# SAML RoleとGrowiの権限の連携

https://github.com/weseek/growi/issues/961

# TODO
- Growiの管理画面でロールごと（keycloakではRole Nameを使う）に出来ること（or 出来ないことを）制限出来るようにする
    - 例
        - `growi_user`でないとログイン出来ない
        - `growi_admin`でないと管理画面に行けない
        - など

- `passport-saml`をversion`1.1.0`にアップグレードする(`getSamlResponseXml`を使うため)
- `passport-saml`の`getSamlResponseXml`で得られるXMLをparseしてロールを抽出
- 抽出したロールと管理画面で設定した制限を照らし合わせて、いろいろauthorizeする。

# Sample Saml Response (passport-saml@1.1.0で`getSamlResponseXml`を呼ぶと得られる)

- keycloakでgrowi_adminという新規ロールを作成した
- 他のロールはデフォルトで与えられるもの

```
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
  Destination="http://localhost:3000/passport/saml/callback" ID="ID_d408e2f0-6fbd-4375-873f-ad168b2c463b"
  InResponseTo="_92a1e9b60a219ce61bdf" IssueInstant="2019-05-21T07:50:41.507Z" Version="2.0">
  <saml:Issuer>http://localhost:18080/auth/realms/growi</saml:Issuer>
  <dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
    <dsig:SignedInfo>
      <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
      <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
      <dsig:Reference URI="#ID_d408e2f0-6fbd-4375-873f-ad168b2c463b">
        <dsig:Transforms>
          <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
          <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
        </dsig:Transforms>
        <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
        <dsig:DigestValue>ynQGaOd3tSER3yQPj9QQTN+Koe8=</dsig:DigestValue>
      </dsig:Reference>
    </dsig:SignedInfo>
    <dsig:SignatureValue>
      EVYfxRzND42J5os6LIFFOU1P0HSqZaGAhmB2dtwX9jEM01t7r2C3fUlOIA/l+4JixTkZTUtaNWUFyGtGT+nvfiIi9i1uumov7NeozFt5yXGtkfPRwxf8O5nRdlsgVVaXoDpHraWgOyerpv37TiEpf3LvbxeaZAF2Ae3YtWOmm53nYvPiz4ml8A2SbsWQ/G2e9wVbHq+4Bg7hNiGDdvzV2Y/hpmImx1WXzZgZt48n2EZ3v1lATmBa/HAye+HKrvMYdWjSOyRDDXCK9a+gPptG9ygpsW9Tz6UkKu1v2DBMlxRukMECpVrQCRZotVECn/GE8lgEY0VsqYkEBwkmPIoIEg==
    </dsig:SignatureValue>
    <dsig:KeyInfo>
      <dsig:KeyName>97L7YxOQ-mbeqNCIM_Pkc558Qqj6sq1JfRCZwAjWZp0</dsig:KeyName>
      <dsig:X509Data>
        <dsig:X509Certificate>
          MIICmTCCAYECBgFq2LGz6TANBgkqhkiG9w0BAQsFADAQMQ4wDAYDVQQDDAVncm93aTAeFw0xOTA1MjEwNDM5NDVaFw0yOTA1MjEwNDQxMjVaMBAxDjAMBgNVBAMMBWdyb3dpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmkhoaTcFbGbbwOueDZygVfnlQKmHhyBkUhPwopEEaCzKtbF3e+G7h8a6QPtO4ZtoSUOsZlUA9W+5wy4brWlbzKrVyqEbp6ywogsuBPajFGNJ8F9jmjjHxPWGe7wpuADuX6E7hIJBMbA4wnYYsXYUva4zfAZa+TohbZugKDbiT5SbZLUjfkFtDGJPmOACOlixf56/7NgrINiPARqyYvYb+uatf5lmk9XCySSQ+nTqZIxWxneseEfyo30ZwYg1GwaahNJPdOvgWr7C/U2YoPkgGkl7QkpWMLjjGjxxPYUSYIT1zE9UIn0sCnTppVGj/MwwslKJgu0d9oCFzSuqQUKjHQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAsOQdaE8BJ6MjRpNPnGt6jKfcoLp6PCIJugzJmJvWykJW0IROdWVnyrcUdJAxa/smPCZsbFwBvWNd7I7htGbCJ8vkZmqzjti4SkC79IALKG+Hbh0Kt3E5ags71NsOKRhEwKZAujZdU/o1hLGvmF9NO3vMlcyKcaEhLvCLrL7YMBRY6FiPqwVb7lCmUcCvUj27yQ5CIQf1vYbLBB1Dt64mdKepdsiQW+NpltF3Wg7vXi/i+JDnjyLC0VWgMY7N/Jx9TF/VEa97Ub95g75AKvy6vcSpAEpeSsMJbcWU9rBaX58rmFbhBo0n8dqpKXSYdvY0yO3VAdVIMW2+VaJTeo6iz
        </dsig:X509Certificate>
      </dsig:X509Data>
      <dsig:KeyValue>
        <dsig:RSAKeyValue>
          <dsig:Modulus>
            mkhoaTcFbGbbwOueDZygVfnlQKmHhyBkUhPwopEEaCzKtbF3e+G7h8a6QPtO4ZtoSUOsZlUA9W+5wy4brWlbzKrVyqEbp6ywogsuBPajFGNJ8F9jmjjHxPWGe7wpuADuX6E7hIJBMbA4wnYYsXYUva4zfAZa+TohbZugKDbiT5SbZLUjfkFtDGJPmOACOlixf56/7NgrINiPARqyYvYb+uatf5lmk9XCySSQ+nTqZIxWxneseEfyo30ZwYg1GwaahNJPdOvgWr7C/U2YoPkgGkl7QkpWMLjjGjxxPYUSYIT1zE9UIn0sCnTppVGj/MwwslKJgu0d9oCFzSuqQUKjHQ==
          </dsig:Modulus>
          <dsig:Exponent>AQAB</dsig:Exponent>
        </dsig:RSAKeyValue>
      </dsig:KeyValue>
    </dsig:KeyInfo>
  </dsig:Signature>
  <samlp:Status>
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
  </samlp:Status>
  <saml:Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" ID="ID_5cdf9dab-0d14-47a7-9268-8859ccd13965"
    IssueInstant="2019-05-21T07:50:41.502Z" Version="2.0">
    <saml:Issuer>http://localhost:18080/auth/realms/growi</saml:Issuer>
    <dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
      <dsig:SignedInfo>
        <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
        <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
        <dsig:Reference URI="#ID_5cdf9dab-0d14-47a7-9268-8859ccd13965">
          <dsig:Transforms>
            <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
            <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
          </dsig:Transforms>
          <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
          <dsig:DigestValue>kVvliB8SeDg2S87Fo4/4tDgArs4=</dsig:DigestValue>
        </dsig:Reference>
      </dsig:SignedInfo>
      <dsig:SignatureValue>
        Rf3ZHmwYZ62QZeKILUlxU0qM/jujgbHqNTnhkWY9HN5bhs/yYgqVIzXGLtALbIGzjcutremTioXt96kE9TKPIaIow+CeC1dZFPOp58B9u6WLwisiy4y1Dqi/7Ekc5WAZamk87OzpapsJKskjk/V7rL5rvv0scpCFbTr2jkWhLrHT6FdHzhM2LD4Ye/e/2dpy/y0ErH2xf+yA2+Tj37LNF+hN81KY8GLFJSrM9/E3U6jHcwAvDN64/FoBE6qz1aW1sl+Xs/45mNlHX5QgfFUeRWBwKUTSKYTPYHQshZdnTNwGzztQRnM5e5Fx13P399sxRD6fExhi1g5ohqAicIBfwg==
      </dsig:SignatureValue>
      <dsig:KeyInfo>
        <dsig:KeyName>97L7YxOQ-mbeqNCIM_Pkc558Qqj6sq1JfRCZwAjWZp0</dsig:KeyName>
        <dsig:X509Data>
          <dsig:X509Certificate>
            MIICmTCCAYECBgFq2LGz6TANBgkqhkiG9w0BAQsFADAQMQ4wDAYDVQQDDAVncm93aTAeFw0xOTA1MjEwNDM5NDVaFw0yOTA1MjEwNDQxMjVaMBAxDjAMBgNVBAMMBWdyb3dpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmkhoaTcFbGbbwOueDZygVfnlQKmHhyBkUhPwopEEaCzKtbF3e+G7h8a6QPtO4ZtoSUOsZlUA9W+5wy4brWlbzKrVyqEbp6ywogsuBPajFGNJ8F9jmjjHxPWGe7wpuADuX6E7hIJBMbA4wnYYsXYUva4zfAZa+TohbZugKDbiT5SbZLUjfkFtDGJPmOACOlixf56/7NgrINiPARqyYvYb+uatf5lmk9XCySSQ+nTqZIxWxneseEfyo30ZwYg1GwaahNJPdOvgWr7C/U2YoPkgGkl7QkpWMLjjGjxxPYUSYIT1zE9UIn0sCnTppVGj/MwwslKJgu0d9oCFzSuqQUKjHQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAsOQdaE8BJ6MjRpNPnGt6jKfcoLp6PCIJugzJmJvWykJW0IROdWVnyrcUdJAxa/smPCZsbFwBvWNd7I7htGbCJ8vkZmqzjti4SkC79IALKG+Hbh0Kt3E5ags71NsOKRhEwKZAujZdU/o1hLGvmF9NO3vMlcyKcaEhLvCLrL7YMBRY6FiPqwVb7lCmUcCvUj27yQ5CIQf1vYbLBB1Dt64mdKepdsiQW+NpltF3Wg7vXi/i+JDnjyLC0VWgMY7N/Jx9TF/VEa97Ub95g75AKvy6vcSpAEpeSsMJbcWU9rBaX58rmFbhBo0n8dqpKXSYdvY0yO3VAdVIMW2+VaJTeo6iz
          </dsig:X509Certificate>
        </dsig:X509Data>
        <dsig:KeyValue>
          <dsig:RSAKeyValue>
            <dsig:Modulus>
              mkhoaTcFbGbbwOueDZygVfnlQKmHhyBkUhPwopEEaCzKtbF3e+G7h8a6QPtO4ZtoSUOsZlUA9W+5wy4brWlbzKrVyqEbp6ywogsuBPajFGNJ8F9jmjjHxPWGe7wpuADuX6E7hIJBMbA4wnYYsXYUva4zfAZa+TohbZugKDbiT5SbZLUjfkFtDGJPmOACOlixf56/7NgrINiPARqyYvYb+uatf5lmk9XCySSQ+nTqZIxWxneseEfyo30ZwYg1GwaahNJPdOvgWr7C/U2YoPkgGkl7QkpWMLjjGjxxPYUSYIT1zE9UIn0sCnTppVGj/MwwslKJgu0d9oCFzSuqQUKjHQ==
            </dsig:Modulus>
            <dsig:Exponent>AQAB</dsig:Exponent>
          </dsig:RSAKeyValue>
        </dsig:KeyValue>
      </dsig:KeyInfo>
    </dsig:Signature>
    <saml:Subject>
      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">mizozobu</saml:NameID>
      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <saml:SubjectConfirmationData InResponseTo="_92a1e9b60a219ce61bdf" NotOnOrAfter="2019-05-21T07:55:39.502Z"
          Recipient="http://localhost:3000/passport/saml/callback" />
      </saml:SubjectConfirmation>
    </saml:Subject>
    <saml:Conditions NotBefore="2019-05-21T07:50:39.502Z" NotOnOrAfter="2019-05-21T07:51:39.502Z">
      <saml:AudienceRestriction>
        <saml:Audience>localhost:3000</saml:Audience>
      </saml:AudienceRestriction>
    </saml:Conditions>
    <saml:AuthnStatement AuthnInstant="2019-05-21T07:50:41.510Z"
      SessionIndex="ddd6a21e-69eb-42e3-b907-b297c871ed9c::b554f081-abfb-4a40-8800-a9dc47340d83">
      <saml:AuthnContext>
        <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
      </saml:AuthnContext>
    </saml:AuthnStatement>
    <saml:AttributeStatement>
      <saml:Attribute FriendlyName="email" Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">sou@weseek.co.jp
        </saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute FriendlyName="username" Name="username"
        NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">mizozobu</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute FriendlyName="id" Name="id" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">
          56c3f5b1-6e00-46fb-a568-bf28b0a38189</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">uma_authorization
        </saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">view-profile</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">no_one</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">offline_access
        </saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">manage-account-links
        </saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
        <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">manage-account
        </saml:AttributeValue>
      </saml:Attribute>
    </saml:AttributeStatement>
  </saml:Assertion>
</samlp:Response>
```

---

## Page Navigation

- Canonical URL: https://dev.growi.org/資料/内部仕様/SAML%20RoleとGrowiの権限の連携
- Permalink: https://dev.growi.org/5d25e82feeb1f9003ee9b64c
- Parent: [内部仕様](/5cc1c93a973c65003eeca8c9.md)
- Children: 0 total
- Total descendants: 0
- Siblings: 48 total
  - [AWS・メーラー周りの改善](/5d02003202145d003e1babf6.md)
  - [Audit Log Bulk Export](/68b96f7fcde220ddd8dad822.md)
  - [ConfigManager](/5cc9975f30890b003fe90935.md)
  - [ElasticSearchのインデックスリビルド](/5e3ff13564387500480619a1.md)
  - [Elasticsearchから取得できるPagesに関するデータ](/614aad9c0043a10051e15701.md)
  - [EmojiPicker](/6333fb298e520dbb752dc0cd.md)
  - [EventEmitterの利用](/61391728d5f8360051fd4942.md)
  - [G2G Transfer](/6346a2e0e4791185c5e88285.md)
  - [GROWI Bot](/62a71cdfb1519362cc276234.md)
  - [HackMD連携](/5d27efd443f7f50048a78e0a.md)
  - [Handsontable統合メモ](/5cc99eac30890b003fe9093b.md)
  - [InAppNotificationにニュースを配信する](/69ab8eb7659066cd59ddb618.md)
  - [LDAPグループ同期](/646d5f73d184d74b40517c3e.md)
  - [Packagesのエラーハンドリングアーキテクチャ](/60e6727cf04bf00049b9d514.md)
  - [Page Bulk Export](/655834752aa37f82842a2034.md)
  - [PageOperation](/62010f2f16bc406c1b5e291b.md)
  - [SMTP設定に関する仕様](/5f4ef239cff9700048251c9a.md)
  - [SWR Utilities](/63735c96c29dff4657eb78ca.md)
  - [Sidebar](/5edacd0e3512890048ddc19f.md)
  - [Slack Command Handling](/60ee432f4a58890049d183cd.md)
  - [WebpackAssetsのHTMLへの注入](/5e3ee633ccdb6f0048e8c124.md)
  - [apiv3仕様](/5cf494d4aa8c91003eb0b481.md)
  - [audit-log](/62a1639c028badd4ac23f533.md)
  - [growi-database-plugin](/634784794b3568aa883bfca6.md)
  - [skipSSR](/64bf8e68a1e72e1b846d02fd.md)
  - [socket.io room 機能を使った通知設計](/6137540af2060f00510d56bb.md)
  - [v5.0.0～v7.0.15 でのRevisionデータマイグレーションバグ](/69301054963f68dfcf2b7111.md)
  - [お知らせ機能](/650d5e741647c0285cbb8a33.md)
  - [アンケート機能](/6385911e1632aa30f4dae6a4.md)
  - [インストールプロセス](/6009091dd3b38b00486b4ba5.md)
  - [インラインコメント機能](/650154e4a3498dcb94e91b36.md)
  - [ショートカットキー](/5cc1cb12973c65003eeca8cc.md)
  - [スケルトン表示ガイドライン](/62d7ca7fb18c4bec89d81a12.md)
  - [タグに関する仕様](/6171077c700078147672e3e0.md)
  - [ビルトインエディタでの同時多人数編集](/6524a63e46f2d6a2691e430a.md)
  - [ファイルアップロードのシーケンス図](/5fd8424f2271ae00481ed2e8.md)
  - [ファイルアップロード設定](/5f55a6af28951e0048d61398.md)
  - [プレゼンテーション](/63ea366fdc96eb0ef7657f53.md)
  - [ページ&ユーザーグループv5](/61b2cdd6aa330ce7d8152a4e.md)
  - [ページの子孫数](/62ac00a1c395c23b7a8c86dc.md)
  - [ページの移動・リネーム](/62149d019311629d4ecd91cf.md)
  - [ページ同時編集時のコンフリクト解消に関する仕様](/615d4a77c0ac5081f05d9d57.md)
  - [ログイン時の挙動](/63eee058c9d7133b414ba205.md)
  - [ワークフロー機能](/64e6b3d5e28cb1aa7ee4197f.md)
  - [検索v5](/61975a974027a1fa01947059.md)
  - [検索結果ページのコメント表示](/621caadad9a9f09266ad21c3.md)
  - [権限修正が可能なページのアラート](/626a263645af0b779a282145.md)
  - [空ページ](/62b2f5b3f442e6078d890a8b.md)
- Last updated: 2019-09-12T08:58:20.578Z by mizozobu
- Full page listing (all children regardless of count): https://dev.growi.org/_api/v3/page-listing/children?id=5d25e82feeb1f9003ee9b64c