CP4AIOPS-3113 Pass authentication group delimiter to rails #389
Conversation
kbrock
changed the title
| @@ -10,4 +10,5 @@ RequestHeader set X_REMOTE_USER_FIRSTNAME %{OIDC_CLAIM_GIVEN_NAME}e | |||
| RequestHeader set X_REMOTE_USER_LASTNAME %{OIDC_CLAIM_FAMILY_NAME}e env=OIDC_CLAIM_FAMILY_NAME | |||
| RequestHeader set X_REMOTE_USER_FULLNAME %{OIDC_CLAIM_NAME}e env=OIDC_CLAIM_NAME | |||
| RequestHeader set X_REMOTE_USER_GROUPS %{OIDC_CLAIM_GROUPS}e env=OIDC_CLAIM_GROUPS | |||
| RequestHeader set X_REMOTE_USER_DELIMITER , env=OIDC_CLAIM_GROUPS | |||
There was a problem hiding this comment.
Not sure if this is the right place for this, but X_REMOTE_USER_DELIMITER feels like a confusing name, because it sounds like this delimeter is for the users themselves, and not the user's groups? I'm thinking X_REMOTE_USER_GROUPS_DELIMITER and it happens to match name-wise with X_REMOTE_USER_GROUPS showing they are related.
kbrock
force-pushed
the
CP4AIOPS-3113
branch
from
8ede0b0
to
c543efd
Compare
|
Seems the remote-user-saml.conf changes from https://github.com/ManageIQ/manageiq-appliance_console/pull/265/files are missing here? Additionally, I think the mellon change from here is needed: https://github.com/ManageIQ/manageiq-pods/pull/1155/files |
kbrock
force-pushed
the
CP4AIOPS-3113
branch
from
c543efd
to
28c5fc9
Compare
Each authentication system is configurated a little differently. open idc uses a , as the group delimiter This sets the configuration in apache so it can easily be passed to the individual containers. Just setting the value in settings.yml is a viable alternative
MellonMergeEnvVars On brings back all groups for REMOTE_USER_GROUPS By default, the delimiter is ;, but this can be overridden This is a no-op, but it highlights that a semicolon is used to join groups. Liberty (via oidc) is using a comma, but that is not displayed here. LookupUserGroups specifies a ":"
For multiple groups, LookupUser sets the delimiter to : rails will then use that to split up the group parameter Since saml (mod_auth_melon) uses a ;, we need to create a separate file This will also need to change in rails
kbrock
force-pushed
the
CP4AIOPS-3113
branch
from
28c5fc9
to
7814228
Compare
|
Checked commits kbrock/manageiq-appliance@7f78b09~...7814228 with ruby 3.1.5, rubocop 1.56.3, haml-lint 0.51.0, and yamllint |
|
update:
update:
|
Each authentication system is configurated a little differently. open idc uses a , as the group delimiter
This sets the configuration in apache so it can easily be passed to the individual containers.
Just setting the value in settings.yml is a viable alternative
see also ManageIQ/manageiq#23139