mirror of
https://github.com/galaxyproject/galaxy.git
synced 2026-10-25 10:24:38 +08:00
112 lines
4.5 KiB
XML
112 lines
4.5 KiB
XML
<?xml version="1.0"?>
|
|
<!--
|
|
|
|
This file shall be properly set for user authentication and authorization leveraging the OpenID Connect protocol.
|
|
Here we provide a quick reference for configuration setters, and we provide a complete documentation
|
|
at the following page:
|
|
|
|
https://galaxyproject.org/authnz/config/oidc/
|
|
|
|
|
|
|
|
Quick Reference
|
|
_______________
|
|
|
|
- provider: Sets the name of OpenID Connect (OIDC) Identity Provider (IdP).
|
|
The following IdPs are currently supported:
|
|
|
|
{ "Google", "Globus" }
|
|
|
|
- client id: Sets the id of this client (i.e., your Galaxy instance) with the IdP, which is
|
|
obtained from the IdP at client registration.
|
|
See: https://tools.ietf.org/html/rfc6749#section-2.2
|
|
|
|
- client secret: A secret generated by IdP for your client upon its registration.
|
|
See https://tools.ietf.org/html/rfc6749#section-2.3.1
|
|
|
|
|
|
|
|
IMPORTANT NOTES
|
|
_______________
|
|
|
|
While registering your client (i.e., your Galaxy instance), you would need to provide the IdP with a
|
|
`redirect_uri`: a URL at which the IdP will callback your Galaxy instance upon a successful user authentication.
|
|
|
|
This URL for your Galaxy instance is composed as:
|
|
|
|
<host_url>/authnz/<provider>/callback
|
|
|
|
|
|
Some examples:
|
|
|
|
- using localhost to authenticate with Google:
|
|
http://localhost:8080/authnz/google/callback
|
|
|
|
- using localhost to authenticat with Globus:
|
|
http://localhost:8080/authnz/globus/callback
|
|
|
|
- using an instance hosted at `https://usegalaxy.org` with Google:
|
|
https://usegalaxy.org/authnz/google/callback
|
|
|
|
|
|
Please mind `http` and `https`.
|
|
|
|
-->
|
|
<OIDC>
|
|
<provider name="Google">
|
|
<client_id> ... </client_id>
|
|
<client_secret> ... </client_secret>
|
|
<redirect_uri>http://localhost:8080/authnz/google/callback</redirect_uri>
|
|
|
|
<prompt>consent</prompt>
|
|
<!--The value of this parameter (i.e., prompt) specifies whether the Google authorization server should prompt
|
|
a galaxy user for (re)authorization and consent. The possible values are: `none`, `consent`, and
|
|
`select_account`. HOWEVER, DO NOT USE `none`, because it will cause authentication failure for new users.
|
|
see the following page for more information:
|
|
https://developers.google.com/identity/protocols/OpenIDConnect#prompt
|
|
|
|
If you want the consent screen to be shown to the new users only, and re-authorization happen without
|
|
asking for user's consent, then remove this attribute.
|
|
|
|
NOTE: Galaxy sets OIDC 'scope' (requested scope of access to user's account) to `openid`. This is the
|
|
minimum scope value that request only user's email address and profile name. For login process Galaxy
|
|
does not need any more information, hence we request minimum possible information. By design, Google
|
|
does NOT show consent screen for this scope, hence user will only see a login page when they try to
|
|
login to Galaxy using their Google account.
|
|
-->
|
|
</provider>
|
|
|
|
<!-- Documentation: http://globus-integration-examples.readthedocs.io -->
|
|
<provider name="Globus">
|
|
<client_id> ... </client_id>
|
|
<client_secret> ... </client_secret>
|
|
<redirect_uri>http://localhost:8080/authnz/globus/callback</redirect_uri>
|
|
|
|
<prompt>consent</prompt>
|
|
</provider>
|
|
|
|
<provider name="Custos">
|
|
<url> ... </url>
|
|
<client_id> ... </client_id>
|
|
<client_secret> ... </client_secret>
|
|
<redirect_uri>http://localhost:8000/authnz/custos/callback</redirect_uri>
|
|
|
|
<realm> ... </realm>
|
|
<!-- (Optional) Trusted CA certificate file or directory to use when verify Custos authorization server.
|
|
See http://docs.python-requests.org/en/master/user/advanced/#ssl-cert-verification for more information. -->
|
|
<!-- <ca_bundle>/path/to/ca_bundle</ca_bundle> -->
|
|
<!-- (Optional) Override the default Custos well-known URL to point to a different instance -->
|
|
<!-- <well_known_oidc_config_uri>https://.../.well-known/openid-configuration</well_known_oidc_config_uri> -->
|
|
<!-- (Optional) Override the default idp hint -->
|
|
<!-- <idphint>cilogon</idphint> -->
|
|
</provider>
|
|
<!-- Documentation: https://galaxyproject.org/authnz/config/oidc/idps/elixir-aai -->
|
|
<provider name="Elixir">
|
|
<client_id>...</client_id>
|
|
<client_secret>...</client_secret>
|
|
<redirect_uri>http://localhost:8080/authnz/elixir/callback</redirect_uri>
|
|
<prompt>consent</prompt>
|
|
</provider>
|
|
|
|
</OIDC>
|