Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

✨ [#2263] Setup configuration steps for authentication #1137

Merged
merged 10 commits into from
Apr 19, 2024
14 changes: 14 additions & 0 deletions src/digid_eherkenning_oidc_generics/admin.py
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,20 @@ class OpenIDConnectConfigBaseAdmin(SingletonModelAdmin):
},
),
(_("Keycloak specific settings"), {"fields": ("oidc_keycloak_idp_hint",)}),
(
_("Advanced settings"),
{
"fields": (
"oidc_use_nonce",
"oidc_nonce_size",
"oidc_state_size",
"oidc_exempt_urls",
),
"classes": [
"collapse in",
],
},
),
)


Expand Down
207 changes: 207 additions & 0 deletions src/open_inwoner/conf/app/setup_configuration.py
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,11 @@
"open_inwoner.configurations.bootstrap.kic.ContactmomentenAPIConfigurationStep",
"open_inwoner.configurations.bootstrap.kic.KICAPIsConfigurationStep",
"open_inwoner.configurations.bootstrap.siteconfig.SiteConfigurationStep",
"open_inwoner.configurations.bootstrap.auth.DigiDOIDCConfigurationStep",
"open_inwoner.configurations.bootstrap.auth.eHerkenningOIDCConfigurationStep",
"open_inwoner.configurations.bootstrap.auth.AdminOIDCConfigurationStep",
"open_inwoner.configurations.bootstrap.auth.DigiDConfigurationStep",
"open_inwoner.configurations.bootstrap.auth.eHerkenningConfigurationStep",
]
OIP_ORGANIZATION = config("OIP_ORGANIZATION", "")

Expand Down Expand Up @@ -183,3 +188,205 @@
SITE_DISPLAY_SOCIAL = config("SITE_DISPLAY_SOCIAL", None)
SITE_THEME_STYLESHEET = config("SITE_THEME_STYLESHEET", None)
SITE_EHERKENNING_ENABLED = config("SITE_EHERKENNING_ENABLED", None)


# Authentication configuration variables
# NOTE variables are namespaced with `DIGID_OIDC`, but some model field names also have `oidc_...` in them
DIGID_OIDC_CONFIG_ENABLE = config("DIGID_OIDC_CONFIG_ENABLE", True)
DIGID_OIDC_IDENTIFIER_CLAIM_NAME = config("DIGID_OIDC_IDENTIFIER_CLAIM_NAME", None)
DIGID_OIDC_OIDC_RP_CLIENT_ID = config("DIGID_OIDC_OIDC_RP_CLIENT_ID", None)
DIGID_OIDC_OIDC_RP_CLIENT_SECRET = config("DIGID_OIDC_OIDC_RP_CLIENT_SECRET", None)
DIGID_OIDC_OIDC_RP_SIGN_ALGO = config("DIGID_OIDC_OIDC_RP_SIGN_ALGO", None)
DIGID_OIDC_OIDC_RP_SCOPES_LIST = config("DIGID_OIDC_OIDC_RP_SCOPES_LIST", None)
DIGID_OIDC_OIDC_OP_DISCOVERY_ENDPOINT = config(
"DIGID_OIDC_OIDC_OP_DISCOVERY_ENDPOINT", None
)
DIGID_OIDC_OIDC_OP_JWKS_ENDPOINT = config("DIGID_OIDC_OIDC_OP_JWKS_ENDPOINT", None)
DIGID_OIDC_OIDC_OP_AUTHORIZATION_ENDPOINT = config(
"DIGID_OIDC_OIDC_OP_AUTHORIZATION_ENDPOINT", None
)
DIGID_OIDC_OIDC_OP_TOKEN_ENDPOINT = config("DIGID_OIDC_OIDC_OP_TOKEN_ENDPOINT", None)
DIGID_OIDC_OIDC_OP_USER_ENDPOINT = config("DIGID_OIDC_OIDC_OP_USER_ENDPOINT", None)
DIGID_OIDC_OIDC_RP_IDP_SIGN_KEY = config("DIGID_OIDC_OIDC_RP_IDP_SIGN_KEY", None)
DIGID_OIDC_USERINFO_CLAIMS_SOURCE = config("DIGID_OIDC_USERINFO_CLAIMS_SOURCE", None)
DIGID_OIDC_OIDC_OP_LOGOUT_ENDPOINT = config("DIGID_OIDC_OIDC_OP_LOGOUT_ENDPOINT", None)
DIGID_OIDC_ERROR_MESSAGE_MAPPING = config("DIGID_OIDC_ERROR_MESSAGE_MAPPING", None)
DIGID_OIDC_OIDC_KEYCLOAK_IDP_HINT = config("DIGID_OIDC_OIDC_KEYCLOAK_IDP_HINT", None)
DIGID_OIDC_OIDC_USE_NONCE = config("DIGID_OIDC_OIDC_USE_NONCE", None)
DIGID_OIDC_OIDC_NONCE_SIZE = config("DIGID_OIDC_OIDC_NONCE_SIZE", None)
DIGID_OIDC_OIDC_STATE_SIZE = config("DIGID_OIDC_OIDC_STATE_SIZE", None)
DIGID_OIDC_OIDC_EXEMPT_URLS = config("DIGID_OIDC_OIDC_EXEMPT_URLS", None)

# NOTE variables are namespaced with `EHERKENNING_OIDC`, but some model field names also have `oidc_...` in them
EHERKENNING_OIDC_CONFIG_ENABLE = config("EHERKENNING_OIDC_CONFIG_ENABLE", True)
EHERKENNING_OIDC_IDENTIFIER_CLAIM_NAME = config(
"EHERKENNING_OIDC_IDENTIFIER_CLAIM_NAME", None
)
EHERKENNING_OIDC_OIDC_RP_CLIENT_ID = config("EHERKENNING_OIDC_OIDC_RP_CLIENT_ID", None)
EHERKENNING_OIDC_OIDC_RP_CLIENT_SECRET = config(
"EHERKENNING_OIDC_OIDC_RP_CLIENT_SECRET", None
)
EHERKENNING_OIDC_OIDC_RP_SIGN_ALGO = config("EHERKENNING_OIDC_OIDC_RP_SIGN_ALGO", None)
EHERKENNING_OIDC_OIDC_RP_SCOPES_LIST = config(
"EHERKENNING_OIDC_OIDC_RP_SCOPES_LIST", None
)
EHERKENNING_OIDC_OIDC_OP_DISCOVERY_ENDPOINT = config(
"EHERKENNING_OIDC_OIDC_OP_DISCOVERY_ENDPOINT", None
)
EHERKENNING_OIDC_OIDC_OP_JWKS_ENDPOINT = config(
"EHERKENNING_OIDC_OIDC_OP_JWKS_ENDPOINT", None
)
EHERKENNING_OIDC_OIDC_OP_AUTHORIZATION_ENDPOINT = config(
"EHERKENNING_OIDC_OIDC_OP_AUTHORIZATION_ENDPOINT", None
)
EHERKENNING_OIDC_OIDC_OP_TOKEN_ENDPOINT = config(
"EHERKENNING_OIDC_OIDC_OP_TOKEN_ENDPOINT", None
)
EHERKENNING_OIDC_OIDC_OP_USER_ENDPOINT = config(
"EHERKENNING_OIDC_OIDC_OP_USER_ENDPOINT", None
)
EHERKENNING_OIDC_OIDC_RP_IDP_SIGN_KEY = config(
"EHERKENNING_OIDC_OIDC_RP_IDP_SIGN_KEY", None
)
EHERKENNING_OIDC_USERINFO_CLAIMS_SOURCE = config(
"EHERKENNING_OIDC_USERINFO_CLAIMS_SOURCE", None
)
EHERKENNING_OIDC_OIDC_OP_LOGOUT_ENDPOINT = config(
"EHERKENNING_OIDC_OIDC_OP_LOGOUT_ENDPOINT", None
)
EHERKENNING_OIDC_ERROR_MESSAGE_MAPPING = config(
"EHERKENNING_OIDC_ERROR_MESSAGE_MAPPING", None
)
EHERKENNING_OIDC_OIDC_KEYCLOAK_IDP_HINT = config(
"EHERKENNING_OIDC_OIDC_KEYCLOAK_IDP_HINT", None
)
EHERKENNING_OIDC_OIDC_USE_NONCE = config("EHERKENNING_OIDC_OIDC_USE_NONCE", None)
EHERKENNING_OIDC_OIDC_NONCE_SIZE = config("EHERKENNING_OIDC_OIDC_NONCE_SIZE", None)
EHERKENNING_OIDC_OIDC_STATE_SIZE = config("EHERKENNING_OIDC_OIDC_STATE_SIZE", None)
EHERKENNING_OIDC_OIDC_EXEMPT_URLS = config("EHERKENNING_OIDC_OIDC_EXEMPT_URLS", None)

# NOTE variables are namespaced with `ADMIN_OIDC`, but some model field names also have `oidc_...` in them
ADMIN_OIDC_CONFIG_ENABLE = config("ADMIN_OIDC_CONFIG_ENABLE", default=True)
ADMIN_OIDC_OIDC_RP_CLIENT_ID = config("ADMIN_OIDC_OIDC_RP_CLIENT_ID", None)
ADMIN_OIDC_OIDC_RP_CLIENT_SECRET = config("ADMIN_OIDC_OIDC_RP_CLIENT_SECRET", None)
ADMIN_OIDC_OIDC_RP_SCOPES_LIST = config("ADMIN_OIDC_OIDC_RP_SCOPES_LIST", None)
ADMIN_OIDC_OIDC_RP_SIGN_ALGO = config("ADMIN_OIDC_OIDC_RP_SIGN_ALGO", None)
ADMIN_OIDC_OIDC_RP_IDP_SIGN_KEY = config("ADMIN_OIDC_OIDC_RP_IDP_SIGN_KEY", None)
ADMIN_OIDC_OIDC_OP_DISCOVERY_ENDPOINT = config(
"ADMIN_OIDC_OIDC_OP_DISCOVERY_ENDPOINT", None
)
ADMIN_OIDC_OIDC_OP_JWKS_ENDPOINT = config("ADMIN_OIDC_OIDC_OP_JWKS_ENDPOINT", None)
ADMIN_OIDC_OIDC_OP_AUTHORIZATION_ENDPOINT = config(
"ADMIN_OIDC_OIDC_OP_AUTHORIZATION_ENDPOINT", None
)
ADMIN_OIDC_OIDC_OP_TOKEN_ENDPOINT = config("ADMIN_OIDC_OIDC_OP_TOKEN_ENDPOINT", None)
ADMIN_OIDC_OIDC_OP_USER_ENDPOINT = config("ADMIN_OIDC_OIDC_OP_USER_ENDPOINT", None)
ADMIN_OIDC_USERNAME_CLAIM = config("ADMIN_OIDC_USERNAME_CLAIM", None)
ADMIN_OIDC_GROUPS_CLAIM = config("ADMIN_OIDC_GROUPS_CLAIM", None)
ADMIN_OIDC_CLAIM_MAPPING = config("ADMIN_OIDC_CLAIM_MAPPING", None)
ADMIN_OIDC_SYNC_GROUPS = config("ADMIN_OIDC_SYNC_GROUPS", None)
ADMIN_OIDC_SYNC_GROUPS_GLOB_PATTERN = config(
"ADMIN_OIDC_SYNC_GROUPS_GLOB_PATTERN", None
)
ADMIN_OIDC_DEFAULT_GROUPS = config("ADMIN_OIDC_DEFAULT_GROUPS", None)
ADMIN_OIDC_MAKE_USERS_STAFF = config("ADMIN_OIDC_MAKE_USERS_STAFF", None)
ADMIN_OIDC_SUPERUSER_GROUP_NAMES = config("ADMIN_OIDC_SUPERUSER_GROUP_NAMES", None)
ADMIN_OIDC_OIDC_USE_NONCE = config("ADMIN_OIDC_OIDC_USE_NONCE", None)
ADMIN_OIDC_OIDC_NONCE_SIZE = config("ADMIN_OIDC_OIDC_NONCE_SIZE", None)
ADMIN_OIDC_OIDC_STATE_SIZE = config("ADMIN_OIDC_OIDC_STATE_SIZE", None)
ADMIN_OIDC_OIDC_EXEMPT_URLS = config("ADMIN_OIDC_OIDC_EXEMPT_URLS", None)
ADMIN_OIDC_USERINFO_CLAIMS_SOURCE = config("ADMIN_OIDC_USERINFO_CLAIMS_SOURCE", None)

DIGID_CONFIG_ENABLE = config("DIGID_CONFIG_ENABLE", default=True)
DIGID_CERTIFICATE_LABEL = config("DIGID_CERTIFICATE_LABEL", None)
DIGID_CERTIFICATE_TYPE = config("DIGID_CERTIFICATE_TYPE", None)
DIGID_CERTIFICATE_PUBLIC_CERTIFICATE = config(
"DIGID_CERTIFICATE_PUBLIC_CERTIFICATE", None
)
DIGID_CERTIFICATE_PRIVATE_KEY = config("DIGID_CERTIFICATE_PRIVATE_KEY", None)
DIGID_METADATA_FILE_SOURCE = config("DIGID_METADATA_FILE_SOURCE", None)
DIGID_WANT_ASSERTIONS_SIGNED = config("DIGID_WANT_ASSERTIONS_SIGNED", None)
DIGID_WANT_ASSERTIONS_ENCRYPTED = config("DIGID_WANT_ASSERTIONS_ENCRYPTED", None)
DIGID_ARTIFACT_RESOLVE_CONTENT_TYPE = config(
"DIGID_ARTIFACT_RESOLVE_CONTENT_TYPE", None
)
DIGID_KEY_PASSPHRASE = config("DIGID_KEY_PASSPHRASE", None)
DIGID_SIGNATURE_ALGORITHM = config("DIGID_SIGNATURE_ALGORITHM", None)
DIGID_DIGEST_ALGORITHM = config("DIGID_DIGEST_ALGORITHM", None)
DIGID_ENTITY_ID = config("DIGID_ENTITY_ID", None)
DIGID_BASE_URL = config("DIGID_BASE_URL", None)
DIGID_SERVICE_NAME = config("DIGID_SERVICE_NAME", None)
DIGID_SERVICE_DESCRIPTION = config("DIGID_SERVICE_DESCRIPTION", None)
DIGID_TECHNICAL_CONTACT_PERSON_TELEPHONE = config(
"DIGID_TECHNICAL_CONTACT_PERSON_TELEPHONE", None
)
DIGID_TECHNICAL_CONTACT_PERSON_EMAIL = config(
"DIGID_TECHNICAL_CONTACT_PERSON_EMAIL", None
)
DIGID_ORGANIZATION_URL = config("DIGID_ORGANIZATION_URL", None)
DIGID_ORGANIZATION_NAME = config("DIGID_ORGANIZATION_NAME", None)
DIGID_ATTRIBUTE_CONSUMING_SERVICE_INDEX = config(
"DIGID_ATTRIBUTE_CONSUMING_SERVICE_INDEX", None
)
DIGID_REQUESTED_ATTRIBUTES = config("DIGID_REQUESTED_ATTRIBUTES", None)
DIGID_SLO = config("DIGID_SLO", None)

EHERKENNING_ENABLE = config("EHERKENNING_ENABLE", default=True)
EHERKENNING_CERTIFICATE_LABEL = config("EHERKENNING_CERTIFICATE_LABEL", None)
EHERKENNING_CERTIFICATE_TYPE = config("EHERKENNING_CERTIFICATE_TYPE", None)
EHERKENNING_CERTIFICATE_PUBLIC_CERTIFICATE = config(
"EHERKENNING_CERTIFICATE_PUBLIC_CERTIFICATE", None
)
EHERKENNING_CERTIFICATE_PRIVATE_KEY = config(
"EHERKENNING_CERTIFICATE_PRIVATE_KEY", None
)
EHERKENNING_METADATA_FILE_SOURCE = config("EHERKENNING_METADATA_FILE_SOURCE", None)
EHERKENNING_WANT_ASSERTIONS_SIGNED = config("EHERKENNING_WANT_ASSERTIONS_SIGNED", None)
EHERKENNING_WANT_ASSERTIONS_ENCRYPTED = config(
"EHERKENNING_WANT_ASSERTIONS_ENCRYPTED", None
)
EHERKENNING_ARTIFACT_RESOLVE_CONTENT_TYPE = config(
"EHERKENNING_ARTIFACT_RESOLVE_CONTENT_TYPE", None
)
EHERKENNING_KEY_PASSPHRASE = config("EHERKENNING_KEY_PASSPHRASE", None)
EHERKENNING_SIGNATURE_ALGORITHM = config("EHERKENNING_SIGNATURE_ALGORITHM", None)
EHERKENNING_DIGEST_ALGORITHM = config("EHERKENNING_DIGEST_ALGORITHM", None)
EHERKENNING_ENTITY_ID = config("EHERKENNING_ENTITY_ID", None)
EHERKENNING_BASE_URL = config("EHERKENNING_BASE_URL", None)
EHERKENNING_SERVICE_NAME = config("EHERKENNING_SERVICE_NAME", None)
EHERKENNING_SERVICE_DESCRIPTION = config("EHERKENNING_SERVICE_DESCRIPTION", None)
EHERKENNING_TECHNICAL_CONTACT_PERSON_TELEPHONE = config(
"EHERKENNING_TECHNICAL_CONTACT_PERSON_TELEPHONE", None
)
EHERKENNING_TECHNICAL_CONTACT_PERSON_EMAIL = config(
"EHERKENNING_TECHNICAL_CONTACT_PERSON_EMAIL", None
)
EHERKENNING_ORGANIZATION_URL = config("EHERKENNING_ORGANIZATION_URL", None)
EHERKENNING_ORGANIZATION_NAME = config("EHERKENNING_ORGANIZATION_NAME", None)
EHERKENNING_EH_LOA = config("EHERKENNING_EH_LOA", None)
EHERKENNING_EH_ATTRIBUTE_CONSUMING_SERVICE_INDEX = config(
"EHERKENNING_EH_ATTRIBUTE_CONSUMING_SERVICE_INDEX", None
)
EHERKENNING_EH_REQUESTED_ATTRIBUTES = config(
"EHERKENNING_EH_REQUESTED_ATTRIBUTES", None
)
EHERKENNING_EH_SERVICE_UUID = config("EHERKENNING_EH_SERVICE_UUID", None)
EHERKENNING_EH_SERVICE_INSTANCE_UUID = config(
"EHERKENNING_EH_SERVICE_INSTANCE_UUID", None
)
EHERKENNING_EIDAS_LOA = config("EHERKENNING_EIDAS_LOA", None)
EHERKENNING_EIDAS_ATTRIBUTE_CONSUMING_SERVICE_INDEX = config(
"EHERKENNING_EIDAS_ATTRIBUTE_CONSUMING_SERVICE_INDEX", None
)
EHERKENNING_EIDAS_REQUESTED_ATTRIBUTES = config(
"EHERKENNING_EIDAS_REQUESTED_ATTRIBUTES", None
)
EHERKENNING_EIDAS_SERVICE_UUID = config("EHERKENNING_EIDAS_SERVICE_UUID", None)
EHERKENNING_EIDAS_SERVICE_INSTANCE_UUID = config(
"EHERKENNING_EIDAS_SERVICE_INSTANCE_UUID", None
)
EHERKENNING_OIN = config("EHERKENNING_OIN", None)
EHERKENNING_NO_EIDAS = config("EHERKENNING_NO_EIDAS", None)
EHERKENNING_PRIVACY_POLICY = config("EHERKENNING_PRIVACY_POLICY", None)
EHERKENNING_MAKELAAR_ID = config("EHERKENNING_MAKELAAR_ID", None)
EHERKENNING_SERVICE_LANGUAGE = config("EHERKENNING_SERVICE_LANGUAGE", None)
39 changes: 9 additions & 30 deletions src/open_inwoner/conf/base.py
Original file line number Diff line number Diff line change
Expand Up @@ -836,38 +836,12 @@
#
# DIGID
#

if ALLOWED_HOSTS:
BASE_URL = "https://{}".format(ALLOWED_HOSTS[0])
else:
BASE_URL = "https://example.com"

DIGID_MOCK = config("DIGID_MOCK", default=True)
DIGID_ENABLED = config("DIGID_ENABLED", default=True)
DIGID_METADATA = config("DIGID_METADATA", "")
SSL_CERTIFICATE_PATH = config("SSL_CERTIFICATE_PATH", "")
SSL_KEY_PATH = config("SSL_KEY_PATH", "")
DIGID_SERVICE_ENTITY_ID = config(
"DIGID_SERVICE_ENTITY_ID", "https://was-preprod1.digid.nl/saml/idp/metadata"
)
DIGID_WANT_ASSERTIONS_SIGNED = config("DIGID_WANT_ASSERTIONS_SIGNED", default=True)

DIGID = {
"base_url": BASE_URL,
"entity_id": BASE_URL,
# This is the metadata of the **Identity provider** NOT our own!
"metadata_file": DIGID_METADATA,
# SSL/TLS key
"key_file": SSL_KEY_PATH,
"cert_file": SSL_CERTIFICATE_PATH,
"service_entity_id": DIGID_SERVICE_ENTITY_ID,
"attribute_consuming_service_index": "1",
"requested_attributes": ["bsn"],
# Logius can sign the assertions (True) but others sign the entire response
# (False).
"want_assertions_signed": DIGID_WANT_ASSERTIONS_SIGNED,
}
DIGID_MOCK = config("DIGID_MOCK", default=True)

#
# EHERKENNING
#
EHERKENNING_MOCK = config("EHERKENNING_MOCK", default=True)

THUMBNAIL_ALIASES = {
Expand Down Expand Up @@ -919,6 +893,11 @@
MAIL_EDITOR_DYNAMIC_CONTEXT,
)

if ALLOWED_HOSTS:
BASE_URL = "https://{}".format(ALLOWED_HOSTS[0])
else:
BASE_URL = "https://example.com"

MAIL_EDITOR_BASE_HOST = BASE_URL

CKEDITOR_CONFIGS = {
Expand Down
13 changes: 5 additions & 8 deletions src/open_inwoner/conf/production.py
Original file line number Diff line number Diff line change
Expand Up @@ -22,14 +22,11 @@
]

DIGID_MOCK = config("DIGID_MOCK", default=False)
if DIGID_METADATA and not DEBUG:
AUTHENTICATION_BACKENDS += ["digid_eherkenning.backends.DigiDBackend"]
DIGID_ENABLED = True
elif DIGID_MOCK:
AUTHENTICATION_BACKENDS += ["digid_eherkenning.mock.backends.DigiDBackend"]
DIGID_ENABLED = True
else:
DIGID_ENABLED = False
if DIGID_ENABLED:
if DIGID_MOCK:
AUTHENTICATION_BACKENDS += ["digid_eherkenning.mock.backends.DigiDBackend"]
else:
AUTHENTICATION_BACKENDS += ["digid_eherkenning.backends.DigiDBackend"]

EHERKENNING_MOCK = config("EHERKENNING_MOCK", default=False)
if EHERKENNING_MOCK:
Expand Down
Loading
Loading