EOSC Node AAI

[enolfc]

Summary

Implement the support for the personal projects as the primary group of the user so this can be properly reported in accounting.

Creates a new EOSCNodeAuthenticator that will try to get the primary group of the user from the entitlements by matching a personal_project_re regular expression with default value:

r"^urn:geant:eosc-federation.eu:group:pp:Personal%20Project%20Name-(.*)$"

If the RE contains a group, the match will be used as the name for the primary group of the user. If it does not match, the primary group will be the first group of the user that matches the allowed_groups.

Sample configuration

c.JupyterHub.authenticator_class = "eoscauthenticator"
c.EOSCNodeAuthenticator.allow_all = True
c.EOSCNodeAuthenticator.claim_groups_key = "eduperson_entitlement"
c.EOSCNodeAuthenticator.personal_project = r"^urn:mace:egi.eu:group:fedcloud-([^#]*)#.*$"

This will match urn:mace:egi.eu:group:fedcloud-users#sso.egi.eu and return users as primary group

Without groups in the re:

c.JupyterHub.authenticator_class = "eoscauthenticator"
c.EOSCNodeAuthenticator.allow_all = True
c.EOSCNodeAuthenticator.claim_groups_key = "eduperson_entitlement"
c.EOSCNodeAuthenticator.personal_project = r"^urn:mace:egi.eu:group:fedcloud-.*$"

This will match urn:mace:egi.eu:group:fedcloud-users#sso.egi.eu and return urn:mace:egi.eu:group:fedcloud-users#sso.egi.eu as primary group

---

Related issue :

[enolfc]

We would benefit from some automated testing here as we are bit blind on whether this works or not :(

[andrea-manzi]

please check comment

[valtri]

Works like a charm.

The default regular expression for personal group is OK? In testing AAI is working this: ^urn:geant:eosc-federation.eu:group:(pp-.*)$.

And maybe we could tune login_service variable for EGI and EOSC authenticator? Something like:

    @default("login_service")
    def _login_service_default(self):
        return "EGI Check-in"

...but that is just a cosmetics and overrode by html customizations anyway.

[enolfc]

Works like a charm.

The default regular expression for personal group is OK? In testing AAI is working this: ^urn:geant:eosc-federation.eu:group:(pp-.*)$.

And maybe we could tune login_service variable for EGI and EOSC authenticator? Something like:

    @default("login_service")
    def _login_service_default(self):
        return "EGI Check-in"

...but that is just a cosmetics and overrode by html customizations anyway.

I think we can just define login_service in the EOSC one to something like "EOSC AAI", no need to define a default

[valtri]

LGTM!

[andrea-manzi]

LGTM! and tested by @valtri