Configure omniauth for SAML

.gitattributes

@@ -0,0 +1,3 @@
+# Auto detect text files and perform LF normalization
+* text=auto eol=lf
+

.gitignore

@@ -25,7 +25,7 @@ vendor/bundle
 ## PROJECT::SPECIFIC
 config/authentication.yml
 config/avalon.yml
-config/controlled_vocabulary.yml
+#config/controlled_vocabulary.yml
 config/matterhorn.yml
 config/role_map_development.yml
 config/initializers/rubyhorn.rb

Gemfile

@@ -59,6 +59,9 @@ gem 'ims-lti', '~> 1.1.13'
 gem 'net-ldap'
 gem 'omniauth-identity'
 gem 'omniauth-lti', git: "https://github.com/avalonmediasystem/omniauth-lti.git", tag: 'avalon-r4'
+gem 'omniauth-ldap'				   
+
+gem 'devise_saml_authenticatable'
 
 # Media Access & Transcoding
 gem 'active_encode', '~> 0.7.0'

Gemfile.lock

@@ -192,9 +192,9 @@ GEM
       multi_json (~> 1.11, >= 1.11.2)
       rack (>= 2.0.8, < 3)
       railties (>= 5.2.4.1)
-    activestorage (5.2.4.4)
-      actionpack (= 5.2.4.4)
-      activerecord (= 5.2.4.4)
+    activestorage (5.2.4.5)
+      actionpack (= 5.2.4.5)
+      activerecord (= 5.2.4.5)
       marcel (~> 0.3.1)
     activesupport (5.2.4.5)
       concurrent-ruby (~> 1.0, >= 1.0.2)
@@ -1482,6 +1482,11 @@ GEM
     omniauth-identity (1.1.1)
       bcrypt-ruby (~> 3.0)
       omniauth (~> 1.0)
+    omniauth-ldap (1.0.5)
+      net-ldap (~> 0.12)
+      omniauth (~> 1.0)
+      pyu-ruby-sasl (~> 0.0.3.2)
+      rubyntlm (~> 0.3.4)
     orm_adapter (0.5.0)
     os (1.0.1)
     parallel (1.17.0)
@@ -1504,6 +1509,7 @@ GEM
     public_suffix (3.0.3)
     puma (4.3.5)
       nio4r (~> 2.0)
+    pyu-ruby-sasl (0.0.3.3)
     raabro (1.3.1)
     racc (1.5.2)
     rack (2.2.3)
@@ -1674,6 +1680,7 @@ GEM
       mime-types
       nokogiri
       rest-client
+    rubyntlm (0.3.4)
     rubyzip (1.3.0)
     safe_yaml (1.0.5)
     samvera-persona (0.1.7)
@@ -1765,6 +1772,8 @@ GEM
       railties (>= 3.1)
     tzinfo (1.2.9)
       thread_safe (~> 0.1)
+    tzinfo-data (1.2022.1)
+      tzinfo (>= 1.0.0)
     uber (0.0.15)
     uglifier (4.1.20)
       execjs (>= 0.3.0, < 3)
@@ -1893,6 +1902,7 @@ DEPENDENCIES
   noid-rails (~> 3.0.1)
   okcomputer
   omniauth-identity
+  omniauth-ldap
   omniauth-lti!
   parallel
   pg
@@ -1929,6 +1939,7 @@ DEPENDENCIES
   sprockets (~> 3.7.2)
   sprockets-es6
   sqlite3
+  tzinfo-data
   uglifier (>= 1.3.0)
   wavefile (~> 1.0.1)
   web-console
@@ -1941,4 +1952,4 @@ DEPENDENCIES
   zoom
 
 BUNDLED WITH
-   2.2.11
+   2.3.17

app/assets/images/tamu/tamu.css

@@ -0,0 +1,72 @@
+#header-navbar .navbar-brand {
+    background: transparent "tamu-logo-with-bar.png" no-repeat top left;
+    background: transparent url(/assets/tamu/tamu-logo-with-bar.png) no-repeat top left;
+	margin-top: 10px;
+    margin-bottom: -10px;
+}
+
+#header-navbar .navbar-toggle, #header-navbar .facets-toggle {
+    background: #ffcf08;
+}
+
+.container > .navbar-header, .container > .navbar-collapse, .container > #facet-panel-collapse, .container > div[id*='facet-panel-'], .container-fluid > .navbar-header, .container-fluid > .navbar-collapse, .container-fluid > #facet-panel-collapse, .container-fluid > div[id*='facet-panel-'] {
+	background-color: #500000;
+}
+
+.custom-header {
+    background-color: #3c0000;
+	padding: 0px 0px 0px 0px;
+}
+
+.navbar-default {
+	background: #500000;
+    border-top: 1px solid #8d8d8d;
+}
+
+.navbar-right {
+    background: #3c0000;
+}
+
+.navbar-title {
+	background: #3c0000;
+    color: white;
+}
+
+.header-wrapper .header-logo > a:hover {
+    text-decoration: none;
+}
+
+#footer.homepage-footer {
+	background: #3c0000;
+    padding: 0px 0px 0px 0px;
+}
+
+.navbar-nav > li > a:hover, .navbar-default .navbar-nav > li > a:focus {
+    color: #500000;
+    background-color: #ffcf08;
+}
+
+.navbar-default .navbar-nav > li > a {
+    color: white;
+}	
+
+.navbar-default .navbar-nav > li > a:hover, .navbar-default .navbar-nav > li > a:focus {
+    color: #500000;
+    background-color: #ffcf08;
+}
+
+.navbar-default .navbar-nav > .active > a, .navbar-default .navbar-nav > .active > a:hover, .navbar-default .navbar-nav > .active > a:focus {
+    color: #333333;
+}
+
+.btn-primary {
+    color: white;
+    background-color: #500000;
+    border-color: #500000;
+}
+
+.btn-primary:hover {
+    color: white;
+    background-color: #3c0000;
+    border-color: #3c0000;
+}

app/controllers/application_controller.rb

@@ -151,7 +151,8 @@ def time_str_to_milliseconds(value)
   def current_ability
     session_opts ||= user_session
     session_opts ||= {}
-    @current_ability ||= Ability.new(current_user, session_opts.merge(remote_ip: request.remote_ip))
+	@current_ability ||= Ability.new(current_user, session_opts.merge(remote_ip: request.env['HTTP_X_REAL_IP']))
+#    @current_ability ||= Ability.new(current_user, session_opts.merge(remote_ip: request.remote_ip))
   end
 
   rescue_from CanCan::AccessDenied do |exception|

app/helpers/application_helper.rb

@@ -19,7 +19,7 @@ def application_name
   end
 
   def release_text
-    "#{application_name} #{t(:release_label)} #{Avalon::VERSION}"
+    "#{Avalon::VERSION}"
   end
 
   def share_link_for(obj, only_path: false)

app/models/user.rb

@@ -26,7 +26,7 @@ class User < ActiveRecord::Base
   # Include default devise modules. Others available are:
   # :confirmable, :lockable, :timeoutable
   # Registration is controlled via settings.yml
-  devise_list = [ :database_authenticatable, :invitable, :omniauthable,
+  devise_list = [ :saml_authenticatable, :invitable, :omniauthable,
                   :recoverable, :rememberable, :trackable, :validatable ]
   devise_list << :registerable if Settings.auth.registerable
   devise_list << { authentication_keys: [:login] }

app/views/_user_util_links.html.erb

@@ -79,10 +79,7 @@ Unless required by applicable law or agreed to in writing, software distributed
   <% end %>
 
   <li class="divider desktop-hidden" />
-  <%= link_to_if user_signed_in?, 'Sign out', main_app.destroy_user_session_path do %>
-  <%# Fallback if the test above fails %>
-  <%= link_to 'Sign in', main_app.new_user_session_path %>
-  <% end %>
+
   <% unless current_page?(main_app.root_path) %>
   <li class="desktop-hidden"><%= render :partial=>'modules/avalon_search_form' %></li>
   <% end %>

app/views/catalog/index.html.erb

@@ -20,13 +20,13 @@ Unless required by applicable law or agreed to in writing, software distributed
       <%= render :partial=>'modules/avalon_search_form' %>
     </div>
 
-    <div class="homepage-splash-lead-copy">
+<!--    <div class="homepage-splash-lead-copy">
       <div class="container">
         <p class="lead">Avalon Media System is an open source system for managing and providing access to large
           collections of
           digital audio and video.</p>
       </div>
-    </div>
+    </div> -->
   </section>
 
   <% if @featured_collection.present? %>

app/views/modules/_footer.html.erb

@@ -13,19 +13,21 @@ Unless required by applicable law or agreed to in writing, software distributed
   specific language governing permissions and limitations under the License.
 ---  END LICENSE_HEADER BLOCK  ---
 %>
-<div id="footer" class="<%= "homepage-footer" if current_page?(main_app.root_path) %>">
+
+<div id="footer" class="homepage-footer">
 
   <footer class="container">
     <div class="separator"></div>
     <ul>
-      <li class="footer-logo">
-        <%= image_tag "AvalonMediaSystem_Logo_A.png", alt: "Avalon Media System - #{t(:release_label)} #{Avalon::VERSION}" %>
-      <li><a href="http://www.avalonmediasystem.org">Avalon Media System Project Website</a> </li>
-      <li><%= link_to "Contact Us", main_app.comments_path %></li>
+
+		<li><a href="https://howdy.tamu.edu">howdy.tamu.edu</a></li>
+		<li><a href="https://library.tamu.edu/services/tech_troubleshooting.html">Off-Campus Access</a></li>
+		<li><a href="https://www.tamu.edu">Texas A&amp;M University</a></li>
+		<li><a href="https://library.tamu.edu/about/compliance.html">Site Policies</a></li>
+		<li><a href="https://askus.library.tamu.edu/contact/index">Comments</a></li>
+		<li><a href="https://library.tamu.edu/status/">Services Status</a></li>
+		<li><%= render 'modules/user_management' %></li>
+
     </ul>
-    <div class="release">
-      <%=release_text%>
-      <%= git_commit_info(" (%s %s [%s])") if Rails.env == 'development' %>
-    </div>
   </footer>
 </div>

app/views/modules/_header.html.erb

@@ -13,25 +13,27 @@ Unless required by applicable law or agreed to in writing, software distributed
   specific language governing permissions and limitations under the License.
 ---  END LICENSE_HEADER BLOCK  ---
 %>
+<link rel="stylesheet" media="all" href="/assets/tamu/tamu.css" />
 <div class="custom-header">
   <div class="container">
     <header class="header-wrapper">
       <div class="header-logo">
         <%= link_to main_app.root_path do %>
-        <%= image_tag "Home.png", class: "img-responvies", alt: "Avalon Media System - #{t(:release_label)} #{Avalon::VERSION}" %>
+        <%= image_tag "tamu/tamu-logo-with-bar.png", class: "img-responvies", alt: "Texas A&amp;M University Libraries Logo" %>
+		<span class="navbar-title">Texas A&amp;M University Libraries - Audio & Video Repository</span> 
         <% end %>
       </div>
 
-      <% unless current_page?(main_app.root_path) %>
-      <div class="header-search">
-        <%= render :partial=>'modules/avalon_search_form' %>
-      </div>
-      <% end %>
+	  <div>
+		<div class="navbar-default navbar-right">
+			<ul class="nav navbar-nav">
+				<li>
+					<a href="http://askus.library.tamu.edu">Help</a>
+				</li>
+			</ul>
+		</div>
+	  </div>
 
-      <%# By default shift log in / log out to the header %>
-      <div class="text-right log-in-out text-muted header-user">
-        <%= render 'modules/user_management' %>
-      </div>
     </header>
   </div>
 </div>

app/views/modules/_user_management.html.erb

@@ -15,7 +15,12 @@ Unless required by applicable law or agreed to in writing, software distributed
 %>
 <%# The containers for the links need to be defined by the calling partial %>
 <% if user_signed_in? %>
-<%= user_key %> | <%= link_to t('auth.sign_out'), main_app.destroy_user_session_path %>
+
+<% if defined?(current_user) %>
+	<%= current_user.email %> 
+<% end %>
+
+| <%= link_to t('auth.sign_out'), main_app.destroy_user_session_path %>
 <% else %>
-<%= link_to t('auth.sign_in'), main_app.new_user_session_path, :class => "btn btn-info" %>
+<%= link_to t('auth.sign_in'), main_app.new_user_session_path, :class => "tamu-btn tamu-btn-info" %>
 <% end %>

config/attribute-map.yml

@@ -0,0 +1,3 @@
+# attribute-map.yml
+"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "user_name"
+"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "email"

config/controlled_vocabulary.yml

@@ -0,0 +1,40 @@
+units:
+  - Collections
+  - Default Unit
+  - Digital Initiatives   
+  - Graduate Student Research  
+  - LAUNCH
+  - Oaktrust
+  - University Libraries
+identifier_types:
+  local: Catalog Key
+  oclc: OCLC
+  lccn: LCCN
+  issue number: Issue Number
+  matrix number: Matrix Number
+  music publisher: Music Publisher/Label
+  videorecording identifier: Videorecording Identifier
+  other: Other
+note_types:
+  general: General Note
+  awards: Awards
+  biographical/historical: Bibliographical/Historical Note
+  creation/production credits: Creation/Production Credits
+  language: Language Note
+  local: Local Note
+  performers: Performers
+  statement of responsibility: Statement of Responsibility
+  venue: Venue/Event Date
+rights_statements:
+  http://rightsstatements.org/vocab/InC/1.0/: In Copyright
+  http://rightsstatements.org/vocab/InC-OW-EU/1.0/: In Copyright - EU Orphan Work
+  http://rightsstatements.org/vocab/InC-EDU/1.0/: In Copyright - Educational Use Permitted
+  http://rightsstatements.org/vocab/InC-NC/1.0/: In Copyright - Non-Commercial Use Permitted
+  http://rightsstatements.org/vocab/InC-RUU/1.0/: In Copyright - Rights-Holders Unlocatable or Unidentifiable
+  http://rightsstatements.org/vocab/NoC-CR/1.0/: No Copyright - Contractual Restrictions
+  http://rightsstatements.org/vocab/NoC-NC/1.0/: No Copyright - Non-Commercial Use Only
+  http://rightsstatements.org/vocab/NoC-OKLR/1.0/: No Copyright - Other Known Legal Restrictions
+  http://rightsstatements.org/vocab/NoC-US/1.0/: No Copyright - United States
+  http://rightsstatements.org/vocab/CNE/1.0/: Copyright Not Evaluated
+  http://rightsstatements.org/vocab/UND/1.0/: Copyright Undetermined
+  http://rightsstatements.org/vocab/NKC/1.0/: No Known Copyright

config/database.yml

@@ -4,9 +4,12 @@
 #   Ensure the SQLite 3 gem is defined in your Gemfile
 #   gem 'sqlite3'
 #
+
+# Increase the default pool size for large jobs.
+# DCH
 default: &default
   adapter: sqlite3
-  pool: 10
+  pool: 40
   timeout: 10000
 
 development:
@@ -21,7 +24,10 @@ test:
   pool: 20
   database: db/test.sqlite3
 
+
+# Increase the default pool size for large jobs.
+# DCH
 production:
   <<: *default
-  pool: 20
+  pool: 40
   database: db/production.sqlite3

config/docker_schedule.rb

@@ -0,0 +1,15 @@
+set :output, "log/whenever_cron.log"
+job_type :locking_rake, "source /etc/profile.d/container_environment.sh && cd :path && :environment_variable=:environment script/locking_runner :lock_name bundle exec rake :task --silent :output"
+job_type :locking_runner, "source /etc/profile.d/container_environment.sh && cd :path && :environment_variable=:environment script/locking_runner :lock_name :task :output"
+
+every 1.minute do
+  locking_rake "avalon:batch:ingest", :lock_name => "batch_ingest", :environment => ENV['RAILS_ENV'] || 'production'
+end
+
+every 15.minutes do
+  locking_rake "avalon:batch:ingest_status_check", :lock_name => "batch_ingest", :environment => ENV['RAILS_ENV'] || 'production'
+end
+
+every 1.day do
+  locking_rake "avalon:batch:ingest_stalled_check", :lock_name => "batch_ingest", :environment => ENV['RAILS_ENV'] || 'production'
+end