Produits Entr'ouvert » Authentic 2

Detail, could AUTHENTIC_SAME_ID_SENTINEL be urn:authentic:same-as-provider-entity-id, rather than an URL ? (I think it makes the usage clearer)

And would it be possible to use that AUTHENTIC_SAME_ID_SENTINEL constant in 0040_plug_sentinel_value_in_libertyfederation_qualifiers.py?

The migration calls raw_input(), I fear this won't fly with packages :/ there's no way to get the entity id from the database?

Frédéric Péters a écrit :

Detail, could AUTHENTIC_SAME_ID_SENTINEL be urn:authentic:same-as-provider-entity-id, rather than an URL ? (I think it makes the usage clearer)

Ok. I'm not fan of using URNs as to do it really formally we should obtain the namespace from IANA but that's just pedantery.

And would it be possible to use that AUTHENTIC_SAME_ID_SENTINEL constant in 0040_plug_sentinel_value_in_libertyfederation_qualifiers.py?

Of course.

The migration calls raw_input(), I fear this won't fly with packages :/

It will block automatic updates, but it should work if the update is attended. What do you think ?

there's no way to get the entity id from the database?

Not with 100% certainty; we do not use django.contrib.sites and it does not have the schema only the domain, it could be extracted from LibertyFederation if there are some but it does not make the update safe.

It will block automatic updates, but it should work if the update is attended. What do you think ?

I still don't like it :/ Here's kind of a proposal: look for the value in the environment (let's say AUTHENTIC_IDP_ENTITY_ID_MIGRATION), and fallback on raw_input() if it's missing (or even abort) if it's missing (and there are existing LibertyFederation and LibertyProvider objects); and add this info in the "How to upgrade to a new version of authentic" section of the README file, along as the recommended way to get the value from a running instance (is it looking in the saml metadata, or is there a better way?).

Frédéric Péters a écrit :

(is it looking in the saml metadata, or is there a better way?).

The URL is generated from each HTTP request, there is really no automatic way to get it from a script :/ You can deduct it from the virtual host configuration.

It will block automatic updates, but it should work if the update is attended. What do you think ?

I still don't like it :/ Here's kind of a proposal: look for the value in the environment (let's say AUTHENTIC_IDP_ENTITY_ID_MIGRATION), and fallback on raw_input() if it's missing (or even abort) if it's missing (and there are existing LibertyFederation and LibertyProvider objects); and add this info in the "How to upgrade to a new version of authentic" section of the README file, along as the recommended way to get the value from a running instance

Ok.

Benjamin Dauvergne a écrit :

Frédéric Péters a écrit :

(is it looking in the saml metadata, or is there a better way?).

The URL is generated from each HTTP request, there is really no automatic way to get it from a script :/ You can deduct it from the virtual host configuration.

That's what I meant, so the instruction to get the value would be along the lines of "go to your site /idp/saml2/metadata, and take the entityId attribute", ok.