Remove defunct custos auth provider

nuwang · nuwang · commit c0a0e4eb0ffa · 2025-10-16T23:17:54.000+05:30
diff --git a/client/src/components/Login/LoginForm.test.ts b/client/src/components/Login/LoginForm.test.ts
@@ -42,7 +42,7 @@ describe("LoginForm", () => {
         axiosMock = new MockAdapter(axios);
         server.use(
             http.get("/api/configuration", ({ response }) => {
-                return response.untyped(HttpResponse.json({ oidc: { cilogon: false, custos: false } }));
+                return response.untyped(HttpResponse.json({ oidc: { cilogon: false } }));
             }),
         );
     });
diff --git a/client/src/components/Register/RegisterForm.vue b/client/src/components/Register/RegisterForm.vue
@@ -32,7 +32,7 @@ interface Props {
     enableOidc?: boolean;
     mailingJoinAddr?: string;
     oidcIdps?: OIDCConfig;
-    preferCustosLogin?: boolean;
+    preferOIDCLogin?: boolean;
     redirect?: string;
     registrationWarningMessage?: string;
     serverMailConfigured?: boolean;
@@ -58,8 +58,8 @@ const labelSubscribe = ref(localize("Stay in the loop and join the galaxy-announ
 
 const idpsWithRegistration = computed(() => (props.oidcIdps ? getOIDCIdpsWithRegistration(props.oidcIdps) : {}));
 
-const custosPreferred = computed(() => {
-    return props.enableOidc && props.preferCustosLogin;
+const oidcPreferred = computed(() => {
+    return props.enableOidc && props.preferOIDCLogin;
 });
 
 /** This decides if all register options should be displayed in column style
@@ -107,30 +107,30 @@ async function submit() {
 
                 <BForm id="registration" @submit.prevent="submit()">
                     <BCard no-body>
-                        <!-- OIDC and Custos enabled and prioritized: encourage users to use it instead of local registration -->
-                        <span v-if="custosPreferred">
+                        <!-- OIDC enabled and prioritized: encourage users to use it instead of local registration -->
+                        <span v-if="oidcPreferred">
                             <BCardHeader v-b-toggle.accordion-oidc role="button">
                                 Register using institutional account
                             </BCardHeader>
 
                             <BCollapse id="accordion-oidc" visible role="tabpanel" accordion="registration_acc">
                                 <BCardBody>
                                     Create a Galaxy account using an institutional account (e.g.:Google/JHU). This will
-                                    redirect you to your institutional login through Custos.
+                                    redirect you to your institutional login through OIDC.
                                     <ExternalLogin class="mt-2" />
                                 </BCardBody>
                             </BCollapse>
                         </span>
 
                         <!-- Local Galaxy Registration -->
-                        <BCardHeader v-if="!custosPreferred" v-localize>Create a Galaxy account</BCardHeader>
+                        <BCardHeader v-if="!oidcPreferred" v-localize>Create a Galaxy account</BCardHeader>
                         <BCardHeader v-else v-localize v-b-toggle.accordion-register role="button">
                             Or, register with email
                         </BCardHeader>
 
                         <BCollapse
                             id="accordion-register"
-                            :visible="!custosPreferred"
+                            :visible="!oidcPreferred"
                             role="tabpanel"
                             accordion="registration_acc">
                             <BCardBody :class="{ 'd-flex w-100': !registerColumnDisplay }">
diff --git a/client/src/components/User/ExternalIdentities/ExternalIDHelper.ts b/client/src/components/User/ExternalIdentities/ExternalIDHelper.ts
@@ -26,7 +26,7 @@ export type OIDCConfigWithRegistration = Record<
 
 /** Return the per-IDP config, minus anything the caller wants to hide. */
 export function getFilteredOIDCIdps(oidcConfig: OIDCConfig, exclude: string[] = []): OIDCConfig {
-    const blacklist = new Set(["cilogon", "custos", ...exclude]);
+    const blacklist = new Set(["cilogon", ...exclude]);
     const filtered: OIDCConfig = {};
     Object.entries(oidcConfig).forEach(([idp, cfg]) => {
         if (!blacklist.has(idp)) {
@@ -51,11 +51,11 @@ export function getOIDCIdpsWithRegistration(oidcConfig: OIDCConfig): OIDCConfigW
 
 /** Do we need to show the institution picker at all? */
 export const getNeedShowCilogonInstitutionList = (cfg: OIDCConfig): boolean => {
-    return Boolean(cfg.cilogon || cfg.custos);
+    return Boolean(cfg.cilogon);
 };
 
 /**
- * Generic OIDC login (all providers *except* CILogon/Custos).
+ * Generic OIDC login (all providers *except* CILogon).
  * Returns the redirect URI Galaxy gives back, or throws.
  */
 export async function submitOIDCLogon(idp: string, redirectParam: string | null = null): Promise<string | null> {
@@ -73,8 +73,8 @@ export async function submitOIDCLogon(idp: string, redirectParam: string | null
 }
 
 /**
- * CILogon/Custos login.
- * @param idp        "cilogon" | "custos"
+ * CILogon login.
+ * @param idp        "cilogon"
  * @param useIDPHint If true, append ?idphint=
  * @param idpHint    The entityID to hint with (ignored when useIDPHint = false)
  */
@@ -108,7 +108,7 @@ export async function redirectToSingleProvider(config: OIDCConfig): Promise<stri
         throw new Error("OIDC provider key is undefined.");
     }
 
-    if (idp === "cilogon" || idp === "custos") {
+    if (idp === "cilogon") {
         const redirectUri = await submitCILogon(idp, false);
         return redirectUri;
     } else {
diff --git a/client/src/components/User/ExternalIdentities/ExternalIdentities.vue b/client/src/components/User/ExternalIdentities/ExternalIdentities.vue
@@ -121,7 +121,7 @@ export default {
             doomedItem: null,
             errorMessage: null,
             enable_oidc: galaxy.config.enable_oidc,
-            cilogonOrCustos: null,
+            cilogonOrOIDC: null,
             userEmail: galaxy.user.get("email"),
         };
     },
diff --git a/client/src/components/User/ExternalIdentities/ExternalLogin.vue b/client/src/components/User/ExternalIdentities/ExternalLogin.vue
@@ -50,7 +50,7 @@ const messageVariant = ref<string | null>(null);
 const cILogonIdps = ref<Idp[]>([]);
 const selected = ref<Idp | null>(null);
 const rememberIdp = ref(false);
-const cilogonOrCustos = ref<"cilogon" | "custos" | null>(null);
+const cilogon = ref<"cilogon" | null>(null);
 const toggleCilogon = ref(false);
 
 const oIDCIdps = computed<OIDCConfig>(() => (isConfigLoaded.value ? config.value.oidc : {}));
@@ -60,22 +60,21 @@ const filteredOIDCIdps = computed(() => getFilteredOIDCIdps(oIDCIdps.value, prop
 const cilogonListShow = computed(() => getNeedShowCilogonInstitutionList(oIDCIdps.value));
 
 const cILogonEnabled = computed(() => oIDCIdps.value.cilogon);
-const custosEnabled = computed(() => oIDCIdps.value.custos);
 
 onMounted(async () => {
     rememberIdp.value = getIdpPreference() !== null;
 
-    // Only fetch CILogonIDPs if custos/cilogon configured
+    // Only fetch CILogonIDPs if cilogon configured
     if (cilogonListShow.value) {
         await getCILogonIdps();
     }
 });
 
-function toggleCILogon(idp: "cilogon" | "custos") {
-    if (cilogonOrCustos.value === idp || cilogonOrCustos.value === null) {
+function toggleCILogon(idp: "cilogon") {
+    if (cilogon.value === idp || cilogon.value === null) {
         toggleCilogon.value = !toggleCilogon.value;
     }
-    cilogonOrCustos.value = toggleCilogon.value ? idp : null;
+    cilogon.value = toggleCilogon.value ? idp : null;
 }
 
 async function clickOIDCLogin(idp: string) {
@@ -186,7 +185,7 @@ function getIdpPreference() {
             <!-- OIDC login-->
             <BForm v-if="cilogonListShow" id="externalLogin" class="cilogon">
                 <div v-if="props.loginPage">
-                    <!--Only Display if CILogon/Custos is configured-->
+                    <!--Only Display if CILogon is configured-->
                     <BFormGroup label="Use existing institutional login">
                         <Multiselect
                             v-model="selected"
@@ -212,31 +211,18 @@ function getIdpPreference() {
                         <LoadingSpan v-if="loading" message="Signing In" />
                         <span v-else>Sign in with Institutional Credentials*</span>
                     </GButton>
-                    <!--convert to v-else-if to allow only one or the other. if both enabled, put the one that should be default first-->
-                    <GButton
-                        v-if="Object.prototype.hasOwnProperty.call(oIDCIdps, 'custos')"
-                        :disabled="loading || selected === null"
-                        @click="clickCILogin('custos')">
-                        <LoadingSpan v-if="loading" message="Signing In" />
-                        <span v-else>Sign in with Custos*</span>
-                    </GButton>
+
                 </div>
 
                 <div v-else>
                     <GButtonGroup class="w-100">
                         <GButton
                             v-if="cILogonEnabled"
-                            :pressed="cilogonOrCustos === 'cilogon'"
+                            :pressed="cilogon === 'cilogon'"
                             @click="toggleCILogon('cilogon')">
                             Sign in with Institutional Credentials*
                         </GButton>
 
-                        <GButton
-                            v-if="custosEnabled"
-                            :pressed="cilogonOrCustos === 'custos'"
-                            @click="toggleCILogon('custos')">
-                            Sign in with Custos*
-                        </GButton>
                     </GButtonGroup>
 
                     <BFormGroup v-if="toggleCilogon" class="mt-1">
@@ -254,18 +240,18 @@ function getIdpPreference() {
                             v-if="toggleCilogon"
                             class="mt-1"
                             :disabled="loading || selected === null"
-                            @click="clickCILogin(cilogonOrCustos)">
-                            Login via {{ cilogonOrCustos === "cilogon" ? "CILogon" : "Custos" }} *
+                            @click="clickCILogin(cilogon)">
+                            Login via CILogon *
                         </GButton>
                     </BFormGroup>
                 </div>
 
                 <p class="mt-3">
                     <small class="text-muted">
-                        * Galaxy uses CILogon via Custos to enable you to log in from this organization. By clicking
+                        * Galaxy uses CILogon to enable you to log in from this organization. By clicking
                         'Sign In', you agree to the
                         <a href="https://ca.cilogon.org/policy/privacy">CILogon</a> privacy policy and you agree to
-                        share your username, email address, and affiliation with CILogon, Custos, and Galaxy.
+                        share your username, email address, and affiliation with CILogon and Galaxy.
                     </small>
                 </p>
             </BForm>
diff --git a/client/src/components/User/ExternalIdentities/service.js b/client/src/components/User/ExternalIdentities/service.js
@@ -6,7 +6,7 @@ const getUrl = (path) => getRootFromIndexLink() + path;
 export async function disconnectIdentity(doomed) {
     if (doomed) {
         let url;
-        if (doomed.provider === "custos" || doomed.provider === "cilogon") {
+        if (doomed.provider === "cilogon") {
             url = getUrl(`authnz/${doomed.provider}/disconnect/${doomed.email}`);
         } else {
             url = getUrl(`authnz/${doomed.provider}/disconnect/`);
diff --git a/client/src/entry/analysis/modules/Login.test.ts b/client/src/entry/analysis/modules/Login.test.ts
@@ -13,7 +13,7 @@ const configMock = {
     allow_local_account_creation: true,
     enable_oidc: true,
     mailing_join_addr: "mailing_join_addr",
-    prefer_custos_login: true,
+    prefer_oidc_login: true,
     registration_warning_message: "registration_warning_message",
     server_mail_configured: true,
     show_welcome_with_login: true,
diff --git a/client/src/entry/analysis/modules/Register.test.ts b/client/src/entry/analysis/modules/Register.test.ts
@@ -13,7 +13,7 @@ const configMock = {
     allow_local_account_creation: true,
     enable_oidc: true,
     mailing_join_addr: "mailing_join_addr",
-    prefer_custos_login: true,
+    prefer_oidc_login: true,
     registration_warning_message: "registration_warning_message",
     server_mail_configured: true,
     show_welcome_with_login: true,
@@ -61,7 +61,7 @@ describe("Register", () => {
         expect(props.sessionCsrfToken).toBe("session_csrf_token");
         expect(props.enableOidc).toBe(true);
         expect(props.mailingJoinAddr).toBe("mailing_join_addr");
-        expect(props.preferCustosLogin).toBe(true);
+        expect(props.preferOIDCLogin).toBe(true);
         expect(props.serverMailConfigured).toBe(true);
         expect(props.registrationWarningMessage).toBe("registration_warning_message");
         expect(props.termsUrl).toBe("terms_url");
diff --git a/client/src/entry/analysis/modules/Register.vue b/client/src/entry/analysis/modules/Register.vue
@@ -21,7 +21,7 @@ const sessionCsrfToken = computed(() => {
             :enable-oidc="config.enable_oidc"
             :mailing-join-addr="config.mailing_join_addr"
             :oidc-idps="config.oidc"
-            :prefer-custos-login="config.prefer_custos_login"
+            :prefer-oidc-login="config.prefer_oidc_login"
             :registration-warning-message="config.registration_warning_message"
             :server-mail-configured="config.server_mail_configured"
             :session-csrf-token="sessionCsrfToken"
diff --git a/doc/source/admin/galaxy_options.rst b/doc/source/admin/galaxy_options.rst
@@ -3818,11 +3818,11 @@
 
 
 ~~~~~~~~~~~~~~~~~~~~~~~
-``prefer_custos_login``
+``prefer_oidc_login``
 ~~~~~~~~~~~~~~~~~~~~~~~
 
 :Description:
-    Controls the order of the login page to prefer Custos-based login
+    Controls the order of the login page to prefer OIDC-based login
     and registration.
 :Default: ``false``
 :Type: bool
diff --git a/doc/source/lib/galaxy.authnz.rst b/doc/source/lib/galaxy.authnz.rst
@@ -9,14 +9,6 @@ galaxy.authnz package
 Submodules
 ----------
 
-galaxy.authnz.custos\_authnz module
------------------------------------
-
-.. automodule:: galaxy.authnz.custos_authnz
-   :members:
-   :undoc-members:
-   :show-inheritance:
-
 galaxy.authnz.managers module
 -----------------------------
 
diff --git a/doc/source/releases/22.05_announce.rst b/doc/source/releases/22.05_announce.rst
@@ -67,7 +67,7 @@ config/galaxy.yml.sample:galaxy
 -  mapping.galaxy.mapping.log_destination
 -  mapping.galaxy.mapping.log_rotate_count
 -  mapping.galaxy.mapping.log_rotate_size
--  mapping.galaxy.mapping.prefer_custos_login
+-  mapping.galaxy.mapping.prefer_oidc_login
 -  mapping.galaxy.mapping.short_term_storage_cleanup_interval
 -  mapping.galaxy.mapping.short_term_storage_default_duration
 -  mapping.galaxy.mapping.short_term_storage_dir
diff --git a/lib/galaxy/authnz/custos_authnz.py b/lib/galaxy/authnz/custos_authnz.py
@@ -40,7 +40,7 @@
 STATE_COOKIE_NAME = "galaxy-oidc-state"
 NONCE_COOKIE_NAME = "galaxy-oidc-nonce"
 VERIFIER_COOKIE_NAME = "galaxy-oidc-verifier"
-KEYCLOAK_BACKENDS = {"custos", "cilogon", "keycloak"}
+KEYCLOAK_BACKENDS = {"cilogon", "keycloak"}
 
 
 class InvalidAuthnzConfigException(Exception):
@@ -84,7 +84,7 @@ def __init__(self, provider, oidc_config, oidc_backend_config, idphint=None):
             label=oidc_backend_config.get("label", provider.capitalize()),
             client_id=oidc_backend_config["client_id"],
             client_secret=oidc_backend_config["client_secret"],
-            require_create_confirmation=oidc_backend_config.get("require_create_confirmation", provider == "custos"),
+            require_create_confirmation=oidc_backend_config.get("require_create_confirmation", False),
             redirect_uri=oidc_backend_config["redirect_uri"],
             ca_bundle=oidc_backend_config.get("ca_bundle", None),
             pkce_support=oidc_backend_config.get("pkce_support", False),
@@ -604,9 +604,7 @@ def GetCustosBasedAuthProvider(provider, oidc_config, oidc_backend_config, idphi
                 return item.item
 
         auth_adapter: OIDCAuthnzBase
-        if provider.lower() == "custos":
-            auth_adapter = OIDCAuthnzBaseCustos(provider, oidc_config, oidc_backend_config, idphint)
-        elif provider.lower() == "keycloak":
+        if provider.lower() == "keycloak":
             auth_adapter = OIDCAuthnzBaseKeycloak(provider, oidc_config, oidc_backend_config, idphint)
         elif provider.lower() == "cilogon":
             auth_adapter = OIDCAuthnzBaseCiLogon(provider, oidc_config, oidc_backend_config, idphint)
@@ -626,36 +624,3 @@ def GetCustosBasedAuthProvider(provider, oidc_config, oidc_backend_config, idphi
             )
 
         return auth_adapter
-
-
-class OIDCAuthnzBaseCustos(OIDCAuthnzBase):
-    def __init__(self, provider, oidc_config, oidc_backend_config, idphint=None):
-        super().__init__(provider, oidc_config, oidc_backend_config, idphint)
-        self.config.extra_params = {"kc_idp_hint": oidc_backend_config.get("idphint", "oidc")}
-        self._load_config_for_custos()
-
-    def _get_custos_credentials(self):
-        clientIdAndSec = f"{self.config.client_id}:{self.config.client_secret}"
-        if not self.config.credential_url:
-            raise Exception(
-                f"Error OIDC provider {self.config.provider} is of type Custos, but does not have the credential url set"
-            )
-        creds = requests.get(
-            self.config.credential_url,
-            headers={"Authorization": f"Basic {util.unicodify(base64.b64encode(util.smart_str(clientIdAndSec)))}"},
-            verify=False,
-            params={"client_id": self.config.client_id},
-            timeout=util.DEFAULT_SOCKET_TIMEOUT,
-        )
-        credentials = creds.json()
-        self.config.iam_client_secret = credentials["iam_client_secret"]
-
-    def _load_config_for_custos(self):
-        self.config.credential_url = f"{self.config.url.rstrip('/')}/credentials"
-        self._get_custos_credentials()
-        # Set custos endpoints
-        clientIdAndSec = f"{self.config.client_id}:{self.config.client_secret}"
-        headers = {"Authorization": f"Basic {util.unicodify(base64.b64encode(util.smart_str(clientIdAndSec)))}"}
-        params = {"client_id": self.config.client_id}
-
-        self._load_config(headers, params)
diff --git a/lib/galaxy/config/sample/galaxy.yml.sample b/lib/galaxy/config/sample/galaxy.yml.sample
@@ -2111,9 +2111,9 @@ galaxy:
   # page (even if require_login is true).
   #show_welcome_with_login: false
 
-  # Controls the order of the login page to prefer Custos-based login
+  # Controls the order of the login page to prefer OIDC-based login
   # and registration.
-  #prefer_custos_login: false
+  #prefer_oidc_login: false
 
   # Allow unregistered users to create new local (non-OIDC) accounts
   # (otherwise, they will have to be created by an admin). This option
diff --git a/lib/galaxy/config/sample/oidc_backends_config.xml.sample b/lib/galaxy/config/sample/oidc_backends_config.xml.sample
diff --git a/lib/galaxy/config/schemas/config_schema.yml b/lib/galaxy/config/schemas/config_schema.yml
diff --git a/lib/galaxy/managers/configuration.py b/lib/galaxy/managers/configuration.py
diff --git a/lib/galaxy/webapps/galaxy/controllers/authnz.py b/lib/galaxy/webapps/galaxy/controllers/authnz.py
diff --git a/test/unit/app/authnz/test_custos_authnz.py b/test/unit/app/authnz/test_custos_authnz.py
