ipsilon.git/ipsilon/tools, branch client-paos

Define PAOS AssertionConsumerService in ipsilon-client-install

2015-08-27T21:18:02+00:00

A SAML SP will not be able to perform ECP unless a
AssertionConsumerService for the PAOS binding has been defined in it's
metadata. The PAOS AssertionConsumerService participates in the ECP
protocol exchange, specifically it's where the ECP client sends the
IdP Assertion.

If lasso starts to engage in an ECP transaction by trying to generate a
Samlp:AuthnRequest and no PAOS AssertionConsumerService is defined in
the SP metadata it will fail with a unknown provider error.

Note, AssertionConsumerService elements are indexed endpoints, there
may be one per protocol binding. Now that there is more than 1
AssertionConsumerService we set the isDefault flag to True on the
existing post response at index 0. This isn't strictly necessary
because the spec says if the default flag isn't set on any
AssertionConsumerService endpoint then the first one is selected, but
it's good practice anyway.

FWIW, if mod_auth_mellon is not configured with metadata then
mod_auth_mellon will generate it's own metadata which includes the
PAOS AssertionConsumerService. However in ipsilon-client we generate
the SP metadata and were failing to add the PAOS
AssertionConsumerService, something mellon would have done
automatically for us. This is why this bug was only first seen using
ipsilon-client-install.

Ticket: 162
Signed-off-by: John Dennis

Set the value of WantAuthnRequestsSigned to True

2015-07-27T09:51:25+00:00

The spec says the default should be False if not specified
but lasso sets it to true unless it is explicitly set to
False. So let's be explicit and set it to True.

https://fedorahosted.org/ipsilon/ticket/136

Signed-off-by: Rob Crittenden 
Reviewed-by: Simo Sorce

Include timezone in metadata validUntil value and use UTC time

2015-07-17T14:22:33+00:00

The python datetime module doesn't append the timezone in its
isoformat() output, so add a Z indicating that the time is
UTC time. Also generate the output using utcnow() rather than
now() so the times line up.

https://fedorahosted.org/ipsilon/ticket/137

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Add support for logout over SOAP

2015-07-16T13:04:36+00:00

As each login session comes in, store the supported logout
mechanisms in the SP metadata.

Upon a logout request, loop through all of those SP's that
support SOAP and log those out first, then log out any
remaining sessions using HTTP Redirect.

https://fedorahosted.org/ipsilon/ticket/59

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Implement ECP in Ipsilon

2015-05-08T15:17:02+00:00

* add saml2/SSO/SOAP endpoint.
* add check for lasso version, ECP endpoint only exposed in metadata
  if lasso has full ECP support.
* add SSO_SOAP soap authentication handler (used for ECP).
* add SAML binding to transaction so we can determine if cookies
  and other HTTP concepts are expected. Each handler is responsible
  for setting the binding.
* add some constants needed for ECP

https://fedorahosted.org/ipsilon/ticket/4

Signed-off-by: John Dennis 
Reviewed-by: Rob Crittenden

Update Copyright header point to COPYING file

2015-05-08T15:00:48+00:00

Point to a file containing the license rather than including
it in every single source file. This will make it easier to
manage the license in the future without another humongous
commit.

https://fedorahosted.org/ipsilon/ticket/126

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

pylint 1.4.3 version fixes

2015-05-07T18:44:20+00:00

Pylint 1.4.3 completely stopped recognizing the star-args condition.
In order to avoid pylint error with > 1.4.3 stop caring for star-args
and add cmdline option to ignore those errors completly so older pylint
versions are happy too.

Also fix type() vs isinstance() checks, isinstance is generally a more
correct approach to check for classes.

In some 'admin' files the type() -> isinstance() fix required to invert
the order in which ComplexList and MappingList are checked as the latter
is a subclass of ComplexList, so it needs to be checked first otherwise
the check for isinstance(option, ComplexList) matches for both and the
code stops functioning properly.

Signed-off-by: Simo Sorce 
Reviewed-by: Rob Crittenden

Add support for expiration in Metadata

2015-01-29T19:06:45+00:00

Signed-off-by: Simo Sorce 
Reviewed-by: Patrick Uiterwijk

Add function to import a cert from a file

2015-01-29T19:06:31+00:00

Signed-off-by: Simo Sorce 
Reviewed-by: Patrick Uiterwijk

Fix file permissions and remove shebang's

2014-12-16T15:51:43+00:00

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Simo Sorce