summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Avoid attrs test flakines, stop using info_nssattrs-testSimo Sorce2015-02-241-4/+2
| | | | | | | | authtest already sets the fullname attribute, just use that one instead of relying on nss which, on test systems may have a completely empty gecos field, which makes the test fail. Signed-off-by: Simo Sorce <simo@redhat.com>
* Split tools between components that require themPatrick Uiterwijk2015-02-241-1/+5
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Signed-off-by: Simo Sorce <simo@redhat.com>
* __init__ needs to be in the main packagePatrick Uiterwijk2015-02-241-2/+1
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Bump spec filePatrick Uiterwijk2015-02-241-1/+5
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Do not require ipsilon-toolsPatrick Uiterwijk2015-02-241-1/+0
| | | | | | | If you want to install without the installer, it's not required Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Split the installer into -toolsPatrick Uiterwijk2015-02-241-4/+4
| | | | | | | The installer is not needed if you deploy with config management Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Split off authformPatrick Uiterwijk2015-02-241-2/+15
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make the configparser case sensitive.Patrick Uiterwijk2015-02-241-0/+1
| | | | | | | | Per the instructions of https://docs.python.org/2/library/configparser.html#ConfigParser.RawConfigParser.optionxform Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make available case insensitive mapping matchingSimo Sorce2015-02-241-19/+96
| | | | | | | | | | | | If ignore_case is True then the incomping attributes are matched case-insensitively in the policy engine. The CAse of the incoming attribute is not changed on wildcard matches. On ther matches attributes will be replaced according to the mapping tables and the case used will be that of the mapped attributes. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Use the new Policy engine for login/info mappingSimo Sorce2015-02-245-64/+45
| | | | | | | | The InfoMapping class is now only used to prettify the default set of wellknown attributes. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add dynamic list to plugin_config formsSimo Sorce2015-02-242-4/+40
| | | | | | | | | This little javascript allows us to dyamically add form fields in the ComplexList and MappingList tables. Makes it much easier to add elements to these lists. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Handle changing MappingList optionsSimo Sorce2015-02-241-0/+85
| | | | | | | | Add admin function to handle getting a MappingList object in form of key/value pair fields. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Handle changing ComplexList optionsSimo Sorce2015-02-241-0/+67
| | | | | | | | Add admin function to handle getting a ComplexList object in form of key/value pair fields. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Do not crash on failure to load configSimo Sorce2015-02-241-1/+5
| | | | | | | Just report an error and continue with default values. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for new options to plugin_config.htmlSimo Sorce2015-02-241-1/+56
| | | | | | | | This add support in the template for showing ComplexList and MappingList options. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for attribute policies in openidpSimo Sorce2015-02-243-3/+30
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for attribute policies in samlidpSimo Sorce2015-02-242-2/+25
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add config option to load mapping listsSimo Sorce2015-02-241-1/+47
| | | | | | | This requires careful handling, and should be used sparingly Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add Policy class to help filter attributesSimo Sorce2015-02-242-0/+320
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Prefix userdata hives with _ to avoid conflictsSimo Sorce2015-02-248-48/+41
| | | | | | | | | | | The main userdata dict contains common attributes, but we add a sepcial groups list and unmapped extras, as well as indicators like auth_type. All these additional attributes are now prefixed by a _ character so that conflicts with legitimate attributes are improbable. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Change attrs test to check for fullnameSimo Sorce2015-02-241-7/+3
| | | | | | | | We are not going to return 'extras' by default, and the only nss attribute mapped to the 'userdata' space is the gecos (as 'fullname') Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix typos in openid provider commentsSimo Sorce2015-02-241-2/+2
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix RPM field seperatorPatrick Uiterwijk2015-02-201-1/+1
| | | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add info plugin that utilizes Apache mod_lookup_identity pluginRob Crittenden2015-02-132-1/+199
| | | | | | | | | | mod_look_identity looks up identity information from sssd over dbus, making additional identity attributes available. https://fedorahosted.org/ipsilon/ticket/31 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Let the plugin configure calls notice failures.Rob Crittenden2015-02-131-4/+8
| | | | | | | | | | | | The call to configure the info/login/auth/provider plugins had no way of recognizing that the configuration failed. Have it check for an explicit False return value as an indication of failure. This lets the configuration plugin do a simple return (None) if it isn't enabled. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix typo in nss and infoldap info pluginsRob Crittenden2015-02-132-2/+2
| | | | | Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Test for Single Logout ServiceRob Crittenden2015-02-132-0/+177
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement Single Logout Service for SP-initiated logoutRob Crittenden2015-02-134-0/+313
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add SAML-specific session data for tracking login/logout sessionsRob Crittenden2015-02-131-0/+226
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Register SingleLogoutService SAML2 metadataRob Crittenden2015-02-131-0/+2
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add helper to store provider specific dataRob Crittenden2015-02-131-0/+16
| | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Ignore .rnd (openssl stuff)Patrick Uiterwijk2015-02-061-0/+1
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make test results more clearPatrick Uiterwijk2015-02-061-2/+5
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fall back to default templates dir if it does not exist in template_dirPatrick Uiterwijk2015-02-061-5/+13
| | | | | | | | This would enable people to only override the templates they care about overriding, like master.html, while still retaining the rest. Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Remove print lines from openidPatrick Uiterwijk2015-02-031-2/+0
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add the OpenID xrds template to setup.pyPatrick Uiterwijk2015-02-031-1/+1
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add expiration to Idp metadataSimo Sorce2015-01-292-6/+41
| | | | | | | | Also regenerate it frequently, so that any change in configuration can be automatically reflected in the metadata downloaded my clients over time. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add Metadata Generator helper classSimo Sorce2015-01-291-16/+24
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for expiration in MetadataSimo Sorce2015-01-291-4/+28
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add function to import a cert from a fileSimo Sorce2015-01-291-0/+4
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Update spec file after Fedora reviewPatrick Uiterwijk2015-01-281-34/+119
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix request multipart logging when only 1 part is presentJohn Dennis2015-01-271-10/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | Test to see if the request parameter value is a cherrypy Part class. This was already being done for the case where the value was a list, but it was omitted for single values. Logic was combined into new local function print_param(). Changed the test for the class back to using if isinstance(item, cherrypy._cpreqbody.Part): instead of: if getattr(item, "part_class", None): because using isinstance() clearly indicates what is being done. The use of getattr() was introduced to prevent a pylint warning concering use of protected values. The getattr() hack is confusing and proably not robust if the class implementation changes. The patch now disables this warning. I cannot explain why cherrypy marks these modules as protected when clearly one has to utilize them and they are documented in the cherrypy API doc. Disabling the warning seems the cleanest and most robust approach. Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix int/pep8 errors in latest patchesSimo Sorce2015-01-261-9/+11
| | | | | | | Mea culpa for not checking before pushing Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: John Dennis <jdennis@redhat.com>
* Add source code context information to debug logsJohn Dennis2015-01-261-3/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The log.debug() function helpfully adds the name of the function invoking it but in a complicated software package there are many functions/methods which share the same name. Thus a debug message like this: DEBUG(__init__): xxx does not give you much context, there are probably hundreds of __init__ methods. It would help to qualify the method name which it's class name, that gives a lot more context when reading the log. Sometimes it's also helpful to know the file and line number. This patch adds the class name to the function and included the filename and line number as well. The file path is trimmed to the last 3 components, sufficient to give context but not too verbose. Now the debug message might look like this instead: DEBUG(ipsilon/providers/common.py:129 LoadProviders.__init__()): xxx Also included is a config option 'stacktrace_on_error' which will include a stacktrace when the log.error function is called. It can be very useful to see a stacktrace when logging an error, it defaults to off. Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add request/response logging via cherrypy tool hooksJohn Dennis2015-01-263-0/+240
| | | | | | | | | | | | | | | | | | | | | | The ability to easily review the HTTP Ipsilon request and response is boon for development and issue debugging. Normally these HTTP conversations occur on SSL/TLS encrypted connections making it difficult to use other tools to view the traffic. Client side tools have known pitfalls (e.g. Firebug) and not all conversations are browser initiated (e.g. SAML ECP). Logging performed by the server hosting Ipsilon makes logging at the server level server specific (e.g. Apache's dumpio requires post-processing the log file to extract and reassamble the HTTP conversation). The best place to log requests and responses is within Ipsilon using the cherrypy framework Ipsilon is embedded in. Cherrypy provides user defined hooks that can be invoked at specific places in the request pipeline. We establish a hook at the last stage just before the response is written to the client, it logs the incoming request and outgoing response. Resolves: https://fedorahosted.org/ipsilon/ticket/44 Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix a copy-paste errorPatrick Uiterwijk2015-01-221-1/+1
| | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix some copy-paste errors in help outputPatrick Uiterwijk2015-01-192-2/+2
| | | | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com> https://fedorahosted.org/ipsilon/ticket/33
* Use referer too as source of transaction IDsSimo Sorce2015-01-162-6/+37
| | | | | | | | | This allows us to use apache module that use things like ErrorDocument directives to do internal redirects and still retain the original transaction intact. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix file permissions and remove shebang'sPatrick Uiterwijk2014-12-1646-92/+0
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Bump RPM spec version to 0.3.0Simo Sorce2014-12-121-1/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-26 04:49:11 +0000