Configuration

LabShare Auth Configuration

Copy the sample-config.json into the config directory of auth and rename it to local.json. For advanced configuration, such as environment or deployment-specific configuration files, view the Config Library Documentation.

Default Tenant Setup

The defaults configuration object provisions the default Tenant, Identity Providers, and Client. Since LabShare Auth is completely dynamic, configuring a default Tenant allows the initial system administrator(s) to start configuring the system with applications such as the Auth UI or through the management REST APIs.

System administrators

The system configuration object provides system-wide configuration settings.

Example:

{
  "auth": {
    "system": {
      "administrators": [
        {
          "email": "admin@example.com",
          "identityIssuer": "https://accounts.google.com"
        }
      ]
    }
  }
}

Database

MySQL

The MySQL driver can be configured with the connection options provided by the mysql library described here.

User Alerts (key: userAlerts)

Tenant Authentication Providers

Configuring Identity Providers

1. Go to the Tenant dashboard in the Auth UI
2. Select the Providers section from the left navigation menu
3. Create or edit Identity Providers from the dashboard

WSFed

{
  "identityProviderUrl": "https://idp.url",
  "realm": "my-id",
  "cert": "awefjkawfjlwaefawefl...",
  "scripts": {
    "mapUserProfile": "module.exports = function (ctx, callback) {
      const claims = ctx.secrets.claims;
      callback(null, {
        email: claims.Email
      });
    }"
  }
}

Azure Open ID Connect

Go to https://apps.dev.microsoft.com and register an application to obtain the client ID and tenant. Ensure the replyUrl for the application is set to your LabShare Auth tenant’s authenticate callback URL and enable id token access. For example: https://a.labshare.org/_api/auth/docs#/Public/get_auth__tenantId__authenticate_callback.

Details: https://www.npmjs.com/package/passport-azure-ad#5-usage

Google

Configuration: https://www.npmjs.com/package/passport-google-oauth2#usage-of-oauth-20 Go to https://console.developers.google.com/ to generate Google OAuth secret

Github (NYI)

https://www.npmjs.com/package/passport-github#usage

Saml2

https://www.npmjs.com/package/passport-wsfed-saml2

Note: The SAML IDP’s ACS will need to be configured to POST to the LabShare Auth auth/{tenantId}/authenticate/callback endpoint. Example: https://a.labshare.org/_api/auth/{tenantId}/authenticate/callback.

Example:

{
  "name": "my-saml-idp",
  "type": "saml2",
  "config": {
    "realm": "https://example.com",
    "identityProviderUrl": "https://example.com/samlp",
    "cert": "waefnioawfnaewofnawef...",
    "scripts": {
      "mapUserProfile": `module.exports = function (ctx, callback) {
           const claims = ctx.secrets.claims;
           callback(null, {
             email: claims.Email
           });
       }`
    }
  }
}

Configuring the Auth WSFed Server

LabShare’s WSFed implements the wsignin1.0 and wsignout1.0 flows.

Configuring WSFed

Service Configuration

Auth’s HTTP port can be configured by modifying the rest options. See: options.

Example:

{
  "rest": {
    "port": 7000,
    "basePath": "/_api"
  }
}

Schedule Configuration

A scheduled process can trim the audit log and event log tables according to the configurable rules by the combination of date and size.

Example:

  "schedule": {
    "trimLogOptions": [
      {
        "logType": "auditLog",
        "bySize": {
          "checkNumber": 5,
          "cronSyntax": "*/5 * * * *"
        },
        "byDate": {
          "ageLimit": "360 days",
          "cronSyntax": "0 0 * * *"
        }
    },
     {
        "logType": "eventLog",
        "bySize": {
          "checkNumber": 5,
          "cronSyntax": "*/5 * * * *"
        },
        "byDate": {
          "ageLimit": "360 days",
          "cronSyntax": "0 0 * * *"
        }
    }
    ]
  }

bySize

byDate

Note: this configuration uses ms to define time format.