ipsilon.git/ipsilon/providers, branch ecp

Implement ECP in Ipsilon

2015-08-27T12:07:26+00:00

* add saml2/SSO/SOAP endpoint.
* add check for lasso version, ECP endpoint only exposed in metadata
  if lasso has full ECP support.
* add SSO_SOAP soap authentication handler (used for ECP).
* add SAML binding to transaction so we can determine if cookies
  and other HTTP concepts are expected. Each handler is responsible
  for setting the binding.
* add some constants needed for ECP

Signed-off-by: John Dennis

Log a message when authentication is successful but doesn't

2015-08-25T12:55:28+00:00

match the NameID required by the SAML request.

https://fedorahosted.org/ipsilon/ticket/157

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk 
Signed-off-by: Patrick Uiterwijk

Fix permission check on SP update

2015-08-21T13:45:00+00:00

The permission check for owner was checking the wrong field,
which would make it possible for anyone to update the Service
Provider owner, making it possible for anyone to change the
SP owner, allowing anyone to change the SP name.

Fixes: CVE-2015-5217

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Rob Crittenden

Only initialize the Persona IDP when actually enabled

2015-08-18T07:41:03+00:00

This has the same reasoning as the OpenID patch (commit
ac7c20cca81c3d23ee66f224030b316bdff2274a), with additionally
that it will otherwise error on loading the signing key.
(This is not critical though as it will retry loading and
succeed, this is just to make it not spit that error).

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Rob Crittenden

Drop all the calls to .keys() when iterating on the keys of a dict

2015-08-11T10:08:50+00:00

When browsing the keys of a dictionary, you can use the ``.keys()`` method but
that is in fact only really useful if you want to store the list of keys first
and act on them (like sorting them or so).
If you just want to iterate through all the keys, no matter the order, then it
is much much faster to just do: ``for key in dict``

Some stats about this can be found there:
http://blog.pingoured.fr/index.php?post/2012/03/12/Python-notes-to-self

Signed-off-by: Pierre-Yves Chibon 
Reviewed-by: Simo Sorce

Only initialize the SAML IDP when actually enabled

2015-07-17T13:59:49+00:00

This has the same reasoning as the OpenID patch (commit
ac7c20cca81c3d23ee66f224030b316bdff2274a), with additionally
that it will otherwise error on finding the metadata.
(This is not critical though as it will retry loading and
succeed, this is just to make it not spit that error).

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Rob Crittenden

Add support for logout over SOAP

2015-07-16T13:04:36+00:00

As each login session comes in, store the supported logout
mechanisms in the SP metadata.

Upon a logout request, loop through all of those SP's that
support SOAP and log those out first, then log out any
remaining sessions using HTTP Redirect.

https://fedorahosted.org/ipsilon/ticket/59

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Only initialize the OpenID IDP when actually enabled

2015-07-08T11:27:02+00:00

This is needed because otherwise it will try to set the database schema version
before it read the configuration for providers, which means it will do this
in the default (openid.sqlite) database file.
If you are running as a non-privileged user (as your should) with the working
directory pointing somewhere this user is unable to write, this means it will
fail to write this.

Note: the working directory is not in the default wsgi file, which means that
people using that will not likely hit this bug.

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Simo Sorce

Use plugin-specific configuration, better expiration

2015-05-11T22:39:31+00:00

Use a SAML2 plugin specific option to specify the database uri
for sessions.

Use a much more robust method to find sessions that need
expiration (thanks Patrick).

https://fedorahosted.org/ipsilon/ticket/90

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Remove expired SAML2 sessions

2015-05-11T22:39:28+00:00

Run a cherrypy background task to sift through the sessions
database and find expired entries and remove them.

From my testing if a previous execution of the background task
is still executing when the next one is scheduled to run, it will
skip it. In other words, you can't end up with multiple expirations
running at the same time.

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk