ipsilon.git/templates/install, branch ecp

Make wellknowndir substitution work on Alias line as well.

2015-08-25T12:44:58+00:00

Signed-off-by: Jan Pazdziora 
Reviewed-by: Patrick Uiterwijk

Use plugin-specific configuration, better expiration

2015-05-11T22:39:31+00:00

Use a SAML2 plugin specific option to specify the database uri
for sessions.

Use a much more robust method to find sessions that need
expiration (thanks Patrick).

https://fedorahosted.org/ipsilon/ticket/90

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Configure the SAML2 session database during installation

2015-05-11T22:39:06+00:00

https://fedorahosted.org/ipsilon/ticket/90

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Add db.conn.log option to suppress sql logs by default

2015-05-07T20:08:04+00:00

The Store logging is quite verbose with a flurry of
init and destroy messages with each session. Setting
db.conn.log to False (default) will suppress these. If one
needs to do connection tracing it can be enabled.

Signed-off-by: Rob Crittenden 
Reviewed-by: Simo Sorce

Allow SP installation to be on non-standard ports

2015-03-18T21:49:43+00:00

When setting up a SP using ipsilon-client-install, there is no
ability to use a non-standard port.  We should allow a port number
to be specified that results in the proper URLs in the SP metadata.

This patch adds a --port option to ipsilon-client-install.  This is
used in the construction of the URLs used in the SP metadata as well
as in the httpd redirect rules if httpd is being configured.

https://fedorahosted.org/ipsilon/ticket/92

Signed-off-by: Nathan Kinder 
Reviewed-by: Rob Crittenden

Add mod_wsgi display name for Ipsilon WSGI process

2015-03-11T13:39:10+00:00

This adds the mod_wsgi display-name setting to allow the Ipsilon
WSGI process to show up with a useful process name instead of
'httpd'.  This allows one to easily distinguish the WSGI process
from other httpd processes.

https://fedorahosted.org/ipsilon/ticket/62

Signed-off-by: Nathan Kinder 
Reviewed-by: Rob Crittenden

Require SSL on SP when using --saml-secure-setup

2015-03-10T22:24:01+00:00

If ipsilon-client-install is used with the --saml-secure-setup
option (which is set by default), only https connections will
work for authentication.  We are not setting the SSLRequireSSL
directive though, so we set mellon up to fail.

This patch adds the SSLRequireSSL directive to the SP config
when --saml-secure-setup is specified.  In addition, we add a
rewrite rule to rewrite http requests to https for the SP.

https://fedorahosted.org/ipsilon/ticket/80

Signed-off-by: Nathan Kinder 
Reviewed-by: Rob Crittenden

Add request/response logging via cherrypy tool hooks

2015-01-26T18:34:06+00:00

The ability to easily review the HTTP Ipsilon request and response is
boon for development and issue debugging. Normally these HTTP
conversations occur on SSL/TLS encrypted connections making it
difficult to use other tools to view the traffic. Client side tools
have known pitfalls (e.g. Firebug) and not all conversations are
browser initiated (e.g. SAML ECP). Logging performed by the server
hosting Ipsilon makes logging at the server level server specific
(e.g. Apache's dumpio requires post-processing the log file to extract
and reassamble the HTTP conversation). The best place to log requests
and responses is within Ipsilon using the cherrypy framework
Ipsilon is embedded in. Cherrypy provides user defined hooks that can
be invoked at specific places in the request pipeline. We establish a
hook at the last stage just before the response is written to the
client, it logs the incoming request and outgoing response.

Resolves: https://fedorahosted.org/ipsilon/ticket/44

Signed-off-by: John Dennis 
Reviewed-by: Simo Sorce

Add support for Persona Identity Provider

2014-11-14T18:06:27+00:00

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Simo Sorce

Add simple SqlSession implementation

2014-11-12T22:46:52+00:00

This allows us to store session data in the DB. This way session data can
be shared by multiple servers behind a balancer.

Signed-off-by: Simo Sorce 
Reviewed-by: Patrick Uiterwijk