Comments (6)
Completed Changes (Github: 9ee7790)
by rpaw053from nz-orcid-hub.
Good overview Roshan. This definitely works.
1), 2), and 3) look secure.
As alternative flows to consider, if we can trust the ability to access email:
i) Hub Admin uploads/populates table of member orgs and Tech Contacts
For each non-tuakiri org:
1) Hub Admin sends email to Tech Contacts containing
The scope can indeed be /authenticate
2) on the round trip if the lookup of state matches a User-Org combo expecting one, and then appends the ORCID iD + token params to the [OrcidToken] table
3) they're directed to the org admin page to initiate the API credential request process.
NB: and authenticate token can be used to /read-public on the profile for which is was granted so some info could in principle be checked/validated
4) on subsequent returns, we use the authenticate process to catch the ORCID iD of people logging into the Hub, and lookup [User].[orcid] to both work out who they are, and what Hub permissions they have.
Where thing might come acropper is multi-org individuals so we need to specify the User-Org in the state and have the flow respond accordingly.
Happy to discuss
by jgus614from nz-orcid-hub.
Some discussion is needed to confirm the below flow for this activity:
1) A Hub admin will send an invitation to the research organisation who is a non-tuakiri member, the same way by generating a salt token and only for his email address.
2) The organisation admin comes to the landing page via link that he got in the mail.
3) Then clicks on the button (“Login via Orcid”) present on our landing page: at first we check the email address and token of the user and then if valid redirect the user to orcid page with client id of orcid hub new Zealand in API call.
The redirect API call will be (which is similar to what openvivo (http://openvivo.org) is doing currently):
- the scope can be /authenticate.
4) Then after authenticating we will redirect the organisation admin to page where he can put his own organisation client id and secret or can obtain those, as done in the previous sprints.
5) Thus it will complete the onboarding and henceforth any research coming to non-tuakiri on boarded organisation can log in on hub.
from nz-orcid-hub.
Thanks for the change Roshan:, this story has relevance to more than just small Research Orgs, e.g., GNS Science is all of: a Consortium Member, not small, and not part of the Tuakiri Federation.
by jgus614from nz-orcid-hub.
Updating the old story ( "As a smaller Research organisation, I want to login into ORCID hub through Tuakiri VHO service, So that a simple and reliable identity-management solution can be used in case we don’t have an identity-management capability or cannot, run a standalone Identity Provider (IdP)." ) to the new one, As the old story has already been completed in sprint 1.
by rpaw053from nz-orcid-hub.
Alternative story:
As a smaller Research organisation, I want to login into ORCID hub through ORCID authentication, So that a simple and reliable identity-management solution can be used in case we don’t have an identity-management capability or cannot, run a standalone Identity Provider (IdP), and are unable to meet costs of Tuakiri VHO membership.
by jgus614from nz-orcid-hub.
Related Issues (20)
- Work contributors erroring at ORCID unless contributor-attributes is fully populated
- Other ID task requires a valid visibility to be present
- Peer review upload requires an external-id-relationship for subject which ORCID doesn't
- QoL improvements for new keywords webform
- Flask-OAuthlib error when running flask commands HOT 2
- Other-IDs task requires a URL when the ORCID model doesn't HOT 5
- flask-admin: need to break down into separate chunks the changes added to flask-admin
- User with two emails responding to invite should over-write email rather than be locked out HOT 7
- Research Resource Proposal End Date errors when empty HOT 2
- To improve rating we need to remove support for TLS 1.0/1.1 HOT 1
- Document getssl application for setting and renewing server certificates
- UnicodeDecodeError with orcid_proxy HOT 2
- Add filter to View/Export People screen
- Leaking email addresses to Google
- Enable assertion of funded-by relationships in V3 work items
- Enable assertion-origin values in source HOT 1
- Renable parameter passing in API credential requests. HOT 1
- Upgrade solution to work with Python 3.10 HOT 2
- User Story: Merge user accounts HOT 2
- How to action a PUT to the Hub's API via the API? HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from nz-orcid-hub.