{"action":"created","issue":{"url":"https://api.github.com/repos/tsuru/tsuru/issues/1324","labels_url":"https://api.github.com/repos/tsuru/tsuru/issues/1324/labels{/name}","comments_url":"https://api.github.com/repos/tsuru/tsuru/issues/1324/comments","events_url":"https://api.github.com/repos/tsuru/tsuru/issues/1324/events","html_url":"https://github.com/tsuru/tsuru/pull/1324","id":121485843,"number":1324,"title":"Add support single sign-on logins through SAML 2.0","user":{"login":"diego-araujo","id":10744888,"avatar_url":"https://avatars.githubusercontent.com/u/10744888?v=3","gravatar_id":"","url":"https://api.github.com/users/diego-araujo","html_url":"https://github.com/diego-araujo","followers_url":"https://api.github.com/users/diego-araujo/followers","following_url":"https://api.github.com/users/diego-araujo/following{/other_user}","gists_url":"https://api.github.com/users/diego-araujo/gists{/gist_id}","starred_url":"https://api.github.com/users/diego-araujo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diego-araujo/subscriptions","organizations_url":"https://api.github.com/users/diego-araujo/orgs","repos_url":"https://api.github.com/users/diego-araujo/repos","events_url":"https://api.github.com/users/diego-araujo/events{/privacy}","received_events_url":"https://api.github.com/users/diego-araujo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-10T13:34:19Z","updated_at":"2015-12-10T20:16:21Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/tsuru/tsuru/pulls/1324","html_url":"https://github.com/tsuru/tsuru/pull/1324","diff_url":"https://github.com/tsuru/tsuru/pull/1324.diff","patch_url":"https://github.com/tsuru/tsuru/pull/1324.patch"},"body":"Prezados,\r\n\r\nEnvio contribuição que adiciona outro meio de autenticação (saml 2.0), os testes foram feitos em integração com um provedor de Identidades Shibboleth.\r\nA solução foi necessária devido a requisitos da Universidade de São Paulo, que irá utilizar o Tsuru como solução para prover PaaS em nossa cloud.\r\nEsta funcionalidade possui como dependência a lib  [XMLSec](https://www.aleksey.com/xmlsec/).  e, portanto, gostaria de saber como incluir uma dependência de terceiros?\r\nCaso tenha algo fora do padrão, errado ou sugestões de melhorias, por gentileza me fiquem à vontade em relatar, assim poderemos alterar e contribuir na forma correta.\r\n\r\n\r\n## Third-party dependencies\r\n\r\nFor enable SAMl authentication the library XMLSec is required.\r\nYou need install this in the API Server.\r\nUbuntu users can install by using `apt-get install xmlsec1`.\r\nFor others Linux Distributions you can download and compile the source code from [XMLSec](https://www.aleksey.com/xmlsec/download.html). \r\nDo not forget to install the required libraries first: libxml2, libxslt, iconv and zlib\r\n\r\n## tsuru.conf reference\r\n\r\n`auth:saml:request-expire-seconds.`\r\nThis  setting defines the amount of seconds that the auth request will be valid waiting for callback response from IDP. \r\nThis setting is optional, and defaults to “180”.\r\n\r\n`auth:saml:idp-attribute-user-identity`\r\nThis setting indicates the attribute name to be looked for in SAML response that MUST contain a unique user identifier\r\nFor internal purposes, this user identifier will be converted to a string email format, if necessary will be added `<user identifier>@<host from auth:saml:idp-ssourl>`\r\n\r\n`auth:saml:sp-publiccert`\r\nTsuru X509 certificate file location\r\n\r\n`auth:saml:sp-privatekey`\r\nTsuru private key file location\r\n\r\nHere's a convenient way to generate a self-signed certificate :)\r\n\r\n<pre>curl -sSL https://raw.githubusercontent.com/frntn/x509-san/master/gencert.sh | CRT_CN=\"mycert\"  bash</pre>\r\n\r\n`auth:saml:idp-ssourl`\r\nThe URL at the Identity Provider to which SAML authentication requests should be sent.\r\n\r\n`auth:saml:idp-publiccert:`\r\nIdentity Provider public key certificate file location\r\n\r\n`auth:saml:sp-entityid`\r\nIndicate a unique identifier configured in your Identity Provider, typically the name of your domain (including a trailing slash).\r\n    \r\n`auth:saml:sp-display-name`\r\nThis filed specifies a localized name fit for display to users in your Identity Provider.\r\nThis setting is optional, and defaults to \"Tsuru\".\r\n\r\n`auth:saml:sp-description`\r\nThis filed specifies a localized description fit for display to users in your Identity Provider.\r\nThis SHOULD be a description of the service being offered. \r\nThis setting is optional, and defaults to \"Tsuru Platform as a Service software\".\r\n\r\n`auth:saml:sp-sign-request`\r\nEnables signing of requests sent to the IDP\r\n\r\n`auth:saml:idp-sign-response`\r\nThis flag indicates whether the identity provider are signing the SAML response, api will check\r\n\r\n`auth:saml:idp-deflate-encoding`\r\nThis flag indicates whether the Identity Provider response are compressed \r\n\r\n\r\n### Callback URL\r\n\r\nSAML api callback URL expects to receive the messages via the HTTP POST binding from the Identity Provider\r\nCallback URL: `<host>:<port>/auth/saml`\r\nThe SAML METADATA is available at the same URL `<host>:<port>/auth/saml`, but will only return metadata from HTTP GET.\r\n\r\nHere is a example to configure saml auth:\r\n```yaml\r\nscheme: saml\r\n  saml:\r\n    request-expire-seconds: 180\r\n    idp-attribute-user-identity: eduPersonPrincipalName\r\n    sp-publiccert: <your-public-cert-file>\r\n    sp-privatekey: <your-private-key-file>\r\n    idp-ssourl: <http://idp.myprovider.com/Redirect/SSO>\r\n    idp-publiccert: <idp-public-cert-file>\r\n    sp-entityid: <your-entity-id>`\r\n    sp-display-name: Tsuru PaaS Login\r\n    sp-description: Tsuru Platform as a Service software\r\n    sp-sign-request: true\r\n    idp-sign-response: true\r\n    idp-deflate-encoding: false\r\n"},"comment":{"url":"https://api.github.com/repos/tsuru/tsuru/issues/comments/163737855","html_url":"https://github.com/tsuru/tsuru/pull/1324#issuecomment-163737855","issue_url":"https://api.github.com/repos/tsuru/tsuru/issues/1324","id":163737855,"user":{"login":"cezarsa","id":11041,"avatar_url":"https://avatars.githubusercontent.com/u/11041?v=3","gravatar_id":"","url":"https://api.github.com/users/cezarsa","html_url":"https://github.com/cezarsa","followers_url":"https://api.github.com/users/cezarsa/followers","following_url":"https://api.github.com/users/cezarsa/following{/other_user}","gists_url":"https://api.github.com/users/cezarsa/gists{/gist_id}","starred_url":"https://api.github.com/users/cezarsa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cezarsa/subscriptions","organizations_url":"https://api.github.com/users/cezarsa/orgs","repos_url":"https://api.github.com/users/cezarsa/repos","events_url":"https://api.github.com/users/cezarsa/events{/privacy}","received_events_url":"https://api.github.com/users/cezarsa/received_events","type":"User","site_admin":false},"created_at":"2015-12-10T20:16:21Z","updated_at":"2015-12-10T20:16:21Z","body":"Hello Diego, thanks a lot for contributing!\r\n\r\nCan you take a look at the failures reported by our [CI server](https://travis-ci.org/tsuru/tsuru/jobs/96029524)?\r\n\r\nOne of the problems is probably related to the missing `xmlsec1` library, you can fix this by adding a new entry to the `addons:apt:packages` section in the `tsuru.yaml` file.\r\n\r\nThere are also failures related to [code formatting](https://travis-ci.org/tsuru/tsuru/jobs/96029524#L273-L300) and you can fix them by running `goimports` on your code."}}