Keith,
We use Shib/SAML here at UAB. (https://galaxy.uabgrid.uab.edu – no, you can’t get in
L )
We currently do it the “old way” in Apache with mod_shib.
We are planning an upgrade soon, sounds like the “old way” should still work until the new feature is implemented?
In our case, we also have to manipulate the user string to strip off the @uab.edu as part of this processing. It would be great if that were a configurable part
of an external authenticator, so we need to twiddle code locally for that.
Regards,
Curtis
From: galaxy-dev [mailto:galaxy-dev-bounces@lists.galaxyproject.org]
On Behalf Of Keith Suderman
Sent: Monday, February 27, 2017 11:34 AM
To: Galaxy Dev List <galaxy-dev@lists.galaxyproject.org>
Subject: [galaxy-dev] SAML Authentication
Is anyone using SAML for authentication? There is a feature request for SAML support on GitHub (
https://github.com/galaxyproject/galaxy/issues/3146), but it doesn't look like any work has been done.
We need to add the ability for our users to authenticate with a SAML identity provider (IdP), in particular with InCommon/EduRoam/EduCause et al. Looking at the documentation there appears to be "the old way" (configuring Apache/Nginx
to do the authentication) and "the new way" where Galaxy handles the authentication. Is it correct to assume that to use the new way I should implement an external authenticator, something like galaxy/auth/providers/saml.py and then some sort of magic to
get a config/auth_conf.xml working?
I just want to make sure I am heading down the correct path before investing too much time.
- Keith
Keith Suderman
Research Associate
Department of Computer Science
Vassar College, Poughkeepsie NY