summaryrefslogtreecommitdiffstats
path: root/ipsilon/providers/saml2
Commit message (Collapse)AuthorAgeFilesLines
* Convert SAML2 SP Provider UI to use Config objectRob Crittenden2015-04-101-1/+91
| | | | | | | | | | This makes the look-and-feel the same between the SAML2 configuration and the per-SP configuration. https://fedorahosted.org/ipsilon/ticket/25 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Print exceptions when saving data fails in admin UIRob Crittenden2015-04-101-1/+2
| | | | | | | | | | | There were places where a broad exception was caught when saving administrative changes but the actual exception wasn't logged. The user was presented only with a 'Failed to save data!' message. https://fedorahosted.org/ipsilon/ticket/39 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Validate SP names for admin pages and RESTNathan Kinder2015-04-012-11/+14
| | | | | | | | | | | | | | | | | | We were previously only validating the SP name in the admin pages for SP creation and update. The REST API would allow a SP to be created with an invalid name, which would break the ability to manage that SP in the admin pages. This patch moves the SP name validation logic out of the admin page code and centralizes it in the provider creation code. This ensures that validation will occur regardless of the interface that is used. In addition, a helper method is added to allow the admin page to check if a name is valid during update operations. https://fedorahosted.org/ipsilon/ticket/102 Signed-off-by: Nathan Kinder <nkinder@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* IdP-initiated logout for current userRob Crittenden2015-04-011-2/+9
| | | | | | | | | | | | | | Perform Single Logout for the current user when a logout is initiated in the IdP. A fake initial session is created. In the current logout code the initial logout requestor holds the final redirect URL. In this case it redirects back to the root IdP page. https://fedorahosted.org/ipsilon/ticket/87 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Try to return a redirect instead a 400 for "not logged in" stateRob Crittenden2015-03-271-9/+43
| | | | | | | | | | | | If the user is not logged in and submits a valid logout request then just redirect the user to the RelayState in the request indicating that the logout was successful. This provides a better user experience. https://fedorahosted.org/ipsilon/ticket/88 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Implement urn:oasis:names:tc:SAML:1.1:nameid-format:unspecifiedRob Crittenden2015-03-232-2/+2
| | | | | | | | | Return the name the user authenticated with. https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement urn:oasis:names:tc:SAML:2.0:nameid-format:persistentRob Crittenden2015-03-231-2/+11
| | | | | | | | | | This also makes persistent the default NameID format when generating metadata. https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement urn:oasis:names:tc:SAML:2.0:nameid-format:transientRob Crittenden2015-03-231-2/+2
| | | | | | | | | NameQualifier and SPNameQualifier are optional and are not included. https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* When a new logout session is received, save old session idsRob Crittenden2015-03-232-1/+23
| | | | | | | | | | | | | | | When a new login session is received and an existing session exists in logout, save the old session IDs. These will be included in the sessions to logout of the SP. This will ensure that if the user clears their cookie cache, for example, that any previous sessions will also be logged out. https://fedorahosted.org/ipsilon/ticket/64 Signed-off-by: Rob Crittenden <rcritten@redhat.com>
* Assertion AttributeStatements must be non-emptyJohn Dennis2015-03-181-8/+11
| | | | | | | | | | | | | | | The saml-core-2.0-os specification section 2.7.3 requires the AttributeStatement element to be non-empty. Shibboleth verifies this and rejects assertions that do not comply. We gather attributes into a local dict first before adding them to the AttributeStatement so the fix is easy. Test if the dict is empty, move the initialization of the assertion AttributeStatement inside the test so it's conditional on whether the dict has members. https://fedorahosted.org/ipsilon/ticket/61 Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Properly handle groups info in SAML providerSimo Sorce2015-03-171-0/+6
| | | | | | | | | Also removes internal attributes (any attribute that starts with _ Fixes: https://fedorahosted.org/ipsilon/ticket/71 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Require admin when accessing REST pagesRob Crittenden2015-03-031-0/+3
| | | | | Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Implement GET and POST REST API for Service ProvidersRob Crittenden2015-02-271-0/+107
| | | | | | | | | | | | | The mount point is /idp/rest/providers/saml2/SPS. GET .../SPS will retrieve all Service Providers GET .../SPS/foo will retrieve the Service Provider named foo POST .../SPS/foo will create the Service Provider named foo https://fedorahosted.org/ipsilon/ticket/26 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add support for attribute policies in samlidpSimo Sorce2015-02-241-2/+9
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Prefix userdata hives with _ to avoid conflictsSimo Sorce2015-02-241-11/+4
| | | | | | | | | | | The main userdata dict contains common attributes, but we add a sepcial groups list and unmapped extras, as well as indicators like auth_type. All these additional attributes are now prefixed by a _ character so that conflicts with legitimate attributes are improbable. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Implement Single Logout Service for SP-initiated logoutRob Crittenden2015-02-133-0/+290
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add SAML-specific session data for tracking login/logout sessionsRob Crittenden2015-02-131-0/+226
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix file permissions and remove shebang'sPatrick Uiterwijk2014-12-163-6/+0
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Use indirection to report error stringsSimo Sorce2014-11-121-13/+16
| | | | | | | This way if CSS/Code changes we have just one place to fix. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Show login target on the login screenPatrick Uiterwijk2014-10-241-1/+2
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add attribute mapping for user informationSimo Sorce2014-10-241-11/+26
| | | | | | | | | | | | When user information is retrieved we map any wellknown data to a standardized set of names. A ne InfoMapping class takes cares of helping the info modules to map the data they retrieve so that providers can find it in wellknown attribute names for further use. Mapping of attribute names for diplay purposes is also provided. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Move some exceptions into provider.commonSimo Sorce2014-10-241-15/+1
| | | | | | | | These are generically useful and can be rused as they are by other providers. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add AdminPage abstraction on top of util.PageSimo Sorce2014-10-071-6/+6
| | | | | | | | | | This is to allow different default headers between Admin pages and other pages. In particular we set no-caching headers to all admin pages to force browsers to refresh as often as possible. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix exposed functionsSimo Sorce2014-10-071-1/+1
| | | | | | | | | | | | The Page util is supposed to intercept and enable exposed pages on its own so that additional functions can be run in the generic __call__ Fix the code to check for the function argument correctly and use a different argument than the standard cherrypy one for admin pages so that we do actually land in the Page.__call__ all the time for those pages. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Use transactions throughout the codeSimo Sorce2014-09-241-14/+36
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for returning user attributesSimo Sorce2014-09-241-1/+23
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Allow deferred initialization of providersSimo Sorce2014-09-241-3/+7
| | | | | | | This fixes enabling a provider after the sever is started. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Restore ability to run from checkoutSimo Sorce2014-08-271-6/+7
| | | | | | | also adds quickrun.py script to make it easy. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Use new Log class everywhereSimo Sorce2014-08-271-11/+3
| | | | | | | | | Replace copies of _debug function sprinkled all over the code with a single implementation Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com> - Removed replace of self._debug to self.debug
* Add optional field to allow pasting the metadataSimo Sorce2014-06-041-1/+16
| | | | | | | This way a user can avoid copying the metadata file arund but paste the content straight from a terminal window. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix handling of SP renamesSimo Sorce2014-05-201-4/+5
| | | | | | Properly replace page self.url Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix E256 with stricter pep8 error checkerSimo Sorce2014-05-202-4/+4
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Convert all forms to use util.Page form supportSimo Sorce2014-04-211-12/+2
| | | | | | This way all forms will get Referer checking automaticaly Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix warningSimo Sorce2014-04-181-2/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix NameId exceptionSimo Sorce2014-04-151-2/+2
| | | | | | | Report what invalid name was used and fix exception on raising the exception on line 129 Signed-off-by: Simo Sorce <simo@redhat.com>
* Add nameid values validationSimo Sorce2014-04-142-0/+15
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Refactor argument validation for SP formsSimo Sorce2014-04-141-61/+105
| | | | | | | Use helper functions to make the code more readbale and exceptions to reduce error hndling duplication. Signed-off-by: Simo Sorce <simo@redhat.com>
* Validate Service Provider namesSimo Sorce2014-04-111-0/+16
| | | | | | We use the name to construct the admin page path, avoid odd characters Signed-off-by: Simo Sorce <simo@redhat.com>
* Move accessory functions to a generic tools moduleSimo Sorce2014-04-113-232/+4
| | | | | | | This will allow to easly share the module with install tools, without the need to install server side modules in clients Signed-off-by: Simo Sorce <simo@redhat.com>
* Add explicit error for Unknown ProvidersSimo Sorce2014-04-111-1/+11
| | | | | | This way the user will get a slightly more meaningful error message. Signed-off-by: Simo Sorce <simo@redhat.com>
* Properly support rename operationSimo Sorce2014-04-041-0/+9
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Admin functions to delete Service ProvidersSimo Sorce2014-04-042-0/+22
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Admin functions to add new Service ProvidersSimo Sorce2014-04-041-0/+78
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Admin classes to change SP propertiesSimo Sorce2014-04-041-1/+103
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Providers can save properties back to the databaseSimo Sorce2014-04-041-4/+43
| | | | | | | This way a provider class can be used in admin pages as well and remain consistent. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add Service and Identity Provider abstractionSimo Sorce2014-04-042-1/+60
| | | | | | | | | | | | This commit adds: - helper functions to create new providers - separate IdentityProvider class to represent the IDP. Database changes: The saml2 plugin database now contain the metadata file contents and does not rely anymore on on-disk data. Signed-off-by: Simo Sorce <simo@redhat.com>
* Saml2 initial admin pageSimo Sorce2014-03-281-0/+49
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Saml2 Metadata generator classSimo Sorce2014-03-201-0/+159
| | | | | | | | | | This class generates metadata files for IDP and SP services and is meant to be used at install/configure time. It uses the certs module to generate certificates. With tests! Signed-off-by: Simo Sorce <simo@redhat.com>
* Simple certificate generator classSimo Sorce2014-03-201-0/+57
| | | | | | | | For now just generates self-signed certificates. In future this calss should connect to a CA, or other service like certmnger's getcert to retrieve a certificate from a CA. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix minor syntax issues in saml2 providerSimo Sorce2014-03-192-2/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-27 21:33:40 +0000