auth.admin.saml.groovy-permission-mapper

Specify the location of the Groovy class which maps SAML users to their permissions.

Key: auth.admin.saml.groovy-permission-mapper
Type: File
Can be set in: global.cfg

Description

Sets the path to a groovy script implementing a mapping from SAML credentials provided by the identify provider to objects representing Funnelback Users.

The following example script provides a simple example in which the groovy script simply loads the 'admin.ini' file for all valid SAML users. In practice a script would likely interrogate the given SAMLCredential, and load or create a suitable user object which grants permissions appropriate for the user.

import java.util.Arrays;

import java.io.File;

import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.saml.SAMLCredential;

import com.funnelback.springmvc.api.config.security.saml.SamlFunnelbackUserMapper;
import com.funnelback.springmvc.api.config.security.saml.user.shared.SAMLConfiguredUser;
import com.funnelback.springmvc.api.config.security.user.model.RestrictionSet;
import com.funnelback.springmvc.api.config.security.user.model.RoleId;

public class ExampleGroovySamlFunnelbackUserMapper implements SamlFunnelbackUserMapper {


    @Override
    public SAMLConfiguredUser getSAMLDerivedUser(SAMLCredential credential, SAMLConfiguredUser emptyUser, File searchHome)
        throws UsernameNotFoundException {
        String username = "admin"; // Derive this from the SAMLCredential
        return emptyUser.withUserInfoDetails(emptyUser.getUserInfoDetails()
                        .withId(username)
                        .withFullName("")
                        .withEmail("")
                        .withInfo(""))
                  .withRoleDetails(emptyUser.getRoleDetails()
                        // These roles should be mapped to ones that exist on disk, depending on
                        // attributes that are provided by the SAMLCredential.
                        .withInRoles(Arrays.asList(new RoleId("default-super-user")))
                        // Always permit this user to edit both shared-collections and shared-resources
                        .withCanEditRoles(RestrictionSet.of(RoleId.of("shared-collections", "shared-resources")))
                        );
    }

}

The file containing the script can be located anywhere so long as it is readable by the Funnelback jetty web server. Further detail about the provided SAMLCredential object is available within the spring security SAML documentation.

⚠ Caveats

This setting requires Jetty to be restarted to take effect.

© 2015- Squiz Pty Ltd