Shibboleth: Institution-wide Shibboleth groups

[pdurbin]

As explained in the Shibboleth Functional Requirements Document for Dataverse 4.0, we plan to support Institution-wide Shibboleth groups.

In practice this means creating a groups with names like "All Harvard PIN/Shibboleth Users" or "All testshib.org Shibboleth Users" that pay attention to the "Shib-Identity-Provider" Shibboleth attribute to see if you authenticated via harvard.edu, testshib.org, etc.

You should be able to assign roles to these groups by clicking the "Assign Roles to Users/Groups" button.

[pdurbin]

As of 4a4310b you can log into dvn-build with the "TestShib IdP" and see that you are part of the "All testshib.org Shibboleth Users (&shib/1)" group with the debugging output I added to the screen when Shibboleth is enabled:

These are the commands I used to enable Shibboleth and create the testshib group:

curl -X PUT -d yes $HOST/s/settings/:ShibEnabled

curl -s -X POST -H 'Content-type:application/json' --upload-file data/shibGroupTestShib.json "$HOST/api/groups/shib?key=$ADMIN_KEY"

[pdurbin]

Per @scolapasta I'm giving this to QA but please note that there is something going on with permissions first reported in #1380 such that Shibboleth users aren't seeing the "Add Data" button when they should. "No effect".

This ticket is more about the creation of Shibboleth groups, and assigning roles like this:

Please note that we'd like to automate the addition of Shibboleth groups in #1403

[bencomp]

In the Dataverse.nl situation, all users come through the same IdP: SURFconext. We look at the value of the Organization attribute to determine the user's organisation. Can that attribute be used as well?

[bencomp]

Oh, and 👍 !