You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Feb 17, 2022. It is now read-only.
An authenticator that uses the Signicat signing service to do authentication
8
+
This project provides an opens source Signicat Authenticator plug-in for the Curity Identity Server. This allows an administrator to add functionality to Curity which will then enable end users to login using their Signicat credentials -- or more exactly -- the credentials of some E-ID provider, like BankID or NemID. The app that integrates with Curity will be provided with all of the attributes released by the user at Signicat, including the user's personal number and other biographical information.
9
+
10
+
System Requirements
11
+
~~~~~~~~~~~~~~~~~~~
12
+
13
+
Curity Identity Server 2.4.0 and `its system requirements <https://developer.curity.io/docs/latest/system-admin-guide/system-requirements.html>`_
14
+
15
+
Requirements for Building from Source
16
+
"""""""""""""""""""""""""""""""""""""
17
+
18
+
The source code is written entirely in `Kotlin <http://kotlinlang.org/>`_. It can be compiled using Maven 3. For this to succeed, however, the `Signicat Connector for Java <https://support.signicat.com/display/S2/Signicat+Connector+for+Java>`_ needs to be installed into a Maven repository which is accessible during compilation. The `POM <pom.xml>`_ may need to be updated depending on the Maven Coordinates (Group, Artifact, Version) used during installation. Refer to the `Maven guide for information about installing third-party JARs <https://maven.apache.org/guides/mini/guide-3rd-party-jars-local.html>`_. Once the Signicat Connector's JAR and its associated OpenSAML version are installed, the project can be compiled from a shell by issuing a command like this: ``mvn package``.
19
+
20
+
Installation
21
+
~~~~~~~~~~~~
22
+
23
+
To install this plug-in, either download a binary version available from the `releases section of this project's GitHub repository <https://github.com/curityio/signicat-authenticator/releases>`_ or compile it from source (as described above). If you compiled the plug-in from source, the package will be placed in the ``target`` subdirectory. The resulting JAR file or the one downloaded from GitHub needs to placed in the directory ``${IDSVR_HOME}/usr/share/plugins/signicat``. (The name of the last directory, ``signicat``, which is the plug-in group, is arbitrary and can be anything.) All of the dependent JAR files must be placed in this directory as well. These include:
24
+
25
+
* signicat-client-lib-4.0.1.jar
26
+
* signicat-opensaml-1.1-PATCH-6.jar
27
+
* commons-codec-1.10.jar
28
+
* xmlsec-1.5.8.jar
29
+
30
+
All of these JAR files can be obtained by downloading the `Signicat Connector for Java <https://support.signicat.com/display/S2/Signicat+Connector+for+Java>`_. Apache Commons Codec and Apache Santuario can be downloaded from Maven central or their respective project web sites.
31
+
32
+
.. note::
33
+
34
+
The Signicat Connector ZIP file contains other JAR files as well (e.g., SLF4J, Apache Commons Logging, etc.). These are not required by this plug-in, but installing them should not adversely effect the plug-in either.
35
+
36
+
Once the plug-in and its dependencies are placed into the plug-in group directory, it will become available as soon as each node is restarted.
37
+
38
+
For a more detailed explanation of installing plug-ins, refer to the `Curity developer guide <https://developer.curity.io/docs/latest/developer-guide/plugins/index.html#plugin-installation>`_.
39
+
40
+
Installing from Source
41
+
""""""""""""""""""""""
42
+
43
+
During development of the plug-in, it is very easy to copy the plug-in JAR and its dependencies with the following one-liner:
Because the server must be restarted after this, it can be quite tedious and time consuming. For that reason, it is better to use `Intellij's HotSwap capability <https://www.jetbrains.com/help/idea/reloading-classes.html>`_ to reload the classes after compilation. This will allow a developer to HotSwap changes without requiring a restart. If it fails to HotSwap some change, however, the above technique can be used.
53
+
54
+
Creating a Signicat Authenticator in Curity
55
+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
56
+
57
+
The easiest way to configure a new Signicat authenticator is using the Curity admin UI. The configuration for this can be downloaded as XML or CLI commands later, so only the steps to do this in the GUI will be described.
58
+
59
+
1. Go to the ``Authenticators`` page of the authentication profile wherein the authenticator instance should be created.
60
+
2. Click the ``New Authenticator`` button.
61
+
3. Enter a name (e.g., ``signicat1``). For production, this name needs to match the URI component in the callback URL whitelisted by Signicat.
62
+
4. For the type, pick the ``Signicat`` option.
63
+
5. On the next page, you can define all of the standard authenticator configuration options like any previous authenticator that should run, the resulting ACR, transformers that should executed, etc. At the bottom of the configuration page, the Signicat-specific options can be found.
Using these inputs, certain required and optional configuration settings may be provided.
70
+
71
+
.. note::
72
+
73
+
The Signicat-specific configuration is generated dynamically based on the `configuration model defined in the Kotlin interface <https://github.com/curityio/signicat-authenticator/blob/master/src/main/kotlin/io/curity/identityserver/plugin/signicat/config/SignicatAuthenticatorPluginConfig.kt>`_.
74
+
75
+
6. From the ``Country`` dropdown box, pick the country's kind of E-ID that should be used. For example, pick ``sweden`` to use Swedish BankID or ``denmark`` to use NemID.
76
+
7. Enter the ``Service Name`` that you have registered with Signicat or use the default of ``demo`` for testing.
77
+
8. From the ``Environment`` dropdown box, select either ``standard-environment`` or ``custom-environment``. The former should be used if you are not using a custom domain (e.g., ``signicat.example.com``). If not, then select ``standard-environment`` and pick either ``production`` or ``pre-production``. ``pre-production`` will cause certain test certificates to be used and warnings to be logged in the server log.
78
+
9. Optionally, enter the name of a `graphics profile <https://support.signicat.com/display/S2/Graphical+profiles%2C+fonts+and+styling>`_ in the ``Graphics Profile`` text field.
79
+
80
+
Once all of these changes are made, they will be staged, but not committed (i.e., not running). To make them active, click the ``Commit`` menu option in the ``Changes`` menu. Optionally enter a comment in the ``Deploy Changes`` dialogue and click ``OK``.
81
+
82
+
Once the configuration is committed and running, the authenticator can be used like any other.
83
+
84
+
.. note::
85
+
86
+
When using the authenticator with the Curity Security Token Service (i.e., the "OAuth server"), if the client application sends the OpenID-Connect-defined ``ui_locales`` request parameter, that will be passed to Signicat as the preferred language. Also, if a request has been made by some other client (in the same browser) using the ``ui_locales``, this preferred language will be propagated to Signicat even if the application does not explicitly provide it in the request.
87
+
88
+
License
89
+
~~~~~~~
90
+
91
+
This plugin and its associated documentation is listed under the `Apache 2 license <LICENSE>`_.
92
+
93
+
More Information
94
+
~~~~~~~~~~~~~~~~
95
+
96
+
Please visit `curity.io <https://curity.io/>`_ for more information about the Curity Identity Server.
Copy file name to clipboardExpand all lines: src/main/kotlin/io/curity/identityserver/plugin/signicat/authentication/SignicatAuthenticatorRequestHandler.kt
0 commit comments