From 1f025f8f1e8b7cd415108026a047793ae1001c93 Mon Sep 17 00:00:00 2001 From: Nordine Bittich <3816305+nbittich@users.noreply.github.com> Date: Wed, 11 Aug 2021 10:02:04 +0200 Subject: [PATCH] Feature: acm/idm login --- .gitignore | 3 + config/authorization/config.ex | 83 +++++++++++++++---- config/dispatcher/dispatcher.ex | 19 ++--- ...151011002223444444-create-mock-user.sparql | 3 +- ...10815112611122233-create-mock-group.sparql | 2 +- .../20210824115111111133333333-auth.sparql | 18 ---- config/proxy-https/proxy_ssl.conf | 22 +++++ config/sink/sink.conf | 7 ++ docker-compose.dev.yml | 24 +++++- docker-compose.prod.yml | 7 +- docker-compose.yml | 26 +++++- 11 files changed, 161 insertions(+), 53 deletions(-) delete mode 100644 config/migrations/20210824115111111133333333-auth.sparql create mode 100644 config/proxy-https/proxy_ssl.conf create mode 100644 config/sink/sink.conf diff --git a/.gitignore b/.gitignore index 92f3276..2fbc202 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,6 @@ docker-compose.override.yml DS_STORE .DS_Store + +/config/proxy-https/cert.pem +/config/proxy-https/key.pem diff --git a/config/authorization/config.ex b/config/authorization/config.ex index 60c5983..af55f24 100644 --- a/config/authorization/config.ex +++ b/config/authorization/config.ex @@ -25,6 +25,68 @@ defmodule Acl.UserGroups.Config do def user_groups do [ + %GroupSpec{ + name: "acmidm", + useage: [:read, :write, :read_for_write], + access: %AccessByQuery{ + query: "PREFIX ext: + PREFIX mu: + PREFIX musession: + SELECT ?s WHERE { + ?s ?p ?o. + FILTER NOT EXISTS { + ext:hasAccount ?account. + } + } LIMIT 1", + vars: [] + }, + graphs: [ + %GraphSpec{ + graph: "http://mu.semte.ch/graphs/contacthub/141d9d6b-54af-4d17-b313-8d1c30bc3f5b/ChAdmin", + constraint: %ResourceConstraint{ + resource_types: [ + "http://www.w3.org/ns/org#Organization", + "http://data.vlaanderen.be/ns/besluit#Bestuurseenheid", + "http://data.lblod.info/vocabularies/erediensten/BestuurVanDeEredienst", + "http://data.vlaanderen.be/ns/besluit#Bestuursorgaan", + "http://data.lblod.info/vocabularies/erediensten/Eredienstbestuursorgaan", + "http://www.w3.org/ns/adms#Identifier", + "https://data.vlaanderen.be/ns/generiek#GestructureerdeIdentificator", + "http://www.w3.org/ns/org#ChangeEvent", + "http://data.lblod.info/vocabularies/erediensten/BetrokkenLokaleBesturen", + "http://www.w3.org/ns/prov#Location", + "http://www.w3.org/ns/org#Site", + "http://www.w3.org/ns/locn#Address", + "http://www.w3.org/ns/person#Person", + "http://data.vlaanderen.be/ns/mandaat#Mandaat", + "http://data.vlaanderen.be/ns/mandaat#Mandataris", + "http://data.lblod.info/vocabularies/erediensten/EredienstMandataris", + "http://schema.org/ContactPoint", + "http://data.lblod.info/vocabularies/leidinggevenden/Bestuursfunctie", + "http://data.lblod.info/vocabularies/erediensten/CentraalBestuurVanDeEredienst", + "http://data.lblod.info/vocabularies/erediensten/CentraleBestuursorgaan", + "http://data.lblod.info/vocabularies/erediensten/RepresentatiefOrgaan", + "http://www.w3.org/ns/org#Role", + "http://www.w3.org/ns/org#Post", + "http://data.lblod.info/vocabularies/contacthub/AgentInPositie", + "http://lblod.data.gift/vocabularies/organisatie/OrganisatieStatusCode", + "http://lblod.data.gift/vocabularies/organisatie/BestuursfunctieCode", + "http://lblod.data.gift/vocabularies/organisatie/BestuursorgaanClassificatieCode", + "http://lblod.data.gift/vocabularies/organisatie/TypeEredienst", + "http://lblod.data.gift/vocabularies/organisatie/HelftVerkiezing", + "http://lblod.data.gift/vocabularies/organisatie/Veranderingsgebeurtenis", + "http://lblod.data.gift/vocabularies/organisatie/MandatarisStatusCode", + "http://lblod.data.gift/vocabularies/organisatie/BestuurseenheidClassificatieCode", + "http://lblod.data.gift/vocabularies/organisatie/TypeBetrokkenheid", + "http://www.w3.org/2004/02/skos/core#ConceptScheme", + "http://www.w3.org/2004/02/skos/core#Concept", + "http://xmlns.com/foaf/0.1/Image", + "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject" + ] + } + } + ] + }, %GroupSpec{ name: "ch-admin", useage: [:read, :write, :read_for_write], @@ -89,24 +151,9 @@ defmodule Acl.UserGroups.Config do resource_prefix: "http://mu.semte.ch/sessions/" } } ] }, - %GroupSpec{ - name: "org", - useage: [:read], - access: %AccessByQuery{ - vars: ["session_group"], - query: "PREFIX ext: - PREFIX mu: - SELECT ?session_group ?session_role WHERE { - ext:sessionGroup/mu:uuid ?session_group. - }" }, - graphs: [ %GraphSpec{ - graph: "http://mu.semte.ch/graphs/organizations/", - constraint: %ResourceConstraint{ - resource_types: [ - "http://xmlns.com/foaf/0.1/Person", - "http://xmlns.com/foaf/0.1/OnlineAccount", - "http://www.w3.org/ns/adms#Identifier", - ] } } ] }, + + + # // CLEANUP # %GraphCleanup{ diff --git a/config/dispatcher/dispatcher.ex b/config/dispatcher/dispatcher.ex index 5f6f5ab..96750c7 100644 --- a/config/dispatcher/dispatcher.ex +++ b/config/dispatcher/dispatcher.ex @@ -211,6 +211,10 @@ defmodule Dispatcher do Proxy.forward conn, path, "http://mocklogin/sessions/" end + match "/sessions/*path", %{ accept: [:any], layer: :api} do + Proxy.forward conn, path, "http://login/sessions/" + end + ############### # API SERVICES ############### @@ -235,20 +239,13 @@ defmodule Dispatcher do end - ############################################################### - # ember metis - ############################################################### - get "/uri-info/*path", %{ accept: [:json], layer: :api} do - forward conn, path, "http://uri-info/" - end - - get "/resource-labels/*path", %{ accept: [:json], layer: :api} do - forward conn, path, "http://resource-labels/" - end - ############################################################### # frontend layer ############################################################### + match "/torii/redirect.html", %{ accept: [:html], layer: :api } do + Proxy.forward conn, [], "http://frontend/torii/redirect.html" + end + match "/assets/*path", %{ layer: :api } do Proxy.forward conn, path, "http://frontend/assets/" end diff --git a/config/migrations/202108151011002223444444-create-mock-user.sparql b/config/migrations/202108151011002223444444-create-mock-user.sparql index 2ebb37b..1d282c4 100644 --- a/config/migrations/202108151011002223444444-create-mock-user.sparql +++ b/config/migrations/202108151011002223444444-create-mock-user.sparql @@ -5,7 +5,7 @@ PREFIX mu: PREFIX ext: INSERT DATA { - GRAPH { + GRAPH { a foaf:Person ; mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3470" ; foaf:firstName "Mock" ; @@ -17,6 +17,7 @@ INSERT DATA { foaf:accountServiceHomepage ; ext:sessionRole "ChAdmin". } + GRAPH { a foaf:Person ; mu:uuid "d39fe09e-d339-4e43-8680-dbbcfb3d3470" ; diff --git a/config/migrations/20210815112611122233-create-mock-group.sparql b/config/migrations/20210815112611122233-create-mock-group.sparql index 2624663..f84e00e 100644 --- a/config/migrations/20210815112611122233-create-mock-group.sparql +++ b/config/migrations/20210815112611122233-create-mock-group.sparql @@ -4,7 +4,7 @@ PREFIX dcterms: PREFIX besluit: INSERT DATA { - GRAPH { + GRAPH { a besluit:Bestuurseenheid ; mu:uuid "141d9d6b-54af-4d17-b313-8d1c30bc3f5b" ; skos:prefLabel "Agentschap Binnenlands Bestuur" ; diff --git a/config/migrations/20210824115111111133333333-auth.sparql b/config/migrations/20210824115111111133333333-auth.sparql deleted file mode 100644 index 43adbab..0000000 --- a/config/migrations/20210824115111111133333333-auth.sparql +++ /dev/null @@ -1,18 +0,0 @@ -DELETE { - GRAPH { - ?s ?p ?o . - } -} INSERT { - GRAPH { - ?s ?p ?o . - } -} WHERE { - GRAPH { - ?s a ?type ; ?p ?o . - VALUES ?type { - - - - } - } -} \ No newline at end of file diff --git a/config/proxy-https/proxy_ssl.conf b/config/proxy-https/proxy_ssl.conf new file mode 100644 index 0000000..777f360 --- /dev/null +++ b/config/proxy-https/proxy_ssl.conf @@ -0,0 +1,22 @@ + +server { + listen *:443; + server_name organisaties.abb.lblod.info; + ssl on; + ssl_certificate /etc/nginx/conf.d/cert.pem; + ssl_certificate_key /etc/nginx/conf.d/key.pem; + + location / { + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_pass http://identifier; + client_max_body_size 3072m; + } + + location ~ /authorization/callback(.*) { + rewrite ^ /torii/redirect.html permanent; + } +} \ No newline at end of file diff --git a/config/sink/sink.conf b/config/sink/sink.conf new file mode 100644 index 0000000..6960c5c --- /dev/null +++ b/config/sink/sink.conf @@ -0,0 +1,7 @@ +server { + error_page 404 =200 @empty_json; + + location @empty_json { + return 200 "{}"; + } +} \ No newline at end of file diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml index 897042f..96c34f0 100644 --- a/docker-compose.dev.yml +++ b/docker-compose.dev.yml @@ -32,4 +32,26 @@ services: mocklogin: image: lblod/mock-login-service:latest links: - - db:database \ No newline at end of file + - db:database + sink: + restart: "no" + login: + restart: "no" + frontend: + image: lblod/frontend-contact-hub:latest + labels: + - "logging=true" + restart: always + environment: + EMBER_OAUTH_API_REDIRECT_URL: "https://organisaties.abb.lblod.info/authorization/callback" + EMBER_OAUTH_API_KEY: "677af572-2e2f-4e61-ad38-036723bb314c" + EMBER_OAUTH_API_BASE_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/auth" + EMBER_OAUTH_API_LOGOUT_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/logout" + EMBER_OAUTH_API_SCOPE: "openid vo profile abb_organisatieportaal" + restart: always + proxy: + image: nginx:1.13 + volumes: + - ./config/proxy-https:/etc/nginx/conf.d + ports: + - "443:443" \ No newline at end of file diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index ec27374..4ba8272 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -24,6 +24,9 @@ services: labels: - "logging=true" environment: - EMBER_METIS_BASE_URL: "http://data.lblod.info/id/" + EMBER_OAUTH_API_REDIRECT_URL: "https://organisaties.abb.lblod.info/authorization/callback" + EMBER_OAUTH_API_KEY: "677af572-2e2f-4e61-ad38-036723bb314c" + EMBER_OAUTH_API_BASE_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/auth" + EMBER_OAUTH_API_LOGOUT_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/logout" + EMBER_OAUTH_API_SCOPE: "openid vo profile abb_organisatieportaal" restart: always - logging: *default-logging diff --git a/docker-compose.yml b/docker-compose.yml index 30854fb..522caa6 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -114,4 +114,28 @@ services: deltanotifier: image: semtech/mu-delta-notifier:0.1.0 volumes: - - ./config/delta:/config \ No newline at end of file + - ./config/delta:/config + sink: + image: nginx:1.15.2 + volumes: + - ./config/sink/sink.conf:/etc/nginx/conf.d/default.conf + labels: + - "logging=true" + restart: always + logging: *default-logging + login: + image: lblod/acmidm-login-service:0.9.2-organisatie_portaal + links: + - db:database + environment: + MU_APPLICATION_AUTH_DISCOVERY_URL: "https://authenticatie-ti.vlaanderen.be/op" + MU_APPLICATION_AUTH_CLIENT_ID: "677af572-2e2f-4e61-ad38-036723bb314c" + MU_APPLICATION_AUTH_REDIRECT_URI: "https://organisaties.abb.lblod.info/authorization/callback" + MU_APPLICATION_AUTH_CLIENT_SECRET: "" + labels: + - "logging=true" + restart: always + logging: *default-logging + links: + - db:database +