summaryrefslogtreecommitdiffstats
path: root/ipsilon/providers
Commit message (Collapse)AuthorAgeFilesLines
* Drop usage of self._debug and use self.debug insteadRob Crittenden2015-05-058-42/+42
| | | | | | | | | This method was deprecated but still used in a lot of places. https://fedorahosted.org/ipsilon/ticket/120 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Change references to authkrb plugin to authgssapiRob Crittenden2015-04-282-2/+2
| | | | | | | | | With the switch to mod_auth_gssapi we aren't limited to only negotiated Kerberos so name the plugin to reflect this. https://fedorahosted.org/ipsilon/ticket/114 Signed-off-by: Rob Crittenden <rcritten@redhat.com>
* Add OpenID test suitePatrick Uiterwijk2015-04-281-2/+5
| | | | | | | | | | | This tests core OpenID and the Attribute Exchange, Simple Registration and Teams extensions. Using a small wsgi tool because mod_auth_openid does not support all extensions. Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Fix OpenID AX extension bugPatrick Uiterwijk2015-04-281-1/+3
| | | | | | | | This makes sure that _display returns a dict, and that the result from _resp can still be passed to addExtension Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Disallow iframes via X-Frame-Options and CSP by defaultRob Crittenden2015-04-241-0/+5
| | | | | | | | | | | | | | A decorator, allow_iframe, is also created so that specific pages can remove the deny values and allow operating within a frame. The Persona plugin relies on iframes and uses this decorator for all endpoints. https://fedorahosted.org/ipsilon/ticket/15 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Use the new transaction convenience function in PersonaPatrick Uiterwijk2015-04-241-10/+1
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add test for per-SP allowed and mapping attributesRob Crittenden2015-04-101-0/+2
| | | | | | | | | | | | This buidls up a specific global mapping and allowed attributes then creates an SP-specific configuration which differs enough to confirm that it is in fact overriding the default. It finishes by removing the per-SP configuration and ensuring that it falls back to the IdP-default. https://fedorahosted.org/ipsilon/ticket/25 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* The last allowed/mapping rule can be removed in SPsRob Crittenden2015-04-101-22/+30
| | | | | | | | | | | If you created rule(s) in an SP for either allowed attributes or attribute mapping there was no way to remove the last rule meaning it could never go back to use the global defaults. https://fedorahosted.org/ipsilon/ticket/25 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add per-SP attribute mapping and allowed attributesRob Crittenden2015-04-102-123/+130
| | | | | | | | | | The per-SP values are considered overrides and the global values are default. https://fedorahosted.org/ipsilon/ticket/25 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Rename and move PluginConfig to ConfigHelperRob Crittenden2015-04-102-5/+6
| | | | | | | | | | | The configuration class was originally intended to be tied. At this point it is quite generic and useful outside of plugins. Rename it to something more generic and move it into the config module. https://fedorahosted.org/ipsilon/ticket/25 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Convert SAML2 SP Provider UI to use Config objectRob Crittenden2015-04-101-1/+91
| | | | | | | | | | This makes the look-and-feel the same between the SAML2 configuration and the per-SP configuration. https://fedorahosted.org/ipsilon/ticket/25 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Print exceptions when saving data fails in admin UIRob Crittenden2015-04-101-1/+2
| | | | | | | | | | | There were places where a broad exception was caught when saving administrative changes but the actual exception wasn't logged. The user was presented only with a 'Failed to save data!' message. https://fedorahosted.org/ipsilon/ticket/39 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* This was renamed to _groups internallyPatrick Uiterwijk2015-04-102-3/+3
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Extend default SAML IdP metadata validity periodNathan Kinder2015-04-091-8/+26
| | | | | | | | | | | | | | | Our current default IdP metadata validity period is hardcoded to 30 days. This is very limiting for anything other than a test environment unless there is a way to allow SPs to automatically fetch updated metadata on a regular interval. This patch increases the default validity period to 5 years. In addition, a new option for ipsilon-server-install is provided to allow a different validity period to be specified. https://fedorahosted.org/ipsilon/ticket/103 Signed-off-by: Nathan Kinder <nkinder@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Validate SP names for admin pages and RESTNathan Kinder2015-04-012-11/+14
| | | | | | | | | | | | | | | | | | We were previously only validating the SP name in the admin pages for SP creation and update. The REST API would allow a SP to be created with an invalid name, which would break the ability to manage that SP in the admin pages. This patch moves the SP name validation logic out of the admin page code and centralizes it in the provider creation code. This ensures that validation will occur regardless of the interface that is used. In addition, a helper method is added to allow the admin page to check if a name is valid during update operations. https://fedorahosted.org/ipsilon/ticket/102 Signed-off-by: Nathan Kinder <nkinder@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* IdP-initiated logout for current userRob Crittenden2015-04-012-2/+50
| | | | | | | | | | | | | | Perform Single Logout for the current user when a logout is initiated in the IdP. A fake initial session is created. In the current logout code the initial logout requestor holds the final redirect URL. In this case it redirects back to the root IdP page. https://fedorahosted.org/ipsilon/ticket/87 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Add options to explicitly set database uris during installPatrick Uiterwijk2015-03-301-1/+6
| | | | | | | | | Also offer the option to set the OpenID database URI during install https://fedorahosted.org/ipsilon/ticket/17 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add a method to Installer classes to validate argument inputRob Crittenden2015-03-271-0/+3
| | | | | | | | | | | | There was no way to validate argument input from plugins and cause the installer to bail out. If a plugin needs to validate some input it can use the validate_args() method and raise ConfigurationError() if an issue is found. https://fedorahosted.org/ipsilon/ticket/78 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Try to return a redirect instead a 400 for "not logged in" stateRob Crittenden2015-03-271-9/+43
| | | | | | | | | | | | If the user is not logged in and submits a valid logout request then just redirect the user to the RelayState in the request indicating that the logout was successful. This provides a better user experience. https://fedorahosted.org/ipsilon/ticket/88 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Make unspecified the default Name ID format, add to enabled listRob Crittenden2015-03-231-2/+3
| | | | | | | https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement urn:oasis:names:tc:SAML:1.1:nameid-format:unspecifiedRob Crittenden2015-03-232-2/+2
| | | | | | | | | Return the name the user authenticated with. https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement urn:oasis:names:tc:SAML:2.0:nameid-format:persistentRob Crittenden2015-03-232-5/+24
| | | | | | | | | | This also makes persistent the default NameID format when generating metadata. https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement urn:oasis:names:tc:SAML:2.0:nameid-format:transientRob Crittenden2015-03-231-2/+2
| | | | | | | | | NameQualifier and SPNameQualifier are optional and are not included. https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* When a new logout session is received, save old session idsRob Crittenden2015-03-232-1/+23
| | | | | | | | | | | | | | | When a new login session is received and an existing session exists in logout, save the old session IDs. These will be included in the sessions to logout of the SP. This will ensure that if the user clears their cookie cache, for example, that any previous sessions will also be logged out. https://fedorahosted.org/ipsilon/ticket/64 Signed-off-by: Rob Crittenden <rcritten@redhat.com>
* Set Cache-control on all generated pages, centralize in EndpointRob Crittenden2015-03-191-5/+0
| | | | | | | | | | See "Bindings for the OASIS Security Assertion Markup Language (SAML) V2.0" section 3.2.3.2. https://fedorahosted.org/ipsilon/ticket/7 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Assertion AttributeStatements must be non-emptyJohn Dennis2015-03-181-8/+11
| | | | | | | | | | | | | | | The saml-core-2.0-os specification section 2.7.3 requires the AttributeStatement element to be non-empty. Shibboleth verifies this and rejects assertions that do not comply. We gather attributes into a local dict first before adding them to the AttributeStatement so the fix is easy. Test if the dict is empty, move the initialization of the assertion AttributeStatement inside the test so it's conditional on whether the dict has members. https://fedorahosted.org/ipsilon/ticket/61 Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Properly handle groups info in SAML providerSimo Sorce2015-03-171-0/+6
| | | | | | | | | Also removes internal attributes (any attribute that starts with _ Fixes: https://fedorahosted.org/ipsilon/ticket/71 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Require admin when accessing REST pagesRob Crittenden2015-03-032-0/+8
| | | | | Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Load and initialize REST in the SAML2 pluginRob Crittenden2015-02-271-0/+3
| | | | | | | https://fedorahosted.org/ipsilon/ticket/26 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement GET and POST REST API for Service ProvidersRob Crittenden2015-02-271-0/+107
| | | | | | | | | | | | | The mount point is /idp/rest/providers/saml2/SPS. GET .../SPS will retrieve all Service Providers GET .../SPS/foo will retrieve the Service Provider named foo POST .../SPS/foo will create the Service Provider named foo https://fedorahosted.org/ipsilon/ticket/26 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add base REST provider framework classesRob Crittenden2015-02-271-0/+41
| | | | | | | | | | | These classes handle mounting the REST plugins. The starting mount point is: /idp/rest/providers https://fedorahosted.org/ipsilon/ticket/26 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add uninstallation support.Patrick Uiterwijk2015-02-264-9/+26
| | | | | | | | | As part of this, made all plugins use a Installer baseclass. https://fedorahosted.org/ipsilon/ticket/38 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add support for attribute policies in openidpSimo Sorce2015-02-243-3/+30
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for attribute policies in samlidpSimo Sorce2015-02-242-2/+25
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Prefix userdata hives with _ to avoid conflictsSimo Sorce2015-02-242-12/+5
| | | | | | | | | | | The main userdata dict contains common attributes, but we add a sepcial groups list and unmapped extras, as well as indicators like auth_type. All these additional attributes are now prefixed by a _ character so that conflicts with legitimate attributes are improbable. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix typos in openid provider commentsSimo Sorce2015-02-241-2/+2
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Implement Single Logout Service for SP-initiated logoutRob Crittenden2015-02-134-0/+313
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add SAML-specific session data for tracking login/logout sessionsRob Crittenden2015-02-131-0/+226
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Register SingleLogoutService SAML2 metadataRob Crittenden2015-02-131-0/+2
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Remove print lines from openidPatrick Uiterwijk2015-02-031-2/+0
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add expiration to Idp metadataSimo Sorce2015-01-291-5/+32
| | | | | | | | Also regenerate it frequently, so that any change in configuration can be automatically reflected in the metadata downloaded my clients over time. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add Metadata Generator helper classSimo Sorce2015-01-291-16/+24
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix file permissions and remove shebang'sPatrick Uiterwijk2014-12-1617-34/+0
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make pep8 happy againSimo Sorce2014-12-051-0/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add OpenIDStore to store associations and noncesPatrick Uiterwijk2014-12-052-3/+88
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add support for Persona Identity ProviderPatrick Uiterwijk2014-11-143-0/+282
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make sure the XRDS is returned as stringPatrick Uiterwijk2014-11-131-1/+1
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Delay exposing OpenIDPatrick Uiterwijk2014-11-131-5/+5
| | | | | | | | This makes sure we have loaded the configuration before using it Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Use indirection to report error stringsSimo Sorce2014-11-121-13/+16
| | | | | | | This way if CSS/Code changes we have just one place to fix. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Refactor plugin initialization and enablementSimo Sorce2014-11-129-102/+64
| | | | | | | | | | | | Move most plugin enablement and initialization code in plugin.py to reduce code duplication and simplify and unifify plugin enablement for all base plugin types (login, info, providers). This patch breaks backwards compatibility as it changes how the list of enabled plugins is stored in the database tables. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-26 09:52:09 +0000