SSO authentication

[pengjiewang]

It seems that most institutions have moved to SAML SSO. Does NEMO support this? Any way to integrate SSO to NEMO?

[rptmat57]

NEMO itself does not deal with authentication.

The easiest way to use SSO with NEMO is by having SAML authentication done in Apache or Nginx and have them set a "remote user" header with the username of the authenticated user.

in NEMO's settings.py, you can then:

• add "NEMO.middleware.HTTPHeaderAuthenticationMiddleware" to middlewares
• set AUTHENTICATION_BACKENDS = ["NEMO.views.authentication.RemoteUserAuthenticationBackend"].
• set AUTHENTICATION_HEADER = "REMOTE_USER" (to fetch the username from the HTTP_REMOTE_USER header)

[rptmat57]

if you are using shibboleth like many facilities/universities, we also provide a version of nginx that will work with that:
https://hub.docker.com/r/nanofab/nginx-shibboleth

[Hydrozyk]

This is helpful, thanks. I wonder if you could post more info on how to get this working with nginx and shibboleth? That would be greatly appreciated! We are a lab with limited staff so not particular my area of expertise here.

[rptmat57]

I added a bit more information in the link on docker but the rest your IT should be able to help you out with

[Hydrozyk]

I added a bit more information in the link on docker but the rest your IT should be able to help you out with

Thank you so much!

[Hydrozyk]

I am actually getting en error about zip when running this step:

docker exec -it nginx bash -c "zip -j /etc/shibboleth/shib-keys.zip /etc/shibboleth/sp-*"
bash: line 1: zip: command not found

But zip is installed on the system, so wonder if this is Docker image issue?

zip -v
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
This is Zip 3.0 (July 5th 2008), by Info-ZIP.

[rptmat57]

Hi Paul, this instructions are referring to an old version of the image.
It will work if you remove the version number (it should use the latest): docker run --name nginx -d nanofab/nginx-shibboleth
you might have to remove the one you created previously docker rm -f nginx

[Hydrozyk]

It does not look like I was, here is my nginx location / config:

location / {
            include shib_fastcgi_params;
            include fastcgi_params;
             more_clear_input_headers 'Variable-*' 'Shib-*' 'Remote-User' 'REMOTE_USER' 'Auth-Type' 'AUTH_TYPE';
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            shib_request_set $shib_remote_user $upstream_http_variable_remote_user;
            shib_request /shibauthorizer;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-Host $server_name;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Connection "";
            proxy_set_header REMOTE_USER $shib_remote_user;
            proxy_pass_request_headers on;
            proxy_pass http://172.18.0.3:8000;

        }

In Nginx logs I see that remote header is set to SHIB_REMOTE_USER
16/Sep/2024:16:08:06 +0000] "GET /static/favicon.ico HTTP/1.1" 404 41676 "https:///" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0" REMOTE_USER=- SHIB_REMOTE_USER=

[rptmat57]

Sorry I was talking about the option in NEMO's settings.py

[Hydrozyk]

Yes corrected it but still same thing. I wonder if any of nginx settings need to change since, what it appears nemo is not receiving the REMOTE_USER header.

nemo  | [16/Sep/2024 17:00:43] NEMO.middleware DEBUG Header: HTTP_REMOTE_USER not present or invalid
nemo  | [16/Sep/2024 17:00:43] django.request WARNING Bad Request: /login/
nemo  | Bad Request: /login/

[Hydrozyk]

Also, should I open a separate issue thread in issues tab? let me know and I can do it.

[rptmat57]

not sure if it changes anything, but in my configuration I have proxy_set_header Remote-User $shib_remote_user; right before shib_request /shibauthorizer; and I don't have proxy_pass_request_headers on; in my config at all.

in shibboleth2.xml, I have:

<ApplicationDefaults entityID="<entity_id>"
REMOTE_USER="uid eppn" 
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">

and in my attribute-map.xml:

<Attribute name="username" id="uid"/>