2. Handle shibboleth-expired users

This module provides a mechanism to handle shibboleth-expired users. The module is compatible with the overquota-handling mechanism provided by the same package. It replaces the ok_policy_enforce.py script and provides a way to migrate from the existing state.

2.1. Policy

The policy of this module defines the following types of shibboleth states:

  • SHIBBOLETH_EXPIRED: User’s shibboleth account has expired
  • SHIBBOLETH_NOTICE: User is informed about the impending suspension actions.
  • SHIBBOLETH_SUSPEND: User is suspended.
  • SHIBBOLETH_DELETED: User has been deactivated by the old script.

You can specify after how many days without a shibboleth login the shibboleth account is considered expired, and define how many days after expiration the states SHIBBOLETH_NOTICE and SHIBBOLETH_SUSPEND can apply. Settings reside at 20-okeanos-policy.conf, for example the following settings:

specify that a shibboleth account expires 60 days without login, and after that, the user will be notified in zero, five, and eight days, and finally will be suspended in 15 days.

2.2. User suspension

A shibboleth-expired user is “suspended” by means of:

  • suspending their system project
  • suspending their project memberships
  • suspending their owned projects
  • deactivating their local account login
  • renewing their token

No actual resource (e.g. VM) is directly affected; however, due to project membership suspension, the user becomes overquota and their resources will be reclaimed by the dedicated overquota script.

If a user logs in again using shibboleth, they can be recovered. The mechanism keeps track which projects/memberships had been suspended due to shibboleth expiration in order to unsuspend them.

2.3. Applying the policy

Management command shibboleth-enforce applies the policy. When run without arguments, it first looks for users that have logged in using shibboleth and need to be recovered. It then looks for users that are expired in order to apply the policy.

The command is meant to run daily with:

snf-manage shibboleth-enforce --run

2.4. Migration

In order to migrate from the old script ok_policy_enforce.py, run:

snf-manage shibboleth-enforce --migrate-ok-policy-enforce

This will first detect users that must be recovered and then migrate shibboleth states as explained below:

  • fnotice becomes SHIBBOLETH_NOTICE:1
  • snotice becomes SHIBBOLETH_NOTICE:2
  • lnotice becomes SHIBBOLETH_NOTICE:3
  • shutdown goes to SHIBBOLETH_SUSPEND and suspension is applied
  • delete becomes SHIBBOLETH_DELETED

Use –run` to actually do the migrations.

Table Of Contents

Previous topic

1. Handling overquota users

Next topic

3. Installation notes

This Page