Hi Marcus, We are going to be able to login with an IdP via multiple implementations. For instance, login with Google via PSA or Custos.
https://github.com/galaxyproject/galaxy/blob/dev/config/oidc_backends_config.xml.sample In case of custos, enabling a backend might be as easy as just whitelisting it, because you provide Galaxy with credentials to access Custos only (i.e., only custos client ID and secret). That is because Custos is a broker in the middle. However, in case of PSA, you would need to provide credentials for each backend. So, you may *not* be able to use PSA as: <provider name="PSA"> <client_id> ... </client_id> <client_secret> ... </client_secret> <included_idp> <idp>Google</idp> <idp>Globus</idp> </included_idp> </provider> because each idp has its own credentials. Therefore, we may need to define a configuration consistent between implementations (e.g., PSA and Custos for now). Best, _____________ *Vahid Jalili, *Ph.D. Computational Biologist Computational Biology Institute Oregon Health and Science University 2730 SW Moody Ave, KCRB #3103.20, OHSU-RLSB Dock 61, Portland, OR, USA 97201 Skype ID: v.jalili On Mon, Mar 11, 2019 at 6:48 AM Christie, Marcus Aaron <[email protected]> wrote: > Hi Vahid, > > On Mar 7, 2019, at 12:30 PM, Vahid Jalili <[email protected]> wrote: > > Regarding the configuration: I think we still want to be able to login to > Google via either/both Custos and PSA, is that still the case? if so, I > think your previous configuration would make more sense where you had > "<provider name="Google" implementation="Custos">" specifying the IdP name > and the implementation that interfaces that IdP. > > > Yes, you can log into Google via Custos through CILogon. But I don't think > we've decided how to configure that. I was thinking that from Galaxy's > perspective the "provider" is Custos and the user select's Google in the > user interface. The Custos integration in Galaxy will pass this identity > provider selection through to CILogon which will in turn redirect to > Google, etc. > > A Galaxy Admin might want to only permit the Google identity provider with > Custos and for that I think we could have some kind of whitelist/blacklist > configuration. For example: > > <provider name="Custos"> > <client_id>...</client_id> > <client_secret>...</client_secret> > <redirect_uri> > http://localhost:8000/authnz/custos/callback</redirect_uri> > <realm>...</realm> > <included-idps> > <included-idp> ... Google's idp identifier ... </included-idp> > </included-idps> > </provider> > > Thanks, > > Marcus >
