.git, branch save_session

Save user attributes on subsequent calls to login.

2015-03-16T18:58:05+00:00

When a login comes in via the remote_login() call no
user attributes are set. These may be later filled in by
a subsequent call to login() after the info plugins are
called but a short-circuit in that function exits if the
user matches the current session.

Add an extra conditional such that if the user matches,
userattributes are passed in and the current user attributes
for this user is empty then save the new data.

https://fedorahosted.org/ipsilon/ticket/86

Signed-off-by: Rob Crittenden

Add test for multi-SP logout

2015-03-16T17:47:45+00:00

Create an additional SP, log into one, fetch the other and
the client is now logged into both. Log out of the first one
and the client is logged out of both.

https://fedorahosted.org/ipsilon/ticket/58

Signed-off-by: Rob Crittenden 
Reviewed-by: Nathan Kinder

Set MALLOC_CHECK_ and MALLOC_PERTURB_ to catch memory problems

2015-03-16T17:47:41+00:00

MALLOC_CHECK_ set to 3 should abort if a memory problem is found.

MALLOC_PERTURB_ should catch any usage of freed memory.

Signed-off-by: Rob Crittenden 
Reviewed-by: Nathan Kinder

Enable Apache access log and core dump in tests

2015-03-16T17:47:17+00:00

Signed-off-by: Rob Crittenden 
Reviewed-by: Nathan Kinder

Don't explicitly save sessions

2015-03-12T19:36:33+00:00

Saving a session causes it to be unlocked, but sessions have a
hook that also performs a save just before the session is finalized.
In CherryPy 3.3.0 and later, an assertion was added to ensure that
a session is locked when trying to perform a save.  Since we perform
explicit saves in our code, this causes the assertion to be tripped
when the hook executes.

This patch removes our explicit save calls.  We should rely on the
hook to save and unlock the session.

https://fedorahosted.org/ipsilon/ticket/84

Signed-off-by: Nathan Kinder 
Reviewed-by: Simo Sorce

Proper fallback from referer to REQUEST_URI

2015-03-12T18:48:11+00:00

If the referer is present but does not contain a transaction ID we still
need to fallback to the REQUEST_URI. Fix the code to check the url and
then fallback to REQUEST_URI rathe than decide upfront merely on the
fact a referer is available.

https://fedorahosted.org/ipsilon/ticket/74

Signed-off-by: Simo Sorce 
Reviewed-by: Nathan Kinder

Validate SP path settings during installation

2015-03-11T13:48:55+00:00

There are a number of URL path options that can be specified as
options when running ipsilon-client-install. There are certain
rules that must be followed to result in a valid mod_auth_mellon
configuration:

 - All path options must be prefixed with '/'.

 - The mellon endpoint path (--saml-sp) must be a subpath of the
   httpd 'Location' element is it contained within (--saml-base).

 - The logout (--saml-sp-logout) and post (--saml-sp-post) paths
   must be subpaths of the mellon endpoint (--saml-sp).

This adds validation for all of the above rules.

https://fedorahosted.org/ipsilon/ticket/82

Signed-off-by: Nathan Kinder 
Reviewed-by: Patrick Uiterwijk

Add mod_wsgi display name for Ipsilon WSGI process

2015-03-11T13:39:10+00:00

This adds the mod_wsgi display-name setting to allow the Ipsilon
WSGI process to show up with a useful process name instead of
'httpd'.  This allows one to easily distinguish the WSGI process
from other httpd processes.

https://fedorahosted.org/ipsilon/ticket/62

Signed-off-by: Nathan Kinder 
Reviewed-by: Rob Crittenden

Add Cache-Control header to prevent browser caching of SAML auth location

2015-03-10T22:24:08+00:00

We should prevent browser caching of the SAML auth location that we
configure for an SP. This can be easily done by adding the following
directive to that location in the httpd config:

    Header append Cache-Control "no-cache"

https://fedorahosted.org/ipsilon/ticket/81

Signed-off-by: Nathan Kinder 
Reviewed-by: Rob Crittenden

Require SSL on SP when using --saml-secure-setup

2015-03-10T22:24:01+00:00

If ipsilon-client-install is used with the --saml-secure-setup
option (which is set by default), only https connections will
work for authentication.  We are not setting the SSLRequireSSL
directive though, so we set mellon up to fail.

This patch adds the SSLRequireSSL directive to the SP config
when --saml-secure-setup is specified.  In addition, we add a
rewrite rule to rewrite http requests to https for the SP.

https://fedorahosted.org/ipsilon/ticket/80

Signed-off-by: Nathan Kinder 
Reviewed-by: Rob Crittenden