django-digid-eherkenning 0.4.1

2.1 Requirements

• Python 3.7 or above

• setuptools 30.3.0 or above

• Django 2.2 or newer

2.2 Install

Install with pip:

pip install git+https://github.com/maykinmedia/python3-saml@maykin#egg=python3-saml
pip install django-digid-eherkenning

Add digid_eherkenning to the INSTALLED_APPS in your Django project’s settings. If you want to use Digid Single Logout you need to also add sessionprofile to the INSTALLED_APPS.

INSTALLED_APPS = [
    ...,
    "digid_eherkenning",
    "sessionprofile",
    ...,
]

If you want to create local users as part of the authentication flow, add the authentication backend to the settings:

AUTHENTICATION_BACKENDS = [
    ...,
    "digid_eherkenning.backends.DigiDBackend",
    ...,
]

For Digid Single Logout you need also to include sessionprofile middleware into your settings. Note that SessionProfileMiddleware should be added before SessionMiddleware.

AUTHENTICATION_BACKENDS = [
    ...,
    "sessionprofile.middleware.SessionProfileMiddleware",
    ...,
]

Finally, at the URL patterns to your root urls.py:

from django.urls import path, include


urlpatterns = [
    ...,
    path("digid/", include("digid_eherkenning.digid_urls")),
    ...,
]

2.3 Configuration

In the settings you can specify the required configuration in DIGID or EHERKENNING dictionary. This is an example of Digid settings:

DIGID = {
    "base_url": "https://sp.example.nl",  # required
    "entity_id": "sp.example.nl/digid",  # required
    "metadata_file": "/path/to/metadata",  # required
    "key_file": /path/to/key/file.key,  # required
    "cert_file": /path/to/cert/file.pem,  # required
    "service_entity_id": "https://example.digid.nl/saml/idp/metadata",  # required
    "attribute_consuming_service_index": "1",
    "service_name": "Example",
    "requested_attributes": [],
    "login_url": reverse_lazy("admin:login"),
    "session_age": 15 * 60,
    "want_assertions_encrypted": False,
    "want_assertions_signed": False,
    "signature_algorithm": "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
    "digest_algorithm": "",
    "key_passphrase": "",
    "technical_contact_person_telephone": "06123123123",
    "technical_contact_person_email": "test@test.nl",
    "organization": "Example organization",
}

Note that signature_algorithm setting is used only for requests with HTTP Redirect binding. Login request with HTTP Post binding uses http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 algorithm.

3.1 Mock login flow

For development and demonstration purposes you can swap-in a mockup Digid login flow that accepts any BSN and doesn’t require an actual DigiD metadata configuration.

In the login view username field you can enter any integer up to 9 digits (and a random password) to be used as the BSN in the authentication backend.

Swap the authentication backend for the mock version:

AUTHENTICATION_BACKENDS = [
    "digid_eherkenning.backends.mock.DigiDBackend",
]

Swap the digid url patterns for the mock version:

urlpatterns = [
    ...,
    path("digid/", include("digid_eherkenning.mock.digid_urls")),
    ...,
]

Additionally add the URLs for the mock IDP service to run in the same runserver instance:

urlpatterns = [
    ...,
    path("digid/idp/", include("digid_eherkenning.mock.idp.digid_urls")),
    ...,
]

For settings to control mock behaviour see digid_eherkenning/mock/config.py.

3.2 Generating the DigiD metadata

The metadata for DigiD can be generated with the following command:

python manage.py generate_digid_metadata \
    --want_assertions_encrypted \
    --want_assertions_signed \
    --key_file /path/test.key \
    --cert_file /path/test.certificate \
    --signature_algorithm "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" \
    --digest_algorithm "http://www.w3.org/2001/04/xmlenc#sha256" \
    --entity_id http://test-url.nl \
    --base_url http://test-url.nl \
    --service_name "Test name" \
    --service_description "Test description" \
    --attribute_consuming_service_index 9050 \
    --technical_contact_person_telephone 06123123123 \
    --technical_contact_person_email test@test.nl \
    --organization_name "Test organisation" \
    --organization_url http://test-organisation.nl \
    --slo

3.3 Generating eHerkenning/eIDAS metadata

The metadata for eHerkenning and eIDAS can be generated with the following command:

python manage.py generate_eherkenning_metadata \
    --want_assertions_encrypted \
    --want_assertions_signed \
    --key_file /path/test.key \
    --cert_file /path/test.certificate \
    --signature_algorithm "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" \
    --digest_algorithm "http://www.w3.org/2001/04/xmlenc#sha256" \
    --entity_id http://test-url.nl \
    --base_url http://test-url.nl \
    --service_name "Test name" \
    --service_description "Test description" \
    --eh_attribute_consuming_service_index 9052 \
    --eidas_attribute_consuming_service_index 9053 \
    --oin 00000001112223330000 \
    --technical_contact_person_telephone 06123123123 \
    --technical_contact_person_email test@test.nl \
    --organization_name "Test organisation" \
    --organization_url http://test-organisation.nl

For information about each option, use:

python manage.py generate_eherkenning_metadata --help

To generate the dienstcatalogus:

python manage.py generate_eherkenning_dienstcatalogus  \
    --key_file /path/test.key \
    --cert_file /path/test.certificate \
    --entity_id http://test-url.nl \
    --base_url http://test-url.nl \
    --service_name "Test name" \
    --service_description "Test description" \
    --eh_attribute_consuming_service_index 9052 \
    --eidas_attribute_consuming_service_index 9053 \
    --oin 00000001112223330000 \
    --privacy_policy http://test-url.nl/privacy \
    --makelaar_id 00000003332223330000 \
    --organization_name "Test Organisation"