Shibboleth: Remote Authentication Phase 1

[pdurbin]

Dataverse 4.0 shipped with experimental Shibboleth support, but there are a number of issues we'd like to resolve before we re-enable Shibboleth at https://dataverse.harvard.edu . In a Remote Authentication Business Requirements Document (BRD) the scope of work is described as "Phase 1". I'm creating this issue to have an issue number to use in the name of a branch where I'll start to push code. If you don't see an issue listed below, I'm not working on it for Phase 1. I'll update this description as necessary. A checkmark indicates that @pdurbin thinks that issue is code-complete and included in pull request #3025.

New features to add

• Review what shows in user account info and what can be changed #2046 Review what shows in user account info and what can be changed (Shib users can't change anything)
• Shibboleth: Add superuser API endpoint to migrate Shib user to builtin/local account #2915 Shibboleth: Add superuser API endpoint to migrate Shib user to builtin/local account
• API: add endpoint for listing users #3009 API: add endpoint for listing users
• Shibboleth: successful conversion from builtin/local account message should appear on account page rather than the home page. #2952 Shibboleth: successful conversion from builtin/local account message should appear on account page rather than the home page
• Shibboleth: tooling for debugging SAML assertions #2916 Shibboleth: tooling for debugging SAML assertions
• Installation Guide: Improve Shibboleth documentation #2953 Installation Guide: Improve Shibboleth documentation
• User Guide: Add section about remote authentication (experimental) #2975 User Guide: Add section about remote authentication
• Shibboleth: Support "Federated Login Mode" (i.e. feed of Identity Providers from InCommon) #2937 Shibboleth: Support "Federated Login Mode" (i.e. feed of Identity Providers from InCommon)
• Shibboleth: update shibboleth2.xml entityID to end with "sp" rather than "shibboleth" #2104 Shibboleth: register with InCommon after updating entityID

Bugs to fix

• Local account creation URL ignores :AllowSignup #2838 Local account creation URL ignores :AllowSignup
• Shibboleth: multiple email addresses are stored as a single invalid address separated by a semicolon #2512 Shibboleth: multiple email addresses are stored as a single one
• Shibboleth: Update any mentions of Institution to be Institutional #3011 Shibboleth: Update any mentions of Institution to be Institutional
• Shib users do not get the "Welcome to Dataverse" message when creating a new account #3080 Shib users do not get the "Welcome to Dataverse" message when creating a new account

Features that should be re-tested (no regressions)

These were developed for 4.0 were based on Shibboleth Functional Requirements Document for Dataverse 4.0:

• Shibboleth: Review Text For Converting an Account/Creating an Account #2950 Shibboleth: Review Text For Converting an Account/Creating an Account (the new Account/Shibboleth: Converting from local to non-local #796, related to Shibboleth: persist institution name as affiliation for users #1497 Shibboleth: persist institution name as affiliation for users)
• Shibboleth: Institution Log In changes: Help link and extra text #2951 Shibboleth: Institution Log In changes: Help link and extra text (the new UI/UX for Shibboleth login #794)
• Shibboleth: Re-test Institution-wide Shibboleth groups and CRUD API operations #1533 Shibboleth: Re-test Institution-wide Shibboleth groups and CRUD API operations

Bonus bug fixes that should be re-tested (no regressions)

• review dataverseuser.xhtml and see if code related to SearchIncludeFragment can be removed since MyData probably isn't using it. Done in 040a4d4

When will Shibboleth support no longer be considered experimental?

Once the issues above have gone through QA and a release has been deployed to https://dataverse.harvard.edu for some amount of time without incident, we'll remove "experimental" from the docs and close the issue below:

• Shibboleth: restore Institution Log In functionality to dataverse.harvard.edu #2117 Shibboleth: restore Institution Log In functionality to dataverse.harvard.edu

Issues that may be included or may be out of scope

• Clean up user code (review specific methods for shib and built in user on AuthenticatedUser) #1456 Clean up user code (review specific methods for shib and built in user on AuthenticatedUser)
• Shibboleth: make use of redirectPage logic for shib users #1551 Shibboleth: make use of redirectPage logic for shib users

Issues that are definitely out of scope

• Login page for "only remote authentication" mode #2974 Login page for "only remote authentication" mode
• Add "Group + Roles" tab to account page #105 Add "Group + Roles" tab to account page
• Shibboleth Groups: arbitrary attributes and regex support #1515 Shibboleth Groups: arbitrary attributes and regex support
• Automatically add a shib group when a user from a new institution first logs in #1403 Automatically add a shib group when a user from a new institution first logs in
• Shib/Log In -- FATAL - DISCO:UI #1762 Shib/Log In -- FATAL - DISCO:UI
• Bundle.properties -- Clean Up Various Messages #1442 Shibboleth: allow for configuration of attributes used for user identification
• Shibboleth/UI/config: one-click IdP-selection, DiscoFeed-bypass #2548 Shibboleth/UI/config: one-click IdP-selection, DiscoFeed-bypass
• code clean up: rename Shib.java to ShibPage.java? Move from default package to edu.harvard.iq.dataverse.authorization.providers.shib (looked at this, probably not a lot of value to doing this)

[eaquigley]

@mheppler and @pdurbin I'm not seeing an issue in the above list that it makes sense to add in the bug we found where the Help link in the Institutional Log In box isn't going to the right URL and doesn't open the guides in a new tab. Is there one above either of you would want me to add it to or should I go ahead and create a new one?

[pdurbin]

@eaquigley I just created #2951 and added it to the list in the description. Thanks for the reminder!

[pdurbin]

This is the parent ticket I've been using to organize the "phase 1" Shibboleth work (and name the branch after) and I'm passing this issue to QA now that I've made my pull request at #3025.

[kcondon]

Tested closing.