Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

store ldr-related cas entitlements in session #1124

Merged
merged 2 commits into from
May 15, 2024
Merged

store ldr-related cas entitlements in session #1124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b6300d8
store ldr-related cas entitlements in session
rococodogs May 2, 2024
9f7d17c
rubo
rococodogs May 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions app/services/spot/cas_user_roles_service.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,10 @@ module Spot
# user.save
class CasUserRolesService
# URI host for valid entitlements
ENTITLEMENT_HOST = 'ldr.lafayette.edu'
class_attribute :entitlement_host, default: 'ldr.lafayette.edu'

# Roles/Groups that we handle via CAS attributes
class_attribute :group_names_from_cas
self.group_names_from_cas = [
class_attribute :group_names_from_cas, default: [
Ability.alumni_group_name,
Ability.faculty_group_name,
Ability.staff_group_name,
Expand Down Expand Up @@ -65,7 +64,7 @@ def update_roles_from_entitlements(entitlements)
# @return [String]
def role_name_from_entitlement(value)
parsed = URI.parse(value)
return unless parsed.host == ENTITLEMENT_HOST
return unless parsed.host == entitlement_host

case parsed.path
when '/alumni' then Ability.alumni_group_name
Expand Down
2 changes: 1 addition & 1 deletion config/application.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ class Application < Rails::Application

config.rack_cas.server_url = ENV['CAS_BASE_URL']
config.rack_cas.service = '/users/service'
config.rack_cas.extra_attributes_filter = %w[uid email givenName surname lnumber]
config.rack_cas.extra_attributes_filter = %w[uid email givenName surname lnumber eduPersonEntitlement]

# Settings in config/environments/* take precedence over those specified here.
# Application configuration should go into files in config/initializers
Expand Down
19 changes: 19 additions & 0 deletions config/initializers/spot_overrides.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,4 +188,23 @@ def find_default_admin_set
end

Hyrax::AdminSetCreateService.singleton_class.send(:prepend, Spot::AdminSetCreateServiceDecorator)

# Only store entitlements related to us in the session to prevent a cookie overflow
# rubocop:disable Style/IfUnlessModifier
require 'rack/cas'
Rack::CAS.class_eval do
def store_session(request, user, ticket, extra_attrs = {})
if RackCAS.config.extra_attributes_filter?
extra_attrs.select! { |key, _val| RackCAS.config.extra_attributes_filter.map(&:to_s).include? key.to_s }
end

if extra_attrs['eduPersonEntitlement'].present?
extra_attrs['eduPersonEntitlement'].select! do |val|
URI.parse(val).host == Spot::CasUserRolesService.entitlement_host
end
end

request.session['cas'] = { 'user' => user, 'ticket' => ticket, 'extra_attributes' => extra_attrs }
end
end
end