ipsilon.git/ipsilon/providers, branch client-paos

Log a message when authentication is successful but doesn't

2015-08-25T12:55:28+00:00

match the NameID required by the SAML request.

https://fedorahosted.org/ipsilon/ticket/157

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk 
Signed-off-by: Patrick Uiterwijk

Fix permission check on SP update

2015-08-21T13:45:00+00:00

The permission check for owner was checking the wrong field,
which would make it possible for anyone to update the Service
Provider owner, making it possible for anyone to change the
SP owner, allowing anyone to change the SP name.

Fixes: CVE-2015-5217

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Rob Crittenden

Only initialize the Persona IDP when actually enabled

2015-08-18T07:41:03+00:00

This has the same reasoning as the OpenID patch (commit
ac7c20cca81c3d23ee66f224030b316bdff2274a), with additionally
that it will otherwise error on loading the signing key.
(This is not critical though as it will retry loading and
succeed, this is just to make it not spit that error).

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Rob Crittenden

Drop all the calls to .keys() when iterating on the keys of a dict

2015-08-11T10:08:50+00:00

When browsing the keys of a dictionary, you can use the ``.keys()`` method but
that is in fact only really useful if you want to store the list of keys first
and act on them (like sorting them or so).
If you just want to iterate through all the keys, no matter the order, then it
is much much faster to just do: ``for key in dict``

Some stats about this can be found there:
http://blog.pingoured.fr/index.php?post/2012/03/12/Python-notes-to-self

Signed-off-by: Pierre-Yves Chibon 
Reviewed-by: Simo Sorce

Only initialize the SAML IDP when actually enabled

2015-07-17T13:59:49+00:00

This has the same reasoning as the OpenID patch (commit
ac7c20cca81c3d23ee66f224030b316bdff2274a), with additionally
that it will otherwise error on finding the metadata.
(This is not critical though as it will retry loading and
succeed, this is just to make it not spit that error).

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Rob Crittenden

Add support for logout over SOAP

2015-07-16T13:04:36+00:00

As each login session comes in, store the supported logout
mechanisms in the SP metadata.

Upon a logout request, loop through all of those SP's that
support SOAP and log those out first, then log out any
remaining sessions using HTTP Redirect.

https://fedorahosted.org/ipsilon/ticket/59

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Only initialize the OpenID IDP when actually enabled

2015-07-08T11:27:02+00:00

This is needed because otherwise it will try to set the database schema version
before it read the configuration for providers, which means it will do this
in the default (openid.sqlite) database file.
If you are running as a non-privileged user (as your should) with the working
directory pointing somewhere this user is unable to write, this means it will
fail to write this.

Note: the working directory is not in the default wsgi file, which means that
people using that will not likely hit this bug.

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Simo Sorce

Use plugin-specific configuration, better expiration

2015-05-11T22:39:31+00:00

Use a SAML2 plugin specific option to specify the database uri
for sessions.

Use a much more robust method to find sessions that need
expiration (thanks Patrick).

https://fedorahosted.org/ipsilon/ticket/90

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Remove expired SAML2 sessions

2015-05-11T22:39:28+00:00

Run a cherrypy background task to sift through the sessions
database and find expired entries and remove them.

From my testing if a previous execution of the background task
is still executing when the next one is scheduled to run, it will
skip it. In other words, you can't end up with multiple expirations
running at the same time.

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Update IdP-initiated logout to use SAML2 Store

2015-05-11T22:39:26+00:00

This moves the order in which the "fake" session is created and
it gives it a unique ID rather than using a fixed value.

Rely on the LogoutRequest request ID so we can get the
order of logout correct.

The basic idea is a logout request is created for the IdP
containing the URL of the IdP itself as the RelayState. A
session is picked and a LogoutRequest generated and sent.

There will be a LogoutRequest/LogoutResponse back and forth
until there are no more sessions to log out. The last
session will be this "fake" session that started it all
and the user will be redirected to the main page of the IdP.

https://fedorahosted.org/ipsilon/ticket/90

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk