Security¶

LDAP backend configuration¶

1. Enable the authentication backend using the environment variable ARCHIVEMATICA_DASHBOARD_DASHBOARD_LDAP_AUTHENTICATION. You can find more details about this environment string in the configuration document.
2. Customize the ldap_auth.py settings module as needed. Open the file to find what are the existing environment variable lookups. You can inject the configuration via the environment string or changing the settings mode manually.
3. Restart the Archivematica Dashboard.

Shibboleth backend configuration in Archivematica Dashboard¶

1. Enable the authentication backend using the environment variable SS_SHIBBOLETH_AUTHENTICATION. You can find more details about this environment string in the configuration document.
2. Customize the shibboleth_auth.py settings module as needed.
3. Restart the Archivematica Dashboard.

Shibboleth backend configuration in Storage Service¶

1. Enable the authentication backend using the environment variable SS_SHIBBOLETH_AUTHENTICATION. Assign a string value true to enable it.
2. Customize the base.py settings module as needed.
3. Restart the Storage Service.

OIDC backend configuration in Archivematica Dashboard¶

1. Enable the authentication backend using the environment variable ARCHIVEMATICA_DASHBOARD_DASHBOARD_OIDC_AUTHENTICATION. You can find more details about this environment string in the configuration document.
2. Customize the oidc_auth.py settings module as needed.
3. Restart the Archivematica Dashboard.

OIDC backend configuration in Storage Service¶

1. Enable the authentication backend using the environment variable SS_OIDC_AUTHENTICATION. Assign a string value true to enable it.
2. Customize the base.py settings module as needed.
3. Restart the Storage Service.

CAS backend configuration in Archivematica Dashboard¶

1. Enable the authentication backend using the environment variable ARCHIVEMATICA_DASHBOARD_DASHBOARD_CAS_AUTHENTICATION`. You can find more details about this environment string in the configuration document.

2. Customize the cas_auth.py settings module as needed.

3. Restart the Archivematica Dashboard.

4. Apply the database migrations with:

   sudo -u archivematica bash -c " \
       set -a -e -x
       source /etc/default/archivematica-dashboard || \
           source /etc/sysconfig/archivematica-dashboard \
               || (echo 'Environment file not found'; exit 1)
       cd /usr/share/archivematica/dashboard
       /usr/share/archivematica/virtualenvs/archivematica-dashboard/bin/python \
           manage.py migrate \
   ";
   

CAS backend configuration in Storage Service¶

1. Enable the authentication backend using the environment variable SS_CAS_AUTHENTICATION. Assign a string value true to enable it.

2. Customize the base.py settings module as needed.

3. Restart the Storage Service.

4. Apply the database migrations with:

   sudo -u archivematica bash -c " \
       set -a -e -x
       source /etc/default/archivematica-storage-service || \
           source /etc/sysconfig/archivematica-storage-service \
               || (echo 'Environment file not found'; exit 1)
       cd /usr/lib/archivematica/storage-service
       /usr/share/archivematica/virtualenvs/archivematica-storage-service/bin/python \
           manage.py migrate
   ";
   

Trusting additional CAs¶

If you are using REQUESTS_CA_BUNDLE you may want to trust additional CAs.

On CentOS:

• Copy the .crt file to /etc/pki/ca-trust/source/anchors on your CentOS machine.
• Run the update-ca-trust extract command.

The /etc/pki/tls/certs/ca-bundle.crt file is a symbolic link that refers to the consolidated output created by the update-ca-trust command.

On Ubuntu:

• Copy the .crt file to /usr/local/share/ca-certificates on your Ubuntu machine.
• Run the update-ca-certificates command.

This will create a new /etc/ssl/certs/ca-certificates.crt file.

Back to the top