API Docs

Invenio module that provides SAML integration.

class invenio_saml.ext.InvenioSSOSAML(app=None)

Invenio-SSO-SAML extension.

Extension initialization.

init_app(app)

Flask application initialization.

init_config(app)

Initialize configuration.

Default handlers

Default handlers for SSO-SAML.

invenio_saml.handlers.acs_handler_factory(remote_app, account_info=<function default_account_info>, account_setup=<function default_account_setup>)

Generate ACS handlers with an specific account info and setup functions.

Note

In 90% of the cases the ACS handler is going to be the same, only the way the information is extracted and processed from the IdP will be different.

Parameters:

• remote_app – string representing the name of the identity provider.

• account_info –

  callable to extract the account information from a dict like object. mappings key is required whe using it. This function is expected to return a dictionary similar to this:

  dict(
      user=dict(
          email='federico@example.com',
          profile=dict(username='federico',
                       full_name='Federico Fernandez'),
      ),
      external_id='12345679abcdf',
      external_method='example',
      active=True
   )
  

  Where external_id is the ID provided by the IdP and external_method is the name of the IdP as in the configuration file (not mandatory but recommended).

• account_setup – callable to setup the user account with the corresponding IdP account information. Typically this means creating a new row under UserIdentity and maybe extending g.identity.

Returns:

function to be used as ACS handler

invenio_saml.handlers.default_account_info(attributes, remote_app)

Return account info for remote user.

This function uses the mappings configuration variable inside your IdP configuration.

Parameters:

• attributes – (dict) dictionary of data returned by identity provider.

• remote_app – (str) Identity provider key.

Returns:

(dict) A dictionary representing user to create or update.

invenio_saml.handlers.default_account_setup(user, account_info)

Default account setup which only links User and UserIdentity.

invenio_saml.handlers.default_sls_handler(auth, next_url)

Default SLS handler which simply logs out the user.