educloudalliance/eca-auth-data

Common gateway of user data to all other services.

Educloud Alliance Auth Data service

The Auth Data service is an abstraction of actual data store, or multiple datastores, which contain user identity and role information.

Part of Educloud Alliance reference implementation.

Contribution

See http://docs.educloudalliance.org for more information.

Documentation

Documentation can be rendered to HTML with Sphinx:

pip install -r sphinx.txt
sphinx-build -b html doc _html

eca-auth-data's Issues

LDAP support

Auth Data can use LDAP as external data source.

Better organisation of certificate files

Currently LDAP certificate files are expected to be found from the project root: https://github.com/haltu/eca-auth-data/blob/db14f4b2acbe09068c5262311e35cd99dddf487c/authdata/external_sources.py#L254

These files are set in place with salt and never committed to this repository. It would be better to save these files outside the project directory. This will require changes to this repository and to the salt configuration.

DoD: Organize certificate files better. They should be outside of project root.

Use ObjectGUID as the external id in LDAP external sources

ObjectGUID is an immutable value, which should be as the external id and for OID hash calculations instead of a mutable attribute such UserPrincipalName.

It should be possible to query only changed data from the API

The database can grow quite large and it would be beneficial to be able to query only the data which has changed after certain timestamp.

It might be impossible to implement this with external data sources.

Generate a fake OID for external users

Users in external sources might not have an OID. Generate a fake OID by hashing an immutable attribute of the user.

Change module name to "authdata"

Proviously this service was named "roledb". The role of the service was changed and now it contains more than just role information. Also the new naming is in line with the documentation.

Document settings.AUTH_EXTERNAL_SOURCES

Write documentation how external data sources are configured.

Allow user search with multiple attributes

Currently query /api/1/user?dreamschool=123&foo=bar filters UserAttributes by only picking either of the parameters (randomly).

DoD: User queryset is filtered using all GET parameters

Ref:

eca-auth-data/authdata/views.py

Line 144 in c37e991

break # only handle one GET variable for now

This is the reason why following test failed: https://travis-ci.org/educloudalliance/eca-auth-data/jobs/102996338

All data should be timestamped in local database

All models should have "created" and "modified" timestamp.

Attributes are not automatically created

When a user adds an authentication method an Attribute with the given name ('google', 'dreamschool', etc) must already exist in Auth Data db. This could also be solved in Auth Connector by calling the Attribute REST endpoint and creating the Attribute if it does not exist.

Settings files should be moved to project directory

Project structure should match with the https://github.com/educloudalliance/eca-auth-connector

LDAP external source results need paging

The query timeouts if too many results are returned in an LDAP query.

Update Django to 1.8 LTS

Current version is 1.7 which doesn't receive security updates. Update to 1.8 series

Dream Platform support

Dreamschool is based on Dream Platform. Dream UserDB should be added as external data source.

Increase test coverage

Line test coverage should be increased

DoD: Coverage >90%

Query endpoint is returning disabled attributes

The /query endpoint is returning UserAttributes that are disabled. This must not happen.

Services can store attributes in the database

Wehn Service queries the database it should get only attributes it should know about. As comprehensive permission handling is huge task this can be implemented by allowing only attributes written by the Service to be queried by the Service.

Auth Proxy service is only exception. It can always receive all attributes.

External Data concept

The concept of Auth Data service should be changed slightly.

Before it behaved like a cache for data. The cache could be updated with an API and changes were always made from outside. This is still the case but now Auth Data can also act as a proxy for external data sources. In this case Auth Data can redirect API query to external service if the query is made with parameters which are attached to external sources. This attachment is known as External Data Mapping. There is runtime config which defines the mapping between municipalities and external data sources.

LDAP external sources need better error handling

Some queries, such as when a query is mapped to an OU in LDAP, HTTP 500 is returned for non-matches.