summaryrefslogtreecommitdiffstats
path: root/ipsilon/providers/saml2/auth.py
Commit message (Collapse)AuthorAgeFilesLines
* Pull the GSSAPI principal out of the userattrsRob Crittenden2015-05-071-1/+2
| | | | | | | | | | This was originally getting the principal from the user object itself which meant it was looking for it in the database. Look in the attributes instead which are stored in the user session. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Drop usage of self._debug and use self.debug insteadRob Crittenden2015-05-051-6/+6
| | | | | | | | | This method was deprecated but still used in a lot of places. https://fedorahosted.org/ipsilon/ticket/120 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Change references to authkrb plugin to authgssapiRob Crittenden2015-04-281-1/+1
| | | | | | | | | With the switch to mod_auth_gssapi we aren't limited to only negotiated Kerberos so name the plugin to reflect this. https://fedorahosted.org/ipsilon/ticket/114 Signed-off-by: Rob Crittenden <rcritten@redhat.com>
* Add test for per-SP allowed and mapping attributesRob Crittenden2015-04-101-0/+2
| | | | | | | | | | | | This buidls up a specific global mapping and allowed attributes then creates an SP-specific configuration which differs enough to confirm that it is in fact overriding the default. It finishes by removing the per-SP configuration and ensuring that it falls back to the IdP-default. https://fedorahosted.org/ipsilon/ticket/25 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add per-SP attribute mapping and allowed attributesRob Crittenden2015-04-101-3/+14
| | | | | | | | | | The per-SP values are considered overrides and the global values are default. https://fedorahosted.org/ipsilon/ticket/25 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement urn:oasis:names:tc:SAML:1.1:nameid-format:unspecifiedRob Crittenden2015-03-231-0/+2
| | | | | | | | | Return the name the user authenticated with. https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement urn:oasis:names:tc:SAML:2.0:nameid-format:persistentRob Crittenden2015-03-231-2/+11
| | | | | | | | | | This also makes persistent the default NameID format when generating metadata. https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement urn:oasis:names:tc:SAML:2.0:nameid-format:transientRob Crittenden2015-03-231-2/+2
| | | | | | | | | NameQualifier and SPNameQualifier are optional and are not included. https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Assertion AttributeStatements must be non-emptyJohn Dennis2015-03-181-8/+11
| | | | | | | | | | | | | | | The saml-core-2.0-os specification section 2.7.3 requires the AttributeStatement element to be non-empty. Shibboleth verifies this and rejects assertions that do not comply. We gather attributes into a local dict first before adding them to the AttributeStatement so the fix is easy. Test if the dict is empty, move the initialization of the assertion AttributeStatement inside the test so it's conditional on whether the dict has members. https://fedorahosted.org/ipsilon/ticket/61 Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Properly handle groups info in SAML providerSimo Sorce2015-03-171-0/+6
| | | | | | | | | Also removes internal attributes (any attribute that starts with _ Fixes: https://fedorahosted.org/ipsilon/ticket/71 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Add support for attribute policies in samlidpSimo Sorce2015-02-241-2/+9
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Prefix userdata hives with _ to avoid conflictsSimo Sorce2015-02-241-11/+4
| | | | | | | | | | | The main userdata dict contains common attributes, but we add a sepcial groups list and unmapped extras, as well as indicators like auth_type. All these additional attributes are now prefixed by a _ character so that conflicts with legitimate attributes are improbable. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Implement Single Logout Service for SP-initiated logoutRob Crittenden2015-02-131-0/+19
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix file permissions and remove shebang'sPatrick Uiterwijk2014-12-161-2/+0
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Show login target on the login screenPatrick Uiterwijk2014-10-241-1/+2
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add attribute mapping for user informationSimo Sorce2014-10-241-11/+26
| | | | | | | | | | | | When user information is retrieved we map any wellknown data to a standardized set of names. A ne InfoMapping class takes cares of helping the info modules to map the data they retrieve so that providers can find it in wellknown attribute names for further use. Mapping of attribute names for diplay purposes is also provided. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Move some exceptions into provider.commonSimo Sorce2014-10-241-15/+1
| | | | | | | | These are generically useful and can be rused as they are by other providers. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Use transactions throughout the codeSimo Sorce2014-09-241-14/+36
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for returning user attributesSimo Sorce2014-09-241-1/+23
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix E256 with stricter pep8 error checkerSimo Sorce2014-05-201-2/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Add explicit error for Unknown ProvidersSimo Sorce2014-04-111-1/+11
| | | | | | This way the user will get a slightly more meaningful error message. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add Service and Identity Provider abstractionSimo Sorce2014-04-041-1/+1
| | | | | | | | | | | | This commit adds: - helper functions to create new providers - separate IdentityProvider class to represent the IDP. Database changes: The saml2 plugin database now contain the metadata file contents and does not rely anymore on on-disk data. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix minor syntax issues in saml2 providerSimo Sorce2014-03-191-1/+1
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Improve exceptions for saml2 providersSimo Sorce2014-03-021-11/+5
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Add ability to strip domain/realm per providerSimo Sorce2014-03-021-2/+4
| | | | | | | | | This allows to return (hopefully) the same name whether the user authenticated via ESSO or form based authentication. Crude for now, may be augmented with some regex configuration in the future. Signed-off-by: Simo Sorce <simo@redhat.com>
* Unsplit checking functionsSimo Sorce2014-03-021-12/+6
| | | | | | Easier to deal with stuff if they are a single validation function. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add a way to return the email address of the userSimo Sorce2014-03-021-0/+4
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Add way to return Kerberos nameid if availableSimo Sorce2014-03-021-1/+4
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Check the NameID policy during authenticationSimo Sorce2014-03-021-5/+31
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Add authentication exception supportSimo Sorce2014-02-261-5/+30
| | | | | | This also add code to return an error code to the SP. Signed-off-by: Simo Sorce <simo@redhat.com>
* Initial SAML2 providerSimo Sorce2014-02-241-0/+168
Signed-off-by: Simo Sorce <simo@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-08 10:58:56 +0000