ZaPF OAuth Provider

Deployment

To deploy the flask app you can use the configuration and systemd service for a gunicorn provided in the repository. The gunicorn creates in the default configuration a socket that can be used by a proxy daemon like nginx to deploy the app to the internet. The proxy daemon also would be responsible for stuff like SSL encryption.

Environment Variables

Variable	Description
AUTH_SETTINGS	A path to a config file that overrides the defaults

Commands

Apart from the usual manage.py runserver and manage.py shell, the following commands are supported:

• manage.py createuser uid FirstName Surname [email] [password] - create a user
• manage.py delete_user uid - delete a user
• manage.py passwd uid - change a password for the user
• manage.py sanity - runs sanity checks, like checking that the base DN's for different things exist, and creates them if necessary
• manage.py groups - lists groups
• manage.py members group_name - list members in a group
• manage.py newgroup group_name - create a group
• manage.py delgroup group_name - delete a group
• manage.py join username group_name - add a user to a group
• manage.py remove username group_name - remove a user from a group
• manage.py unis - list unis and their tokens
• manage.py adduni name token - add a uni and a token
• manage.py deluni name - delete a uni
• manage.py set_token name token - set the token for a uni
• manage.py profile [length] [profile_dir] - run the app under a profiler
• manage.py db - Flask-Migrate DB commands:
  • manage.py db upgrade - Run database migrations
  • manage.py db migrate - Create database migrations

Permissions

Permissions are managed via groups. The members of the following groups have special permissions:

• members of admin are superusers, and can administrate oauth2 applications
• members of orga can see and edit uni registration data

OAuth

Scopes

Scope Name	Description
uni_list	List all of the universities
ownUserData	Get user data of currently logged in user
registration	Allow a user to create a registration

Endpoints

URL	Scopes required	Description
/api/me	ownUserData	Get user data of currently logged in user
/api/unis	uni_list	Get a list of universities
/api/registration	registration	GET the registration of currently logged in user or POST a new registration

OpenLDAP notes

Schema

The following schema are required:

• core
• inetOrgPerson
• cosine
• nis
• oidc-schema

ACL's

Please make sure the bind user can bind and has read&write access to the users, groups, and oauth2 subtrees.

Good hashing

Using the contrib/sha2 module for OpenLDAP is highly recommended, otherwise the following hashes do not work:

• HASHED_SHA256
• HASHED_SHA385
• HASHED_SHA512
• HASHED_SALTED_SHA256
• HASHED_SALTED_SHA385
• HASHED_SALTED_SHA512

Testing

A sample OpenLDAP configuration to run a testing server is included. Tests hoever are run by mocking the ldap connection. A script is included to generate the serialized data objects used from a LDIF file.