summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Validate options of the LDAP auth plugin on installationHEADmasterRob Crittenden2015-08-272-31/+72
| | | | | | | | | | | | | | Few of the LDAP options had any validation at all so it was easy to provide a bad DN template, basedn and server URL. These types of errors are now sufficient to kill the installer rather than letting it limp along and hope the user notices the failures in the output. https://fedorahosted.org/ipsilon/ticket/40 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Log a message when authentication is successful but doesn'tRob Crittenden2015-08-251-0/+2
| | | | | | | | | | match the NameID required by the SAML request. https://fedorahosted.org/ipsilon/ticket/157 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com> Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Count IPA as a login plugin when checking for enabled pluginsRob Crittenden2015-08-251-1/+1
| | | | | | | | | | | The installer ensures that at least one login plugin is enabled. It didn't consider IPA, which automatically enables gssapi, when doing this calculation. Add a check so that IPA counts as well. https://fedorahosted.org/ipsilon/ticket/152 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Make wellknowndir substitution work on Alias line as well.Jan Pazdziora2015-08-251-1/+1
| | | | | Signed-off-by: Jan Pazdziora <jpazdziora@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Enable auto-escaping templatesPatrick Uiterwijk2015-08-211-1/+3
| | | | | | | | | | This will prevent most cases of insertion of HTML or other code into the generated HTML. Fixes: CVE-2015-5215 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Fix permission check on SP updatePatrick Uiterwijk2015-08-211-2/+3
| | | | | | | | | | | | The permission check for owner was checking the wrong field, which would make it possible for anyone to update the Service Provider owner, making it possible for anyone to change the SP owner, allowing anyone to change the SP name. Fixes: CVE-2015-5217 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Report to user if an LDAP error occursRob Crittenden2015-08-184-9/+164
| | | | | | | | | | | | | | | Catch LDAP errors and display them properly rather than just dumping the exception. Rename variable authed to authok. Add test for case where LDAP server is not started to confirm the user receives the error alert. https://fedorahosted.org/ipsilon/ticket/55 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Clear testdir before test runPatrick Uiterwijk2015-08-181-0/+1
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Mark the service as readonly in the UI in authpam pluginRob Crittenden2015-08-183-20/+52
| | | | | | | | | | | | | | Update the Option class to take a readonly keyword argument, defaulting to False. Extend its subclasses to pass this value along. The page template will add the disabled keyword to input and textarea if a config option is marked as readonly. https://fedorahosted.org/ipsilon/ticket/6 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Only initialize the Persona IDP when actually enabledPatrick Uiterwijk2015-08-181-1/+0
| | | | | | | | | | | This has the same reasoning as the OpenID patch (commit ac7c20cca81c3d23ee66f224030b316bdff2274a), with additionally that it will otherwise error on loading the signing key. (This is not critical though as it will retry loading and succeed, this is just to make it not spit that error). Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Use full path when constructing "Other authentication methods"Rob Crittenden2015-08-111-1/+3
| | | | | | | | | | | | | | | | It was previously providing just a relative path and if the paths overlapped I guess the browser was trying to smash them together. This would result in a double "gssapi" in the gssapi URL like: https://my.ipsilon.org/idp/login/gssapi/gssapi/negotiate?ips... Don't rely on the browser to get the path right, use self.basepath. https://fedorahosted.org/ipsilon/ticket/153 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Drop all the calls to .keys() when iterating on the keys of a dictPierre-Yves Chibon2015-08-118-9/+9
| | | | | | | | | | | | | | When browsing the keys of a dictionary, you can use the ``.keys()`` method but that is in fact only really useful if you want to store the list of keys first and act on them (like sorting them or so). If you just want to iterate through all the keys, no matter the order, then it is much much faster to just do: ``for key in dict`` Some stats about this can be found there: http://blog.pingoured.fr/index.php?post/2012/03/12/Python-notes-to-self Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr> Reviewed-by: Simo Sorce <simo@redhat.com>
* Log caught exceptions in server installer at debug levelRob Crittenden2015-07-271-1/+2
| | | | | | | | | | | | exception() is a helper that logs a traceback at the ERROR level. Since the stdout logs at INFO the traceback was going to both the log file and stdout. We really only want it in the debug log. https://fedorahosted.org/ipsilon/ticket/143 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Set the value of WantAuthnRequestsSigned to TrueRob Crittenden2015-07-271-0/+2
| | | | | | | | | | | The spec says the default should be False if not specified but lasso sets it to true unless it is explicitly set to False. So let's be explicit and set it to True. https://fedorahosted.org/ipsilon/ticket/136 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Include timezone in metadata validUntil value and use UTC timeRob Crittenden2015-07-171-2/+2
| | | | | | | | | | | | The python datetime module doesn't append the timezone in its isoformat() output, so add a Z indicating that the time is UTC time. Also generate the output using utcnow() rather than now() so the times line up. https://fedorahosted.org/ipsilon/ticket/137 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Only initialize the SAML IDP when actually enabledPatrick Uiterwijk2015-07-171-1/+0
| | | | | | | | | | | This has the same reasoning as the OpenID patch (commit ac7c20cca81c3d23ee66f224030b316bdff2274a), with additionally that it will otherwise error on finding the metadata. (This is not critical though as it will retry loading and succeed, this is just to make it not spit that error). Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Refactor SP generation to simplify logout testingRob Crittenden2015-07-161-97/+110
| | | | | | | | | | | | | This adds the ability to quickly and easily add more SPs as needed to test more complex logout scenarios. Create five SP's, two of which support only HTTP-Redirect to ensure that logout works in a mixed environment. https://fedorahosted.org/ipsilon/ticket/59 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add client install option to disable logout over SOAPRob Crittenden2015-07-162-1/+8
| | | | | | | | | | | | This is at least somewhat for testing to ensure that a mixed environment works but HTTP Redirect is the recommended mechanism in the spec so some may want to use only that. https://fedorahosted.org/ipsilon/ticket/59 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for logout over SOAPRob Crittenden2015-07-168-45/+167
| | | | | | | | | | | | | | As each login session comes in, store the supported logout mechanisms in the SP metadata. Upon a logout request, loop through all of those SP's that support SOAP and log those out first, then log out any remaining sessions using HTTP Redirect. https://fedorahosted.org/ipsilon/ticket/59 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Return PAM errors from mod_intercept_form_submitRob Crittenden2015-07-152-8/+18
| | | | | | | | | | | | | | | | | | | This fixes several problems: 1. The PAM error was being retrieved from the wrong location 2. The error was not always logged properly 3. The error was not propogated up 4. Even if the error had been propgated up the auth_failed routine failed to pass it to the error page template. A dictionary is used to translate the PAM errors into something more consulable. This can be used eventually to translate into other languages. https://fedorahosted.org/ipsilon/ticket/69 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Only initialize the OpenID IDP when actually enabledPatrick Uiterwijk2015-07-081-1/+0
| | | | | | | | | | | | | | | This is needed because otherwise it will try to set the database schema version before it read the configuration for providers, which means it will do this in the default (openid.sqlite) database file. If you are running as a non-privileged user (as your should) with the working directory pointing somewhere this user is unable to write, this means it will fail to write this. Note: the working directory is not in the default wsgi file, which means that people using that will not likely hit this bug. Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Replace some type(...) checks with isinstance(...)Patrick Uiterwijk2015-07-081-6/+6
| | | | | | | | This is needed because otherwise the pylint version in Fedora 22 will complain. Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Default --saml-sp-logout/post base on --saml-spJamie Lennox2015-07-071-6/+11
| | | | | | | | | | In ipsilon-client-install salow setting only --saml-sp and have --saml-sp-logout and --saml-sp-post values based upon the provided value rather than complaining that the defaults are wrong. Closes-Ticket: 145 Signed-off-by: Jamie Lennox <jamielennox@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add missing requirement on mod_ssl for ipsilon-clientPatrick Uiterwijk2015-06-221-1/+5
| | | | | | | https://fedorahosted.org/ipsilon/ticket/144 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* ipsilon-client-install give password in env. var.Rich Megginson2015-06-092-1/+4
| | | | | | | | | | | https://fedorahosted.org/ipsilon/ticket/142 If --admin-password is not given, see if the IPSILON_ADMIN_PASSWORD environment variable is set, and use it for the admin_password, before doing getpass(). Signed-off-by: Rich Megginson <rmeggins@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Bump version for 1.0.0 releasePatrick Uiterwijk2015-05-122-2/+5
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Install man pages for client and serverRob Crittenden2015-05-121-1/+4
| | | | | | | | | | This includes the man pages for the installers and for ipsilon.conf. https://fedorahosted.org/ipsilon/ticket/34 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add man page for ipsilon.conf.Rob Crittenden2015-05-121-0/+92
| | | | | | | https://fedorahosted.org/ipsilon/ticket/34 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add more text to ipsilon(7) man pageRob Crittenden2015-05-121-2/+11
| | | | | | | https://fedorahosted.org/ipsilon/ticket/34 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* ipsilon-server-install man pageRob Crittenden2015-05-121-0/+177
| | | | | | | https://fedorahosted.org/ipsilon/ticket/34 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* ipsilon-client-install man pageRob Crittenden2015-05-121-0/+94
| | | | | | | https://fedorahosted.org/ipsilon/ticket/34 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add logout to pgdb, fix name in testsRob Crittenden2015-05-121-3/+23
| | | | | | | | | | Add a logout to the postgres test to ensure that sessions are updated properly on logout. Fix the name in the tests, it was test1. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Use plugin-specific configuration, better expirationRob Crittenden2015-05-128-36/+50
| | | | | | | | | | | | | Use a SAML2 plugin specific option to specify the database uri for sessions. Use a much more robust method to find sessions that need expiration (thanks Patrick). https://fedorahosted.org/ipsilon/ticket/90 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Remove expired SAML2 sessionsRob Crittenden2015-05-122-8/+41
| | | | | | | | | | | | | Run a cherrypy background task to sift through the sessions database and find expired entries and remove them. From my testing if a previous execution of the background task is still executing when the next one is scheduled to run, it will skip it. In other words, you can't end up with multiple expirations running at the same time. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Update IdP-initiated logout to use SAML2 StoreRob Crittenden2015-05-121-16/+20
| | | | | | | | | | | | | | | | | | | | | | This moves the order in which the "fake" session is created and it gives it a unique ID rather than using a fixed value. Rely on the LogoutRequest request ID so we can get the order of logout correct. The basic idea is a logout request is created for the IdP containing the URL of the IdP itself as the RelayState. A session is picked and a LogoutRequest generated and sent. There will be a LogoutRequest/LogoutResponse back and forth until there are no more sessions to log out. The last session will be this "fake" session that started it all and the user will be redirected to the main page of the IdP. https://fedorahosted.org/ipsilon/ticket/90 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Convert logout code to use SAML2 StoreRob Crittenden2015-05-121-40/+38
| | | | | | | | | | | | | | This is functionally the same. The primary differences are: - When logging out, fetch all requested session indexes in the LogoutRequest. - Store the LogoutRequest request ID to be used later when a LogoutResponse is received to look up the logout. https://fedorahosted.org/ipsilon/ticket/90 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Create a SAML2 session during loginRob Crittenden2015-05-121-13/+4
| | | | | | | | | | | | | | | Use the updated session API to create a SAML2 session. Note that each session is stored discretely. Previously if a session for a provider already existed then that one session held all the session indexes. Now if a new session comes in it is added separately. During logout all sessions for a provider are retrieved and all logged-in sessions sent to the SP to log out. https://fedorahosted.org/ipsilon/ticket/90 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Change SAML2 sessions backend to use Store APIRob Crittenden2015-05-121-152/+224
| | | | | | | | | | | | | | | The basic session API remains the same, just replace the calls to pull data out of the user session to instead pull from the database. The per-session logout state is now a constant rather than being a member of either the logged_in or logging_out dictionaries. https://fedorahosted.org/ipsilon/ticket/90 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Configure the SAML2 session database during installationRob Crittenden2015-05-123-1/+8
| | | | | | | https://fedorahosted.org/ipsilon/ticket/90 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for storing SAML2 sessionsRob Crittenden2015-05-121-0/+64
| | | | | | | | | | | | | Store SAML2 session information in a table rather than with the user entry so sessions can be persisted past IdP restarts and if the user accesses the system via multiple browsers SLO will log out all sessions, not just the user session that initiated the logout. https://fedorahosted.org/ipsilon/ticket/90 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add uninstallation support to infosssdPatrick Uiterwijk2015-05-082-5/+75
| | | | | | | | | | This should make it revert any changes it made during installation. https://fedorahosted.org/ipsilon/ticket/67 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Implement change registrationPatrick Uiterwijk2015-05-0818-29/+59
| | | | | | | | | | | This will make it possible for plugins to register what they have changed during installation, so that they can revert any changes they made during the uninstallation. https://fedorahosted.org/ipsilon/ticket/67 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add database schema versioningPatrick Uiterwijk2015-05-082-0/+29
| | | | | | | | | | With this skeleton code we can add upgrade code if we ever change the database schema. https://fedorahosted.org/ipsilon/ticket/56 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Implement ECP in IpsilonJohn Dennis2015-05-085-4/+154
| | | | | | | | | | | | | | | | * add saml2/SSO/SOAP endpoint. * add check for lasso version, ECP endpoint only exposed in metadata if lasso has full ECP support. * add SSO_SOAP soap authentication handler (used for ECP). * add SAML binding to transaction so we can determine if cookies and other HTTP concepts are expected. Each handler is responsible for setting the binding. * add some constants needed for ECP https://fedorahosted.org/ipsilon/ticket/4 Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Update Copyright header point to COPYING fileRob Crittenden2015-05-0881-706/+85
| | | | | | | | | | | | Point to a file containing the license rather than including it in every single source file. This will make it easier to manage the license in the future without another humongous commit. https://fedorahosted.org/ipsilon/ticket/126 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Remove extraneous logging arg in authform login pluginRob Crittenden2015-05-081-2/+1
| | | | | | | | | If you didn't provide credentials at all at the form by pressing ENTER then a 500 error would be thrown rather than an authentication error. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Set infosssd config value preconfigured as a booleanRob Crittenden2015-05-081-1/+1
| | | | | | | | | It was storing a python boolean which saved as integer 1 but when reading the data the Condition translates text into a python native value. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Add db.conn.log option to suppress sql logs by defaultRob Crittenden2015-05-073-1/+9
| | | | | | | | | | The Store logging is quite verbose with a flurry of init and destroy messages with each session. Setting db.conn.log to False (default) will suppress these. If one needs to do connection tracing it can be enabled. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix ownership of config and state directoriesNathan Kinder2015-05-071-2/+2
| | | | | | | | | | | | | | | | The recent RPM package restructing introduced some problems with the ownership of /etc/ipsilon and /var/lib/ipsilon. These were previously owned by the 'ipsilon' user, but the changes resulted in the ownership being set as root since the 'ipsilon' user was not yet created when the directories were installed. While discussing this problem, it was determined that we should have the ownership of these directories be root, but allow other users to traverse through them so they can access subdirectories that they have permissions on. Signed-off-by: Nathan Kinder <nkinder@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* pylint 1.4.3 version fixesSimo Sorce2015-05-0724-44/+30
| | | | | | | | | | | | | | | | | | | Pylint 1.4.3 completely stopped recognizing the star-args condition. In order to avoid pylint error with > 1.4.3 stop caring for star-args and add cmdline option to ignore those errors completly so older pylint versions are happy too. Also fix type() vs isinstance() checks, isinstance is generally a more correct approach to check for classes. In some 'admin' files the type() -> isinstance() fix required to invert the order in which ComplexList and MappingList are checked as the latter is a subclass of ComplexList, so it needs to be checked first otherwise the check for isinstance(option, ComplexList) matches for both and the code stops functioning properly. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-19 19:13:33 +0000