Feature: acm/idm login

2021-08-11 10:02:04 +02:00
parent e431707ef0
commit 1f025f8f1e
11 changed files with 161 additions and 53 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,6 @@ docker-compose.override.yml

 DS_STORE
 .DS_Store
+
+/config/proxy-https/cert.pem
+/config/proxy-https/key.pem
--- a/config/authorization/config.ex
+++ b/config/authorization/config.ex
@@ -25,6 +25,68 @@ defmodule Acl.UserGroups.Config do

  def user_groups do
    [
+            %GroupSpec{
+        name: "acmidm",
+        useage: [:read, :write, :read_for_write],
+        access: %AccessByQuery{
+          query: "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
+                  PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
+                  PREFIX musession: <http://mu.semte.ch/vocabularies/session/>
+                  SELECT ?s WHERE {
+                    ?s ?p ?o.
+                    FILTER NOT EXISTS {
+                      <SESSION_ID> ext:hasAccount ?account.
+                    }
+                  } LIMIT 1",
+          vars: []
+        },
+        graphs: [
+          %GraphSpec{
+            graph: "http://mu.semte.ch/graphs/contacthub/141d9d6b-54af-4d17-b313-8d1c30bc3f5b/ChAdmin",
+            constraint: %ResourceConstraint{
+              resource_types: [
+                        "http://www.w3.org/ns/org#Organization",
+                        "http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
+                        "http://data.lblod.info/vocabularies/erediensten/BestuurVanDeEredienst",
+                        "http://data.vlaanderen.be/ns/besluit#Bestuursorgaan",
+                        "http://data.lblod.info/vocabularies/erediensten/Eredienstbestuursorgaan",
+                        "http://www.w3.org/ns/adms#Identifier",
+                        "https://data.vlaanderen.be/ns/generiek#GestructureerdeIdentificator",
+                        "http://www.w3.org/ns/org#ChangeEvent",
+                        "http://data.lblod.info/vocabularies/erediensten/BetrokkenLokaleBesturen",
+                        "http://www.w3.org/ns/prov#Location",
+                        "http://www.w3.org/ns/org#Site",
+                        "http://www.w3.org/ns/locn#Address",                          
+                        "http://www.w3.org/ns/person#Person",
+                        "http://data.vlaanderen.be/ns/mandaat#Mandaat",
+                        "http://data.vlaanderen.be/ns/mandaat#Mandataris",
+                        "http://data.lblod.info/vocabularies/erediensten/EredienstMandataris",
+                        "http://schema.org/ContactPoint",                          
+                        "http://data.lblod.info/vocabularies/leidinggevenden/Bestuursfunctie",
+                        "http://data.lblod.info/vocabularies/erediensten/CentraalBestuurVanDeEredienst",
+                        "http://data.lblod.info/vocabularies/erediensten/CentraleBestuursorgaan",
+                        "http://data.lblod.info/vocabularies/erediensten/RepresentatiefOrgaan",                          
+                        "http://www.w3.org/ns/org#Role",
+                        "http://www.w3.org/ns/org#Post",
+                        "http://data.lblod.info/vocabularies/contacthub/AgentInPositie",
+                        "http://lblod.data.gift/vocabularies/organisatie/OrganisatieStatusCode",
+                        "http://lblod.data.gift/vocabularies/organisatie/BestuursfunctieCode",
+                        "http://lblod.data.gift/vocabularies/organisatie/BestuursorgaanClassificatieCode",
+                        "http://lblod.data.gift/vocabularies/organisatie/TypeEredienst",
+                        "http://lblod.data.gift/vocabularies/organisatie/HelftVerkiezing",
+                        "http://lblod.data.gift/vocabularies/organisatie/Veranderingsgebeurtenis",
+                        "http://lblod.data.gift/vocabularies/organisatie/MandatarisStatusCode",
+                        "http://lblod.data.gift/vocabularies/organisatie/BestuurseenheidClassificatieCode",
+                        "http://lblod.data.gift/vocabularies/organisatie/TypeBetrokkenheid",
+                        "http://www.w3.org/2004/02/skos/core#ConceptScheme",
+                        "http://www.w3.org/2004/02/skos/core#Concept",
+                        "http://xmlns.com/foaf/0.1/Image",
+                        "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
+              ]
+            }
+          }
+        ]
+      },
           %GroupSpec{
        name: "ch-admin",
        useage: [:read, :write, :read_for_write],
@@ -89,24 +151,9 @@ defmodule Acl.UserGroups.Config do
                      resource_prefix: "http://mu.semte.ch/sessions/"
                    } } ] },
  
-      %GroupSpec{
-        name: "org",
-        useage: [:read],
-        access: %AccessByQuery{
-          vars: ["session_group"],
-          query: "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
-                  PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
-                  SELECT ?session_group ?session_role WHERE {
-                    <SESSION_ID> ext:sessionGroup/mu:uuid ?session_group.
-                    }" },
-        graphs: [ %GraphSpec{
-                    graph: "http://mu.semte.ch/graphs/organizations/",
-                    constraint: %ResourceConstraint{
-                      resource_types: [
-                        "http://xmlns.com/foaf/0.1/Person",
-                        "http://xmlns.com/foaf/0.1/OnlineAccount",
-                        "http://www.w3.org/ns/adms#Identifier",
-                      ] } } ] },
+     
+
+                      
      # // CLEANUP
      #
      %GraphCleanup{
--- a/config/dispatcher/dispatcher.ex
+++ b/config/dispatcher/dispatcher.ex
@@ -211,6 +211,10 @@ defmodule Dispatcher do
    Proxy.forward conn, path, "http://mocklogin/sessions/"
  end

+  match "/sessions/*path", %{ accept: [:any], layer: :api} do
+    Proxy.forward conn, path, "http://login/sessions/"
+  end
+  
  ###############
  # API SERVICES
  ###############
@@ -235,20 +239,13 @@ defmodule Dispatcher do
  end


-  ###############################################################
-  # ember metis
-  ###############################################################
-  get "/uri-info/*path", %{ accept: [:json], layer: :api} do
-    forward conn, path, "http://uri-info/"
-  end
-
-  get "/resource-labels/*path", %{ accept: [:json], layer: :api} do
-    forward conn, path, "http://resource-labels/"
-  end  
-
  ###############################################################
  # frontend layer
  ###############################################################
+  match "/torii/redirect.html", %{ accept: [:html], layer: :api } do
+    Proxy.forward conn, [], "http://frontend/torii/redirect.html"
+  end
+
  match "/assets/*path", %{ layer: :api } do
    Proxy.forward conn, path, "http://frontend/assets/"
  end
--- a/config/migrations/202108151011002223444444-create-mock-user.sparql
+++ b/config/migrations/202108151011002223444444-create-mock-user.sparql
@@ -5,7 +5,7 @@ PREFIX mu:<http://mu.semte.ch/vocabularies/core/>
 PREFIX ext:<http://mu.semte.ch/vocabularies/ext/>

 INSERT DATA {
-  GRAPH <http://mu.semte.ch/application> {
+  GRAPH <http://mu.semte.ch/graphs/public> {
    <http://data.lblod.info/id/persoon/d39fe09e-d339-4e43-8680-dbbcfb3d3470> a foaf:Person ;
      mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3470" ;
      foaf:firstName "Mock" ;
@@ -17,6 +17,7 @@ INSERT DATA {
      foaf:accountServiceHomepage <https://github.com/lblod/mock-login-service>;
      ext:sessionRole "ChAdmin".
  }
+
  GRAPH <http://mu.semte.ch/graphs/organizations/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> {
    <http://data.lblod.info/id/persoon/d39fe09e-d339-4e43-8680-dbbcfb3d3470> a foaf:Person ;
      mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3470" ;
--- a/config/migrations/20210815112611122233-create-mock-group.sparql
+++ b/config/migrations/20210815112611122233-create-mock-group.sparql
@@ -4,7 +4,7 @@ PREFIX dcterms: <http://purl.org/dc/terms/>
 PREFIX besluit: <http://data.vlaanderen.be/ns/besluit#>

 INSERT DATA {
-  GRAPH <http://mu.semte.ch/application> {
+  GRAPH <http://mu.semte.ch/graphs/public> {
    <http://data.lblod.info/id/bestuurseenheden/141d9d6b-54af-4d17-b313-8d1c30bc3f5b> a besluit:Bestuurseenheid ;
       mu:uuid "141d9d6b-54af-4d17-b313-8d1c30bc3f5b" ;
       skos:prefLabel "Agentschap Binnenlands Bestuur" ;
--- a/config/migrations/20210824115111111133333333-auth.sparql
+++ b/config/migrations/20210824115111111133333333-auth.sparql
@@ -1,18 +0,0 @@
-DELETE {
-  GRAPH  <http://mu.semte.ch/application> {
-    ?s ?p ?o .
-  }
-} INSERT {
-  GRAPH  <http://mu.semte.ch/graphs/public> {
-    ?s ?p ?o .
-  }
-} WHERE {
-  GRAPH  <http://mu.semte.ch/application> {
-    ?s a ?type ; ?p ?o .
-    VALUES ?type {
-        <http://data.vlaanderen.be/ns/besluit#Bestuurseenheid>
-        <http://xmlns.com/foaf/0.1/Person>
-        <http://xmlns.com/foaf/0.1/OnlineAccount>
-    }
-  }
-}
--- a/config/proxy-https/proxy_ssl.conf
+++ b/config/proxy-https/proxy_ssl.conf
@@ -0,0 +1,22 @@
+
+server {
+  listen *:443;
+  server_name organisaties.abb.lblod.info;
+  ssl on;
+  ssl_certificate /etc/nginx/conf.d/cert.pem;
+  ssl_certificate_key /etc/nginx/conf.d/key.pem;
+
+  location / {
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header    X-Forwarded-For $remote_addr;
+        proxy_pass http://identifier;
+        client_max_body_size 3072m;
+  }
+
+  location ~ /authorization/callback(.*) {
+    rewrite ^ /torii/redirect.html permanent;
+  }
+}
--- a/config/sink/sink.conf
+++ b/config/sink/sink.conf
@@ -0,0 +1,7 @@
+server {
+  error_page 404 =200 @empty_json;
+
+  location @empty_json {
+    return 200 "{}";
+  }
+}
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -32,4 +32,26 @@ services:
  mocklogin:
    image: lblod/mock-login-service:latest
    links:
-      - db:database
+      - db:database
+  sink:
+    restart: "no"
+  login:
+    restart: "no"
+  frontend:
+    image: lblod/frontend-contact-hub:latest
+    labels:
+      - "logging=true"
+    restart: always
+    environment: 
+     EMBER_OAUTH_API_REDIRECT_URL: "https://organisaties.abb.lblod.info/authorization/callback"
+     EMBER_OAUTH_API_KEY: "677af572-2e2f-4e61-ad38-036723bb314c"
+     EMBER_OAUTH_API_BASE_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/auth"
+     EMBER_OAUTH_API_LOGOUT_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/logout"
+     EMBER_OAUTH_API_SCOPE: "openid vo profile abb_organisatieportaal"
+    restart: always
+  proxy:
+    image: nginx:1.13
+    volumes:
+      - ./config/proxy-https:/etc/nginx/conf.d
+    ports:
+      - "443:443"
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -24,6 +24,9 @@ services:
    labels:
      - "logging=true"
    environment: 
-     EMBER_METIS_BASE_URL: "http://data.lblod.info/id/"
+     EMBER_OAUTH_API_REDIRECT_URL: "https://organisaties.abb.lblod.info/authorization/callback"
+     EMBER_OAUTH_API_KEY: "677af572-2e2f-4e61-ad38-036723bb314c"
+     EMBER_OAUTH_API_BASE_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/auth"
+     EMBER_OAUTH_API_LOGOUT_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/logout"
+     EMBER_OAUTH_API_SCOPE: "openid vo profile abb_organisatieportaal"
    restart: always
-    logging: *default-logging
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -114,4 +114,28 @@ services:
  deltanotifier:
    image: semtech/mu-delta-notifier:0.1.0
    volumes:
-      - ./config/delta:/config
+      - ./config/delta:/config
+  sink:
+    image: nginx:1.15.2
+    volumes:
+      - ./config/sink/sink.conf:/etc/nginx/conf.d/default.conf
+    labels:
+      - "logging=true"
+    restart: always
+    logging: *default-logging
+  login:
+    image: lblod/acmidm-login-service:0.9.2-organisatie_portaal
+    links:
+      - db:database
+    environment:
+      MU_APPLICATION_AUTH_DISCOVERY_URL: "https://authenticatie-ti.vlaanderen.be/op"
+      MU_APPLICATION_AUTH_CLIENT_ID: "677af572-2e2f-4e61-ad38-036723bb314c"
+      MU_APPLICATION_AUTH_REDIRECT_URI: "https://organisaties.abb.lblod.info/authorization/callback"
+      MU_APPLICATION_AUTH_CLIENT_SECRET: ""
+    labels:
+      - "logging=true"
+    restart: always
+    logging: *default-logging
+    links:
+      - db:database
+