> On Mar 12, 2019, at 1:20 PM, Vahid Jalili <[email protected]> wrote: > > We are going to be able to login with an IdP via multiple implementations. > For instance, login with Google via PSA or Custos. > > https://github.com/galaxyproject/galaxy/blob/dev/config/oidc_backends_config.xml.sample > > <https://github.com/galaxyproject/galaxy/blob/dev/config/oidc_backends_config.xml.sample> > > In case of custos, enabling a backend might be as easy as just whitelisting > it, because you provide Galaxy with credentials to access Custos only > (i.e., only custos client ID and secret). That is because Custos is a > broker in the middle. However, in case of PSA, you would need to provide > credentials for each backend. So, you may *not* be able to use PSA as: > > <provider name="PSA"> > <client_id> ... </client_id> > <client_secret> ... </client_secret> > <included_idp> > <idp>Google</idp> > <idp>Globus</idp> > </included_idp> > </provider> > > because each idp has its own credentials. Therefore, we may need to define > a configuration consistent between implementations (e.g., PSA and Custos > for now).
We discussed this on the call but just to document the conclusion, we decided to go ahead with removing the implementation attribute. The implementation to use (PSA or Custos) will be based on the name of the provider, as is currently the case. How to whitelist/blacklist idps for Custos we left as something to be figured out later.
smime.p7s
Description: S/MIME cryptographic signature
