A generic user management service.
The word emeis ([e̞ˈmis]) comes from greek (εμείς) and means we.
Original RFC that led to emeis
It's important to configure the app before the first start. When running for the first time, there is a data migration, that depends on settings from the config.
emeis is a 12factor app which means that configuration is stored in environment variables. Different environment variable types are explained at django-environ.
A list of configuration options which you might need to configure to get emeis started in your environment.
SECRET_KEY: A secret key used for cryptography. This needs to be a random string of a certain length. See more.ALLOWED_HOSTS: A list of hosts/domains your service will be served from. See more.DATABASE_ENGINE: Database backend to use. See more. (default: django.db.backends.postgresql)DATABASE_HOST: Host to use when connecting to database (default: localhost)DATABASE_PORT: Port to use when connecting to database (default: 5432)DATABASE_NAME: Name of database to use (default: emeis)DATABASE_USER: Username to use when connecting to the database (default: emeis)DATABASE_PASSWORD: Password to use when connecting to databaseLANGUAGE_CODE: Language code of the default language (default: en)LANGUAGES: A list of supported languages (default: [en])Additional options you might want to configure
Emeis supports custom properties on all models via the metainfo JSON fields containing key-value pairs.
If you want to support ordering of such custom fields, add the respective keys to the EMEIS_META_FIELDS setting.
For OIDC, a customized mozilla-django-oidc is used.
Most of the settings below are documented in it's respective documentation.
OIDC_OP_USER_ENDPOINT: Url of userinfo endpoint (see spec)OIDC_VERIFY_SSL: Bool (default: true)OIDC_BEARER_TOKEN_REVALIDATION_TIME: Time in seconds before bearer token validity is verified again. For best security, token is validated on each request per default. It might be helpful though in case of slow Open ID Connect provider to cache it. It uses cache mechanism for memorizing userinfo result. Number has to be lower than access token expiration time. (default: 0)OIDC_CREATE_USER: Enables or disables automatic user creation during authentication (default: false). If set to false, users have to be created manually in emeis with the username set to the value that will be received in the OIDC_USERNAME_CLAIM.OIDC_UPDATE_USER: Enables or disables updating of the user email address based on the email claim (default: false)OIDC_USERNAME_CLAIM: Name of claim that contains the username (default: sub). This is needed for matching users from the received claims.OIDC_EMAIL_CLAIM: Name of claim that contains the email address (default: email). This is only needed if OIDC_CREATE_USER or OIDC_UPDATE_USER are trueOIDC_OP_INTROSPECT_ENDPOINT: Url of introspection endpoint (optionally needed for Client Credentials Grant)OIDC_RP_CLIENT_ID: ID of the client (optionally needed for Client Credentials Grant)OIDC_RP_CLIENT_SECRET: Secret of the client (optionally needed for Client Credentials Grant)EMEIS_OIDC_USER_FACTORY: Optional, factory function (or class) that defines
an OIDC user object. See also here: Extending EmeisCACHE_BACKEND: cache backend to use (default: django.core.cache.backends.locmem.LocMemCache)CACHE_LOCATION: location of cache to usePer default no CORS headers are set but can be configured with following options.
CORS_ORIGIN_ALLOW_ALL: If True, the whitelist will not be used and all origins will be accepted. (default: False)CORS_ORIGIN_WHITELIST: A list of origin hostnames (including the scheme and with optional port) that are authorized to make cross-site HTTP requests.LOG_LEVEL: The logging level of the console logging handler (default: INFO)ALLOW_ANONYMOUS_WRITE: If set to true, unauthenticated users are allowed to write data (default: false)Their request will also go through the permission layer and access can be restricted/denied from there.
This setting can be handy when setting up emeis or during development, when no OIDC provider is available.
This should always be false in production environments.
Requirements
After installing and configuring those, download docker-compose.yml and run the following command:
# only needs to be run once
echo UID=$UID > .env
docker-compose up -d
This will build the containers, start the services and run the database migrations. Additionally, it creates a user, scope, role and and ACL for administration based on the settings documented above
You can now access the api at http://localhost:8000/api/v1/.
Read more about extending and configuring Emeis here: Extending Emeis.
Look at our contributing guidelines to start with your first contribution.
Some notes for maintaining this project can be found in the maintainer's handbook.
FAQs
user management
We found that emeis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI confirms no security flaws were exploited in the Ultralytics supply chain attack and highlights improvements for safer package publishing.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.