Hi Vahid, > On Mar 7, 2019, at 12:30 PM, Vahid Jalili <[email protected]> wrote: > > Regarding the configuration: I think we still want to be able to login to > Google via either/both Custos and PSA, is that still the case? if so, I > think your previous configuration would make more sense where you had > "<provider name="Google" implementation="Custos">" specifying the IdP name > and the implementation that interfaces that IdP.
Yes, you can log into Google via Custos through CILogon. But I don't think
we've decided how to configure that. I was thinking that from Galaxy's
perspective the "provider" is Custos and the user select's Google in the user
interface. The Custos integration in Galaxy will pass this identity provider
selection through to CILogon which will in turn redirect to Google, etc.
A Galaxy Admin might want to only permit the Google identity provider with
Custos and for that I think we could have some kind of whitelist/blacklist
configuration. For example:
<provider name="Custos">
<client_id>...</client_id>
<client_secret>...</client_secret>
<redirect_uri>http://localhost:8000/authnz/custos/callback</redirect_uri>
<realm>...</realm>
<included-idps>
<included-idp> ... Google's idp identifier ... </included-idp>
</included-idps>
</provider>
Thanks,
Marcus
smime.p7s
Description: S/MIME cryptographic signature
