Merge pull request #145 from AI-READI/orcid-github-microsoft-idp-dete…

…ction

Orcid GitHub microsoft idp detection

components/download/LicenseForm.vue

@@ -38,7 +38,7 @@ onMounted(() => {
 
 <template>
   <div>
-    <n-form-item label="Please review the entire license below. Once you have reviewed the it you will be able to accept the license.">
+    <n-form-item label="Please review the entire license below. Once you have reviewed it you will be able to accept the license.">
       <n-input
         ref="textareaRef"
         type="textarea"

pages/datasets/[datasetid]/access/login.vue

@@ -124,18 +124,17 @@ const handleLogin = async () => {
             <div v-else>
               <n-alert title="Please note:" type="info">
                 <p>
-                  On the next screen, you will have the ability to create an
-                  account for access (click on "Sign up now").
+                  On the next screen, you will authenticate for access via
+                  CILogon, a federated Identity Provider. You may use your
+                  institutional account by selecting your home institution from
+                  the drop-down list.
                 </p>
 
                 <p>
-                  When registering for access
-                  <strong
-                    >you must use your organization or institutional email
-                    address</strong
-                  >. Accounts not affiliated with a recognized entity email will
-                  be delayed and Al-READI admins will confirm your identity
-                  before granting access to the dataset.
+                  If you do not see your institution in the list of
+                  participating Identity Providers please contact the
+                  <a href="mailto:[email protected]">Data Access Committee</a
+                  >.
                 </p>
               </n-alert>
 

pages/forbiddenlogin.vue

@@ -6,39 +6,66 @@ const badIdPType = route.query.type;
 
 <template>
   <main class="flex h-full w-full flex-col items-center px-12 py-12">
-    <div class="font-dark text-5xl font-bold">403: Forbidden</div>
-
-    <p class="text-2xl font-light leading-normal md:text-3xl">
-      Thank you for your request.
-    </p>
-
-    <div v-if="badIdPType === 'adversarial'">
-      <p class="text-2xl font-light leading-normal md:text-3xl">
-        You have been directed to this page because you have authenticated using
-        an Identity Provider that is based in a country that has been designated
-        a country of concern by the US Government. At this time, we are awaiting
-        clarification from the Department of Justice on the recent executive
-        order on data sharing with countries of concern (<a
-          href="https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/"
-          >Details Here</a
-        >). Please know that we are fully committed to maximizing the impact of
-        the the data from our participants and data sharing but have been
-        advised to for clarification.
+    <div class="font-dark text-5xl font-bold">403</div>
+
+    <div class="items-left justify-left container mx-auto flex flex-col px-12">
+      <p class="text-center text-2xl font-light leading-normal md:text-3xl">
+        Thank you for your request.
       </p>
-    </div>
 
-    <div v-else>
-      <p class="text-2xl font-light leading-normal md:text-3xl">
-        The Identity Provider you have utilized has not been verified by the
-        Data Access committee to provide sufficiently secure user attestation.
+      <div
+        v-if="badIdPType === 'adversarial'"
+        class="justify-left container mx-auto px-12"
+      >
+        <p class="text-left font-light leading-normal">
+          You have been directed to this page because you have authenticated
+          using an Identity Provider that is based in a country that has been
+          designated a country of concern by the US Government. At this time, we
+          are awaiting clarification from the Department of Justice on the
+          recent
+          <a
+            href="https://www.whitehouse.gov/briefing-room/presidential-actions/2024/02/28/executive-order-on-preventing-access-to-americans-bulk-sensitive-personal-data-and-united-states-government-related-data-by-countries-of-concern/"
+            >executive order on data sharing with countries of concern</a
+          >. Please know that we are fully committed to maximizing the impact of
+          the the data from our participants and data sharing but have been
+          advised to for clarification.
+        </p>
+      </div>
+
+      <div v-else class="justify-left container mx-auto px-12">
+        <p class="justify-left text-left font-light leading-normal">
+          The Identity Provider you selected has not been verified by the
+          AI-READI Data Access committee to provide sufficient user
+          identification. If you authenticated using one of the following
+          accounts:
+        </p>
+
+        <ul
+          class="list justify-left list-inside text-left font-light leading-normal"
+        >
+          <li>ORCID</li>
+
+          <li>GitHub</li>
+
+          <li>Google</li>
+
+          <li>Amazon AWS</li>
+        </ul>
+
+        <p class="text-left font-light leading-normal">
+          You can re-attempt using a valid account from an academic instution or
+          an eduGain-affiliated Identity Provider.
+        </p>
+      </div>
+
+      <p class="mb-8 px-12 text-left">
+        If you believe you were directed here mistakenly, please contact the
+        <a href="mailto:[email protected]" class="underline"
+          >Data Access Committee</a
+        >.
       </p>
     </div>
 
-    <p class="md:text-3xl">
-      If you believe you were directed here mistakenly, please contact the
-      <a href="mailto:[email protected]">Data Access Committee</a>.
-    </p>
-
     <a href="/">
       <button
         class="focus:shadow-outline-blue inline rounded-lg border border-transparent bg-blue-600 px-4 py-2 text-sm font-medium leading-5 text-white shadow transition-colors duration-150 hover:bg-blue-700 focus:outline-none active:bg-blue-600"

server/routes/login.get.ts

@@ -117,7 +117,17 @@ function checkTokenIdPIsValid(tokenResponse: AuthenticationResult): string {
     /(\.kp\/)/, // Democratic People's Republic of Korea
     /(\.ru\/)/, // Russian Federation
   ];
-  const selfAttestationIdPPatterns = [/(sts\.windows\.net)/, /github\.com/];
+  const selfAttestationIdPPatterns = [
+    /(sts\.windows\.net)/,
+    /(github\.com)/,
+    /(orcid\.org)/,
+    /(microsoftonline\.com)/,
+    /(google\.com)/,
+    /(amazonaws\.com)/,
+    /(saml\.nelnet\.net)/,
+    /(miracosta\.fedgw\.com)/,
+    /(cirrusidentity)/,
+  ];
 
   const indexableClaims = { ...tokenResponse.idTokenClaims };
   const idpName = getStringTokenClaim(indexableClaims, "idp");