Passing SAML / Mellon atrritbutes to PUN

Get Help
1

Hi All,

I’m somewhat new to OOD. Configuring the latest 3.1 with SAML / Mellon as idP. There are two attributes ‘MELLON_urn:oid:0.9.2342.19200300.100.1.1’ for the UID and ‘MELLON_urn:oid:0.9.2342.19200300.100.1.3’ for the user email. I’ve manager to define in the config/ood_portal.yml:

user_env: MELLON_urn:oid:0.9.2342.19200300.100.1.1
user_map_match: '.*'

this has allowed to get idP auth to work. The next would be propagating ‘MELLON_urn:oid:0.9.2342.19200300.100.1.3’ attribute (==user email) to PUN.

Here is a solution to try: How can I pass OIDC_CLAIM_EMAIL value to my applications? but only if I manage to map the SAML’s attribute to an environment variable and propagate it to PUN.

Tried next in the ood_portal.yml:

custom_vhost_directives:
    - 'SetEnv OOD_USER_MAIL_ENV "MELLON_urn:oid:0.9.2342.19200300.100.1.3"'
pun_pre_hook_exports: "OOD_USER_ENV,OOD_USER_MAIL_ENV"

but a simple pun_pre_hook_root_cmd script with printenv gives me

...
OOD_OOD_USER_MAIL_ENV=MELLON_urn:oid:0.9.2342.19200300.100.1.3

There should be something simple that I miss…

My further idea for passing that idP provided attribute would be having a pun_pre_hook_root_cmd like

USEREMAILDIR="/dev/shm/emails"
[[ -d "$USEREMAILDIR" ]] || mkdir -m 755 "$USEREMAILDIR"

if [ ! -z ${OOD_USER_ENV+x} ]; then
  EMAILFILE="${USEREMAILDIR}/${OOD_USER_ENV}"
  echo "${OOD_USER_MAIL_ENV:-none}" > "${EMAILFILE}"
  /bin/chown "$OOD_USER_ENV" "${EMAILFILE}"
  /bin/chmod 750 "${EMAILFILE}"
fi

and the reading that file through the initializer either globally or within the app that wants the user email.

What do I miss here? Or is there a better way to pass SAML’s attributes to PUN?

2

I think that’s about it.

3

Jeff, do you want to say that there a better way to do it?

4

I can’t really think of one. That’s pretty much why the pun_pre_hook_root_cmd exists, to do stuff like this because we strip a lot of those sensitive headers (or they may not exist as headers at all).

5

I suppose you could also use the user_map_cmd shim script to modify the variable being passed as as std input from the auth mechanism before it hits apache but that might run a lot more often than the pun_pre_hook_root_cmd does?

6

Yea user_map_cmd is going to run for every single request where pun_pre_hook_root_cmd only runs once when the PUN has to startup.