You are browsing a read-only backup copy of Wikitech. The live site can be found at wikitech.wikimedia.org

Difference between revisions of "CAS-SSO"

From Wikitech-static
Jump to navigation Jump to search
imported>Jobo
imported>Ottomata
Line 4: Line 4:


The authentication happens with your ''Wikimedia Developer Account'' name and the respective password. There's also be possibility to add a second factor using [https://en.wikipedia.org/wiki/Universal_2nd_Factor U2F], see below how to enable it.  
The authentication happens with your ''Wikimedia Developer Account'' name and the respective password. There's also be possibility to add a second factor using [https://en.wikipedia.org/wiki/Universal_2nd_Factor U2F], see below how to enable it.  
'''Instructions for using SSO can be found at [[Single Sign On|Single Sign On.]]'''


If you select "Remember Me" during, a long term session is initiated. It lasts for seven days (or until you logout via https://idp.wikimedia.org/logout). Do only use this when working from a machine only used by yourself. If that's not the case and "Remember Me" is not used, your SSO session will expire after one hour of inactivity.
If you select "Remember Me" during, a long term session is initiated. It lasts for seven days (or until you logout via https://idp.wikimedia.org/logout). Do only use this when working from a machine only used by yourself. If that's not the case and "Remember Me" is not used, your SSO session will expire after one hour of inactivity.


The current SSO setup is targeted at SRE staff. This is to collect more feedback and address pain points before a wider rollout and also because there might still be disruptive changes which we don't want to impose on less technical users. That's why a number of services with a significant amount of non-SRE users are currently only enabled via a separate Apache site (to not interfere with users authenticating against plain LDAP).
The current SSO setup is targeted at SRE staff. This is to collect more feedback and address pain points before a wider rollout and also because there might still be disruptive changes which we don't want to impose on less technical users. That's why a number of services with a significant amount of non-SRE users are currently only enabled via a separate Apache site (to not interfere with users authenticating against plain LDAP).
== Which services are currently enabled? ==
* https://icinga.wikimedia.org
* https://librenms.wikimedia.org
* https://graphite.wikimedia.org
* https://hue-next.wikimedia.org
* https://superset.wikimedia.org
* https://people.wikimedia.org/~cdanis/sremap/
* https://piwik.wikimedia.org
* https://puppetboard.wikimedia.org
* https://racktables.wikimedia.org
* https://rt.wikimedia.org
* https://tendril.wikimedia.org
* https://thanos.wikimedia.org
* https://turnilo.wikimedia.org
* https://yarn.wikimedia.org


== Service ==
== Service ==
Line 41: Line 26:


Mid-term, enabling U2F for web SSO will be part of our account management. Until then, please open a task in Phabricator and apply the ''LDAP-Access-Requests'' tag. Your SSO account will be U2F-enabled by the SRE person currently on [[SRE/SRE Clinic Duty]].
Mid-term, enabling U2F for web SSO will be part of our account management. Until then, please open a task in Phabricator and apply the ''LDAP-Access-Requests'' tag. Your SSO account will be U2F-enabled by the SRE person currently on [[SRE/SRE Clinic Duty]].
See also: [[Single Sign On#Enabling 2FA using a YubiKey|Single Sign On#Enabling 2FA using a YubiKey.]]


=== Enabling U2F for an account ===
=== Enabling U2F for an account ===
Line 52: Line 40:
  sudo modify-mfa --disable UID
  sudo modify-mfa --disable UID


UID is your shell username here (as that's what identifies your identity on the LDAP level), not the Wikimedia Developer Name). Once it's enabled, the next time you login, your token will be registered (Mid-term we'll have a proper identity management solution which will make registration on the shell obsolete. Note that CAS operates on the readonly LDAP replicas, so it might take up to two minutes minutes until the LDAP change is affective.
Note that CAS operates on the readonly LDAP replicas, so it might take up to two minutes minutes until the LDAP change is affective.
 
UID is the shell username here (as that's what identifies your identity on the LDAP level, not the Wikimedia Developer Name). Once it's enabled, the next time you login to the SSO session, you will be asked to register your U2F token.  This registration screen is disabled after you have entered your username and password.  Subsequent logins will require you authenticate via the U2F token in a similar manner i.e enter username and password then get forwarded to a screen to authenticate with your U2F tokens.
 
If you want to force the U2F registration immediately  instead of waiting for your SSO session to expire, simply [https://idp.wikimedia.org/logout logout] and [https://idp.wikimedia.org/logout log back in]
 
 
Mid-term we'll have a proper identity management solution which will make registration on the shell obsolete.  


In the current version CAS only supports a single token. If you lose your token it needs to be removed from configuration at which point a replacement token can be added.
In the current version CAS only supports a single token. If you lose your token it needs to be removed from configuration at which point a replacement token can be added.

Revision as of 17:43, 16 June 2021

The Wikimedia Developer SSO Portal at idp.wikimedia.org is a single sign-on (SSO) infrastructure built on Apereo CAS.

Wikimedia Developer Single Sign-On Portal

When logging into a CAS-enabled website without an active SSO session you'll be redirected to the CAS login page (https://idp.wikimedia.org/login) The CAS service collects LDAP group memberships and makes them available to services for making authorisation choices. After authentication the users get redirected to the initiating service.

The authentication happens with your Wikimedia Developer Account name and the respective password. There's also be possibility to add a second factor using U2F, see below how to enable it.

Instructions for using SSO can be found at Single Sign On.

If you select "Remember Me" during, a long term session is initiated. It lasts for seven days (or until you logout via https://idp.wikimedia.org/logout). Do only use this when working from a machine only used by yourself. If that's not the case and "Remember Me" is not used, your SSO session will expire after one hour of inactivity.

The current SSO setup is targeted at SRE staff. This is to collect more feedback and address pain points before a wider rollout and also because there might still be disruptive changes which we don't want to impose on less technical users. That's why a number of services with a significant amount of non-SRE users are currently only enabled via a separate Apache site (to not interfere with users authenticating against plain LDAP).

Service

The source code is in the operations/software/cas-overlay-template repository.

The service runs mainly on the idp1001 (Eqiad) and idp2001 (Codfw) hosts.

Enabling U2F as a second factor

Apereo CAS supports U2F as a second factor. This is configured on a per-user opt in basis and configured via LDAP. Supported browsers are Chrome/Chromium, Firefox (ESR68 and later, ESR60 had some issues in tests, but it's EOLed anyway now) and Safari (13 and later).

All Yubikeys issued by OIT should be compatible. Onlykeys were also reported to work (https://phabricator.wikimedia.org/T242438)

Requesting to enable U2F (if you're not in SRE)

Mid-term, enabling U2F for web SSO will be part of our account management. Until then, please open a task in Phabricator and apply the LDAP-Access-Requests tag. Your SSO account will be U2F-enabled by the SRE person currently on SRE/SRE Clinic Duty.


See also: Single Sign On#Enabling 2FA using a YubiKey.

Enabling U2F for an account

To enable U2F as a second factor, run the following on mwmaint1002.eqiad.wmnet:

sudo modify-mfa --enable UID

To disable U2F, use

sudo modify-mfa --disable UID

Note that CAS operates on the readonly LDAP replicas, so it might take up to two minutes minutes until the LDAP change is affective.

UID is the shell username here (as that's what identifies your identity on the LDAP level, not the Wikimedia Developer Name). Once it's enabled, the next time you login to the SSO session, you will be asked to register your U2F token. This registration screen is disabled after you have entered your username and password. Subsequent logins will require you authenticate via the U2F token in a similar manner i.e enter username and password then get forwarded to a screen to authenticate with your U2F tokens.

If you want to force the U2F registration immediately instead of waiting for your SSO session to expire, simply logout and log back in


Mid-term we'll have a proper identity management solution which will make registration on the shell obsolete.

In the current version CAS only supports a single token. If you lose your token it needs to be removed from configuration at which point a replacement token can be added.

Known issues / FAQ

External link