ipsilon.git/ipsilon/providers/saml2, branch ecp

Implement ECP in Ipsilon

2015-08-27T12:07:26+00:00

* add saml2/SSO/SOAP endpoint.
* add check for lasso version, ECP endpoint only exposed in metadata
  if lasso has full ECP support.
* add SSO_SOAP soap authentication handler (used for ECP).
* add SAML binding to transaction so we can determine if cookies
  and other HTTP concepts are expected. Each handler is responsible
  for setting the binding.
* add some constants needed for ECP

Signed-off-by: John Dennis

Log a message when authentication is successful but doesn't

2015-08-25T12:55:28+00:00

match the NameID required by the SAML request.

https://fedorahosted.org/ipsilon/ticket/157

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk 
Signed-off-by: Patrick Uiterwijk

Fix permission check on SP update

2015-08-21T13:45:00+00:00

The permission check for owner was checking the wrong field,
which would make it possible for anyone to update the Service
Provider owner, making it possible for anyone to change the
SP owner, allowing anyone to change the SP name.

Fixes: CVE-2015-5217

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Rob Crittenden

Drop all the calls to .keys() when iterating on the keys of a dict

2015-08-11T10:08:50+00:00

When browsing the keys of a dictionary, you can use the ``.keys()`` method but
that is in fact only really useful if you want to store the list of keys first
and act on them (like sorting them or so).
If you just want to iterate through all the keys, no matter the order, then it
is much much faster to just do: ``for key in dict``

Some stats about this can be found there:
http://blog.pingoured.fr/index.php?post/2012/03/12/Python-notes-to-self

Signed-off-by: Pierre-Yves Chibon 
Reviewed-by: Simo Sorce

Add support for logout over SOAP

2015-07-16T13:04:36+00:00

As each login session comes in, store the supported logout
mechanisms in the SP metadata.

Upon a logout request, loop through all of those SP's that
support SOAP and log those out first, then log out any
remaining sessions using HTTP Redirect.

https://fedorahosted.org/ipsilon/ticket/59

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Use plugin-specific configuration, better expiration

2015-05-11T22:39:31+00:00

Use a SAML2 plugin specific option to specify the database uri
for sessions.

Use a much more robust method to find sessions that need
expiration (thanks Patrick).

https://fedorahosted.org/ipsilon/ticket/90

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Remove expired SAML2 sessions

2015-05-11T22:39:28+00:00

Run a cherrypy background task to sift through the sessions
database and find expired entries and remove them.

From my testing if a previous execution of the background task
is still executing when the next one is scheduled to run, it will
skip it. In other words, you can't end up with multiple expirations
running at the same time.

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Convert logout code to use SAML2 Store

2015-05-11T22:39:22+00:00

This is functionally the same. The primary differences are:

- When logging out, fetch all requested session indexes in the
  LogoutRequest.
- Store the LogoutRequest request ID to be used later when a
  LogoutResponse is received to look up the logout.

https://fedorahosted.org/ipsilon/ticket/90

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Create a SAML2 session during login

2015-05-11T22:39:14+00:00

Use the updated session API to create a SAML2 session.
Note that each session is stored discretely. Previously if
a session for a provider already existed then that one session
held all the session indexes. Now if a new session comes in
it is added separately. During logout all sessions for a provider
are retrieved and all logged-in sessions sent to the SP to
log out.

https://fedorahosted.org/ipsilon/ticket/90

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Change SAML2 sessions backend to use Store API

2015-05-11T22:39:10+00:00

The basic session API remains the same, just replace
the calls to pull data out of the user session to
instead pull from the database.

The per-session logout state is now a constant rather than
being a member of either the logged_in or logging_out
dictionaries.

https://fedorahosted.org/ipsilon/ticket/90

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk