Support for <RequireAll> sections in ood_portal.yml auth: block

Feature Requests and Roadmap Discussion
1

Hi!

I was wondering if generating <RequireAll> sections was something that is currently supported (or planned) in the OOD portal generator.

Right now, the auth: section takes things like:

auth:
  - "AuthType openid-connect"
  - "Require claim group:foo"

and transforms them in the following Apache configuration block:

  <Location "/oidc">
    AuthType openid-connect
    Require claim group:foo
  </Location>

But in some configurations, it may be necessary to check and require multiple claims, and make sure they’re all satisfied, using the <RequireAll> directive. For instance, to check that users are members of multiple groups, like this:

<Location "/oidc"> 
  <RequireAll>
    AuthType openid-connect 
    Require claim group:foo
    Require claim group:bar
  </RequireAll>    
</Location>

Is that something that the OOD portal generator can do?

Thanks!

2

The logic for the auth lines is to iterate over the items in auth and write them out: https://github.com/OSC/ondemand/blob/c2aa53db187b90f67d1ec179af853d144f5e64c9/ood-portal-generator/templates/ood-portal.conf.erb#L218-L220

This should give you the desired result:

auth:
  - '<RequireAll>'
  - '  AuthType openid-connect',
  - '  ...etc...'
  - '</RequireAll>'
3

Ah but of course, thanks for pointing this out. :smiley:
This works great, thank you!