django-digid-eherkenning 0.3.1

2.1 Requirements

• Python 3.7 or above

• setuptools 30.3.0 or above

• Django 2.2 or newer

2.2 Install

Install with pip:

pip install git+https://github.com/maykinmedia/python3-saml@maykin#egg=python3-saml
pip install django-digid-eherkenning

Add digid_eherkenning to the INSTALLED_APPS in your Django project’s settings:

INSTALLED_APPS = [
    ...,
    "digid_eherkenning",
    ...,
]

If you want to create local users as part of the authentication flow, add the authentication backend to the settings:

AUTHENTICATION_BACKENDS = [
    ...,
    "digid_eherkenning.backends.DigiDBackend",
    ...,
]

Finally, at the URL patterns to your root urls.py:

from django.urls import path, include


urlpatterns = [
    ...,
    path("digid/", include("digid_eherkenning.digid_urls")),
    ...,
]

3.1 Mock login flow

For development and demonstration purposes you can swap-in a mockup Digid login flow that accepts any BSN and doesn’t require an actual DigiD metadata configuration.

In the login view username field you can enter any integer up to 9 digits (and a random password) to be used as the BSN in the authentication backend.

Swap the authentication backend for the mock version:

AUTHENTICATION_BACKENDS = [
    "digid_eherkenning.backends.mock.DigiDBackend",
]

Swap the digid url patterns for the mock version:

urlpatterns = [
    ...,
    path("digid/", include("digid_eherkenning.mock.digid_urls")),
    ...,
]

Additionally add the URLs for the mock IDP service to run in the same runserver instance:

urlpatterns = [
    ...,
    path("digid/idp/", include("digid_eherkenning.mock.idp.digid_urls")),
    ...,
]

For settings to control mock behaviour see digid_eherkenning/mock/config.py.

3.2 Generating the DigiD metadata

The metadata for DigiD can be generated with the following command:

python manage.py generate_digid_metadata \
    --want_assertions_encrypted \
    --want_assertions_signed \
    --key_file /path/test.key \
    --cert_file /path/test.certificate \
    --signature_algorithm "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" \
    --digest_algorithm "http://www.w3.org/2001/04/xmlenc#sha256" \
    --entity_id http://test-url.nl \
    --base_url http://test-url.nl \
    --service_name "Test name" \
    --service_description "Test description" \
    --attribute_consuming_service_index 9050 \
    --technical_contact_person_telephone 06123123123 \
    --technical_contact_person_email test@test.nl \
    --organization_name "Test organisation" \
    --organization_url http://test-organisation.nl

3.3 Generating eHerkenning/eIDAS metadata

The metadata for eHerkenning and eIDAS can be generated with the following command:

python manage.py generate_eherkenning_metadata \
    --want_assertions_encrypted \
    --want_assertions_signed \
    --key_file /path/test.key \
    --cert_file /path/test.certificate \
    --signature_algorithm "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" \
    --digest_algorithm "http://www.w3.org/2001/04/xmlenc#sha256" \
    --entity_id http://test-url.nl \
    --base_url http://test-url.nl \
    --service_name "Test name" \
    --service_description "Test description" \
    --eh_attribute_consuming_service_index 9052 \
    --eidas_attribute_consuming_service_index 9053 \
    --oin 00000001112223330000 \
    --technical_contact_person_telephone 06123123123 \
    --technical_contact_person_email test@test.nl \
    --organization_name "Test organisation" \
    --organization_url http://test-organisation.nl

For information about each option, use:

python manage.py generate_eherkenning_metadata --help

To generate the dienstcatalogus:

python manage.py generate_eherkenning_dienstcatalogus  \
    --key_file /path/test.key \
    --cert_file /path/test.certificate \
    --entity_id http://test-url.nl \
    --base_url http://test-url.nl \
    --service_name "Test name" \
    --service_description "Test description" \
    --eh_attribute_consuming_service_index 9052 \
    --eidas_attribute_consuming_service_index 9053 \
    --oin 00000001112223330000 \
    --privacy_policy http://test-url.nl/privacy \
    --makelaar_id 00000003332223330000 \
    --organization_name "Test Organisation"