is recommended to use the RolePolicy flow. Here, all LS-Login users in MinIO will be assigned to one or more policies. These policies can control access to specific buckets by group membership; e.g. require that users belong to a specific LS-AAI group (see [policy based access control](https://min.io/docs/minio/linux/administration/identity-access-management/policy-based-access-control.html#tag-based-policy-conditions)).
91+
92+
In the example below, access to a bucket (`sensitive/`) is restricted to a list of users which are identified by their `preferred_username` claims.
93+
94+
```json
95+
{
96+
"Version": "2012-10-17",
97+
"Statement": [
98+
{
99+
"Effect": "Allow",
100+
"Action": [
101+
"s3:GetObject",
102+
"s3:ListBucket"
103+
],
104+
"Resource": [
105+
"arn:aws:s3:::sensitive",
106+
"arn:aws:s3:::sensitive/*"
107+
],
108+
"Condition": {
109+
"StringEquals": {
110+
"jwt:preferred_username": [
111+
"ELIXIR_USERNAME"
112+
]
113+
}
114+
}
115+
}
116+
]
117+
}
118+
```

‎mkdocs.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ nav:
8989
- "guides/guide-dev/index.md"
9090
- Administrators:
9191
- "guides/guide-admin/index.md"
92+
- "LS Login configuration": "guides/guide-admin/services_to_ls_aai.md"
9293
- Contributors:
9394
- "guides/guide-contributor/index.md"
9495
- "Workflow": "guides/guide-contributor/workflow.md"

0 commit comments

Comments
 (0)