example shibboleth configuration about exafs HOT 2 CLOSED

Hello,
thank you for pointing this out. Flask-sso is quite old, but it's working quite well. However the error messages can be improved.

Is your Shibboleth working in general? I mean for example for a directory with static html file. For Flask-SSO the eppn value must be present in headers, so you should adjust the attribute map for sure.

One more possible issue / solution. You should insert your first user to DB using SQL command and give him admin role. This is not done by db-init.py script. It's a bug to be fixed in near future, but currently this must be done manually.

If the shibboleth is working, the shibo.conf for httpd (apache2) should be as follows:

<Location />
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require shib-session
</Location>

<LocationMatch /api/>
  Satisfy Any
  allow from All
</LocationMatch>

<LocationMatch /rules/announce_all>
  Satisfy Any
  allow from All
</LocationMatch>

<LocationMatch /rules/withdraw_expired>
  Satisfy Any
  allow from All
</LocationMatch> 

The endpoints which are not protected by Shibboleth are protected by app itself. Either by @localhost_only decorator or by API key.

from exafs.

I was missing this part in Apache config. I've also modified the attribute map to suit our IDP. I've already created the user, but with different UUID (since i was just testing it in local mode), now it matches the value sent from IDP and mapped by Shibboleth and it works. Thanks!

from exafs.