Skip to content

Add vestiging to eherkenning auth variable. #3967

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
joeribekker opened this issue Mar 4, 2024 · 3 comments · Fixed by #4484 · May be fixed by #4525
Open

Add vestiging to eherkenning auth variable. #3967

joeribekker opened this issue Mar 4, 2024 · 3 comments · Fixed by #4484 · May be fixed by #4525
Assignees
@joeribekker @robinmolen
Labels
owner: den-haag owner: dimpact topic: machtigen
Milestone
Release 3.2.0

Comments

@joeribekker
Copy link
Contributor

You can request the "vestiging" with eHerkenning. This should be available in the auth object.
This also relies on the ticket from Silvia for fixing the template with all the variables (including vestigting).
@joeribekker joeribekker added this to the Release 2.7.0 milestone Mar 4, 2024
@sergei-maertens sergei-maertens moved this from Todo to In Progress in Development Jul 3, 2024
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
🗃️ [#3967] Add model field to store service restriction (branch number)
2ce7cba
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
🍱 [#3967] Update fixture to have a user with vestiging claim
a1ba9e6
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
✅ [#3967] Add test for branch number extraction with eHerkenning via …
b340e7a 
…OIDC auth
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
✨ [#3967] Implement recording branch number service restriction
e98749f
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
✨ [#3967] Add 'auth_context_branch_number' static variable
5b23649 
For eherkenning authentication, this will contain the branch number
that the employee is authenticated/authorized for.
@sergei-maertens sergei-maertens moved this from In Progress to Implemented in Development Jul 3, 2024
@sergei-maertens sergei-maertens mentioned this issue Jul 3, 2024
Merged
9 tasks
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
🗃️ [#3967] Add model field to store service restriction (branch number)
1432dc5
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
🍱 [#3967] Update fixture to have a user with vestiging claim
44caead
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
✅ [#3967] Add test for branch number extraction with eHerkenning via …
b56c9a9 
…OIDC auth
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
✨ [#3967] Implement recording branch number service restriction
7d0fa25
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
✨ [#3967] Add 'auth_context_branch_number' static variable
be42e89 
For eherkenning authentication, this will contain the branch number
that the employee is authenticated/authorized for.
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
🗃️ [#3967] Add model field to store service restriction (branch number)
5313020
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
🍱 [#3967] Update fixture to have a user with vestiging claim
30fbeb5
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
✅ [#3967] Add test for branch number extraction with eHerkenning via …
69b2a3f 
…OIDC auth
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
✨ [#3967] Implement recording branch number service restriction
ebc9999
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
✨ [#3967] Add 'auth_context_branch_number' static variable
ecd3f46 
For eherkenning authentication, this will contain the branch number
that the employee is authenticated/authorized for.
sergei-maertens added a commit that referenced this issue Jul 3, 2024
@sergei-maertens
✅ [#3967] Add test for branch number extraction with eHerkenning via …
9e4a5c7 
…OIDC auth
@github-project-automation github-project-automation bot moved this from Implemented to Done in Development Jul 3, 2024
@sergei-maertens
Copy link
Member

eHerkenning via SAML needs to be covered too, re-opening

@github-project-automation github-project-automation bot moved this from Done to In Progress in Development Jul 8, 2024
@sergei-maertens sergei-maertens moved this from In Progress to Todo in Development Jul 8, 2024
@sergei-maertens sergei-maertens moved this from Todo to In Progress in Development Jul 15, 2024
sergei-maertens added a commit that referenced this issue Jul 15, 2024
@sergei-maertens
⚗️ [#3967] See if we can grab the branch number from eHerkenning
459f903 
This is really hard to test/try out because we don't have a real
eherkenning setup with a branch service restriction as far as I can
tell...

However, piecing together the documentation on:
https://afsprakenstelsel.etoegang.nl/Startpagina/v2/interface-specifications-dv-hm
(which describes the interface between service provider and makelaar),
we should get back the ServiceRestriction SAML attribute if information
is available in the MR (machtigingsregister). The examples show that
it would not be an encrypted attribute (it sits in the AttributeStatement
element):

    <saml:Attribute Name=urn:etoegang:1.9:ServiceRestriction:Vestigingsnr>
        <saml:AttributeValue xsi:type=xs:string>123456789012</saml:AttributeValue>
    </saml:Attribute>

The documentation says it would be one or more restriction, so we're
assuming that it returns a list of strings of values after processing,
similar to the urn:etoegang:core:ServiceID and urn:etoegang:core:ServiceUUID
attributes.
sergei-maertens added a commit that referenced this issue Jul 15, 2024
@sergei-maertens
⚗️ [#3967] See if we can grab the branch number from eHerkenning
824aea1 
This is really hard to test/try out because we don't have a real
eherkenning setup with a branch service restriction as far as I can
tell...

However, piecing together the documentation on:
https://afsprakenstelsel.etoegang.nl/Startpagina/v2/interface-specifications-dv-hm
(which describes the interface between service provider and makelaar),
we should get back the ServiceRestriction SAML attribute if information
is available in the MR (machtigingsregister). The examples show that
it would not be an encrypted attribute (it sits in the AttributeStatement
element):

    <saml:Attribute Name=urn:etoegang:1.9:ServiceRestriction:Vestigingsnr>
        <saml:AttributeValue xsi:type=xs:string>123456789012</saml:AttributeValue>
    </saml:Attribute>

The documentation says it would be one or more restriction, so we're
assuming that it returns a list of strings of values after processing,
similar to the urn:etoegang:core:ServiceID and urn:etoegang:core:ServiceUUID
attributes.

I checked our code in django-digid-eherkenning, and we already by
default include the service restriction request in the catalogus
request, so no extra work should be needed there, see:
https://github.com/maykinmedia/django-digid-eherkenning/blob/0189aceea660d2f4774d238397365f17adeb354a/digid_eherkenning/models/eherkenning.py#L234
@sergei-maertens sergei-maertens linked a pull request Jul 15, 2024 that will close this issue
Draft
11 tasks
@joeribekker
Copy link
Contributor Author

joeribekker commented Apr 1, 2025 •
edited
Loading

Not sure why I assigned myself. Assigning to Robin to tackle with the OIDC stuff.
But first, I'll see what data is returned atm and post back here.

@sergei-maertens
Copy link
Member

sergei-maertens commented Apr 1, 2025 •
edited
Loading

@joeribekker you need to contact Signicat to get representative test accounts where we have an eherkenning middel with a service restriction (because this is the SAMLv2 flow, not OIDC)

I have a PR with an implementation, I just can't test it so I have no idea if I'm doing it correctly.

sergei-maertens added a commit that referenced this issue Apr 1, 2025
@sergei-maertens
⚗️ [#3967] See if we can grab the branch number from eHerkenning
6e37953 
This is really hard to test/try out because we don't have a real
eherkenning setup with a branch service restriction as far as I can
tell...

However, piecing together the documentation on:
https://afsprakenstelsel.etoegang.nl/Startpagina/v2/interface-specifications-dv-hm
(which describes the interface between service provider and makelaar),
we should get back the ServiceRestriction SAML attribute if information
is available in the MR (machtigingsregister). The examples show that
it would not be an encrypted attribute (it sits in the AttributeStatement
element):

    <saml:Attribute Name=urn:etoegang:1.9:ServiceRestriction:Vestigingsnr>
        <saml:AttributeValue xsi:type=xs:string>123456789012</saml:AttributeValue>
    </saml:Attribute>

The documentation says it would be one or more restriction, so we're
assuming that it returns a list of strings of values after processing,
similar to the urn:etoegang:core:ServiceID and urn:etoegang:core:ServiceUUID
attributes.

I checked our code in django-digid-eherkenning, and we already by
default include the service restriction request in the catalogus
request, so no extra work should be needed there, see:
https://github.com/maykinmedia/django-digid-eherkenning/blob/0189aceea660d2f4774d238397365f17adeb354a/digid_eherkenning/models/eherkenning.py#L234
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@joeribekker joeribekker

@robinmolen robinmolen

Labels
owner: den-haag owner: dimpact topic: machtigen
Projects
Development
Status: Todo
Milestone
Release 3.2.0
5 participants
@joeribekker @alextreme @sergei-maertens @SilviaAmAm @robinmolen