summaryrefslogtreecommitdiffstats
path: root/ipsilon/providers/saml2idp.py
blob: e89fe0c05f4836d3b4f90aa7195c93a45ed05533 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
#!/usr/bin/python
#
# Copyright (C) 2014  Simo Sorce <simo@redhat.com>
#
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from ipsilon.providers.common import ProviderBase, ProviderPageBase
from ipsilon.providers.common import FACILITY
from ipsilon.providers.saml2.auth import AuthenticateRequest
from ipsilon.providers.saml2.admin import AdminPage
from ipsilon.providers.saml2.provider import IdentityProvider
from ipsilon.tools.certs import Certificate
from ipsilon.tools import saml2metadata as metadata
from ipsilon.tools import files
from ipsilon.util.user import UserSession
from ipsilon.util.plugin import PluginObject
import cherrypy
import lasso
import os


class Redirect(AuthenticateRequest):

    def GET(self, *args, **kwargs):

        query = cherrypy.request.query_string

        login = self.saml2login(query)
        return self.auth(login)


class POSTAuth(AuthenticateRequest):

    def POST(self, *args, **kwargs):

        request = kwargs.get(lasso.SAML2_FIELD_REQUEST)
        relaystate = kwargs.get(lasso.SAML2_FIELD_RELAYSTATE)

        login = self.saml2login(request)
        login.set_msgRelayState(relaystate)
        return self.auth(login)


class Continue(AuthenticateRequest):

    def GET(self, *args, **kwargs):

        session = UserSession()
        user = session.get_user()
        session.nuke_data('login', 'Return')
        self.stage = session.get_data('saml2', 'stage')

        if user.is_anonymous:
            self._debug("User is marked anonymous?!")
            # TODO: Return to SP with auth failed error
            raise cherrypy.HTTPError(401)

        self._debug('Continue auth for %s' % user.name)

        dump = session.get_data('saml2', 'Request')
        if not dump:
            self._debug("Couldn't find Request dump?!")
            # TODO: Return to SP with auth failed error
            raise cherrypy.HTTPError(400)

        try:
            login = self.cfg.idp.get_login_handler(dump)
        except Exception, e:  # pylint: disable=broad-except
            self._debug('Failed to load status from dump: %r' % e)

        if not login:
            self._debug("Empty Request dump?!")
            # TODO: Return to SP with auth failed error
            raise cherrypy.HTTPError(400)

        return self.auth(login)


class SSO(ProviderPageBase):

    def __init__(self, *args, **kwargs):
        super(SSO, self).__init__(*args, **kwargs)
        self.Redirect = Redirect(*args, **kwargs)
        self.POST = POSTAuth(*args, **kwargs)
        self.Continue = Continue(*args, **kwargs)


class Metadata(ProviderPageBase):
    def GET(self, *args, **kwargs):
        with open(self.cfg.idp_metadata_file) as m:
            body = m.read()
        cherrypy.response.headers["Content-Type"] = "text/xml"
        cherrypy.response.headers["Content-Disposition"] = \
            'attachment; filename="metadata.xml"'
        return body


class SAML2(ProviderPageBase):

    def __init__(self, *args, **kwargs):
        super(SAML2, self).__init__(*args, **kwargs)
        self.metadata = Metadata(*args, **kwargs)

        # Init IDP data
        try:
            self.cfg.idp = IdentityProvider(self.cfg)
        except Exception, e:  # pylint: disable=broad-except
            self._debug('Failed to init SAML2 provider: %r' % e)
            return

        # Import all known applications
        data = self.cfg.get_data()
        for idval in data:
            sp = data[idval]
            if 'type' not in sp or sp['type'] != 'SP':
                continue
            if 'name' not in sp or 'metadata' not in sp:
                continue
            try:
                self.cfg.idp.add_provider(sp)
            except Exception, e:  # pylint: disable=broad-except
                self._debug('Failed to add SP %s: %r' % (sp['name'], e))

        self.SSO = SSO(*args, **kwargs)


class IdpProvider(ProviderBase):

    def __init__(self):
        super(IdpProvider, self).__init__('saml2', 'saml2')
        self.page = None
        self.idp = None
        self.description = """
Provides SAML 2.0 authentication infrastructure. """

        self._options = {
            'idp storage path': [
                """ Path to data storage accessible by the IdP """,
                'string',
                '/var/lib/ipsilon/saml2'
            ],
            'idp metadata file': [
                """ The IdP Metadata file genearated at install time. """,
                'string',
                'metadata.xml'
            ],
            'idp certificate file': [
                """ The IdP PEM Certificate genearated at install time. """,
                'string',
                'certificate.pem'
            ],
            'idp key file': [
                """ The IdP Certificate Key genearated at install time. """,
                'string',
                'certificate.key'
            ],
            'allow self registration': [
                """ Allow authenticated users to register applications. """,
                'boolean',
                True
            ],
            'default allowed nameids': [
                """Default Allowed NameIDs for Service Providers. """,
                'list',
                ['persistent', 'transient', 'email', 'kerberos', 'x509']
            ],
            'default nameid': [
                """Default NameID used by Service Providers. """,
                'string',
                'persistent'
            ],
            'default email domain': [
                """Default email domain, for users missing email property.""",
                'string',
                'example.com'
            ]
        }
        if cherrypy.config.get('debug', False):
            import logging
            import sys
            logger = logging.getLogger('lasso')
            lh = logging.StreamHandler(sys.stderr)
            logger.addHandler(lh)
            logger.setLevel(logging.DEBUG)

    @property
    def allow_self_registration(self):
        return self.get_config_value('allow self registration')

    @property
    def idp_storage_path(self):
        return self.get_config_value('idp storage path')

    @property
    def idp_metadata_file(self):
        return os.path.join(self.idp_storage_path,
                            self.get_config_value('idp metadata file'))

    @property
    def idp_certificate_file(self):
        return os.path.join(self.idp_storage_path,
                            self.get_config_value('idp certificate file'))

    @property
    def idp_key_file(self):
        return os.path.join(self.idp_storage_path,
                            self.get_config_value('idp key file'))

    @property
    def default_allowed_nameids(self):
        return self.get_config_value('default allowed nameids')

    @property
    def default_nameid(self):
        return self.get_config_value('default nameid')

    @property
    def default_email_domain(self):
        return self.get_config_value('default email domain')

    def get_tree(self, site):
        self.page = SAML2(site, self)
        self.admin = AdminPage(site, self)
        return self.page


class Installer(object):

    def __init__(self):
        self.name = 'saml2'
        self.ptype = 'provider'

    def install_args(self, group):
        group.add_argument('--saml2', choices=['yes', 'no'], default='yes',
                           help='Configure SAML2 Provider')
        group.add_argument('--saml2-secure',
                           choices=['yes', 'no'], default='yes',
                           help='Configure SAML2 Provider')

    def configure(self, opts):
        if opts['saml2'] != 'yes':
            return

        # Check storage path is present or create it
        path = os.path.join(opts['data_dir'], 'saml2')
        if not os.path.exists(path):
            os.makedirs(path, 0700)

        # Use the same cert for signing and ecnryption for now
        cert = Certificate(path)
        cert.generate('idp', opts['hostname'])

        # Generate Idp Metadata
        proto = 'https'
        if opts['saml2_secure'].lower() == 'no':
            proto = 'http'
        url = '%s://%s/%s/saml2' % (proto, opts['hostname'], opts['instance'])
        meta = metadata.Metadata(metadata.IDP_ROLE)
        meta.set_entity_id(url + '/metadata')
        meta.add_certs(cert, cert)
        meta.add_service(metadata.SAML2_SERVICE_MAP['sso-post'],
                         url + '/SSO/POST')
        meta.add_service(metadata.SAML2_SERVICE_MAP['sso-redirect'],
                         url + '/SSO/Redirect')

        meta.add_allowed_name_format(
            lasso.SAML2_NAME_IDENTIFIER_FORMAT_TRANSIENT)
        meta.add_allowed_name_format(
            lasso.SAML2_NAME_IDENTIFIER_FORMAT_PERSISTENT)
        meta.add_allowed_name_format(
            lasso.SAML2_NAME_IDENTIFIER_FORMAT_EMAIL)
        if 'krb' in opts and opts['krb'] == 'yes':
            meta.add_allowed_name_format(
                lasso.SAML2_NAME_IDENTIFIER_FORMAT_KERBEROS)

        meta.output(os.path.join(path, 'metadata.xml'))

        # Add configuration data to database
        po = PluginObject()
        po.name = 'saml2'
        po.wipe_data()

        po.wipe_config_values(FACILITY)
        config = {'idp storage path': path,
                  'idp metadata file': 'metadata.xml',
                  'idp certificate file': cert.cert,
                  'idp key file': cert.key,
                  'enabled': '1'}
        po.set_config(config)
        po.save_plugin_config(FACILITY)

        # Fixup permissions so only the ipsilon user can read these files
        files.fix_user_dirs(path, opts['system_user'])