summaryrefslogtreecommitdiffstats
path: root/ipsilon/util
Commit message (Collapse)AuthorAgeFilesLines
* Use python logging in install / log cherrypy at right severityRob Crittenden2015-05-074-7/+15
| | | | | | | | | | | | | | | | This replaces the print statements in the installer code with a python logger so we can log all output to the installer log and a subset of it to stdout in one step without duplication. The cherrypy.log.error() logs to the "error" log at a severity of logging.INFO by default. Set an appropriate log level for these as well. https://fedorahosted.org/ipsilon/ticket/35 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Drop usage of self._debug and use self.debug insteadRob Crittenden2015-05-054-16/+16
| | | | | | | | | This method was deprecated but still used in a lot of places. https://fedorahosted.org/ipsilon/ticket/120 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Disallow iframes via X-Frame-Options and CSP by defaultRob Crittenden2015-04-241-0/+20
| | | | | | | | | | | | | | A decorator, allow_iframe, is also created so that specific pages can remove the deny values and allow operating within a frame. The Persona plugin relies on iframes and uses this decorator for all endpoints. https://fedorahosted.org/ipsilon/ticket/15 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Close database sesssionsPatrick Uiterwijk2015-04-151-3/+33
| | | | | | | | | | This will close any opened database sessions at the end of the request. https://fedorahosted.org/ipsilon/ticket/110 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* The last allowed/mapping rule can be removed in SPsRob Crittenden2015-04-102-3/+11
| | | | | | | | | | | If you created rule(s) in an SP for either allowed attributes or attribute mapping there was no way to remove the last rule meaning it could never go back to use the global defaults. https://fedorahosted.org/ipsilon/ticket/25 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Rename and move PluginConfig to ConfigHelperRob Crittenden2015-04-102-39/+38
| | | | | | | | | | | The configuration class was originally intended to be tied. At this point it is quite generic and useful outside of plugins. Rename it to something more generic and move it into the config module. https://fedorahosted.org/ipsilon/ticket/25 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add options to explicitly set database uris during installPatrick Uiterwijk2015-03-301-0/+1
| | | | | | | | | Also offer the option to set the OpenID database URI during install https://fedorahosted.org/ipsilon/ticket/17 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Set Cache-control on all generated pages, centralize in EndpointRob Crittenden2015-03-192-2/+4
| | | | | | | | | | See "Bindings for the OASIS Security Assertion Markup Language (SAML) V2.0" section 3.2.3.2. https://fedorahosted.org/ipsilon/ticket/7 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Save user attributes on subsequent calls to login.Rob Crittenden2015-03-161-0/+2
| | | | | | | | | | | | | | | | | When a login comes in via the remote_login() call no user attributes are set. These may be later filled in by a subsequent call to login() after the info plugins are called but a short-circuit in that function exits if the user matches the current session. Add an extra conditional such that if the user matches, userattributes are passed in and the current user attributes for this user is empty then save the new data. https://fedorahosted.org/ipsilon/ticket/86 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Don't explicitly save sessionsNathan Kinder2015-03-121-4/+0
| | | | | | | | | | | | | | | | | Saving a session causes it to be unlocked, but sessions have a hook that also performs a save just before the session is finalized. In CherryPy 3.3.0 and later, an assertion was added to ensure that a session is locked when trying to perform a save. Since we perform explicit saves in our code, this causes the assertion to be tripped when the hook executes. This patch removes our explicit save calls. We should rely on the hook to save and unlock the session. https://fedorahosted.org/ipsilon/ticket/84 Signed-off-by: Nathan Kinder <nkinder@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Proper fallback from referer to REQUEST_URISimo Sorce2015-03-121-2/+4
| | | | | | | | | | | | If the referer is present but does not contain a transaction ID we still need to fallback to the REQUEST_URI. Fix the code to check the url and then fallback to REQUEST_URI rathe than decide upfront merely on the fact a referer is available. https://fedorahosted.org/ipsilon/ticket/74 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Find transaction ids for internal redirectsSimo Sorce2015-03-061-2/+8
| | | | | | | | | | | On internal redirections, such as when ErrorDocument is used to redirect on failed negotiate authentication we need to look harder for the transaction id. Ticket: #74 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Change root class of Page from Log to EndpointRob Crittenden2015-02-271-2/+3
| | | | | Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Low-level class for managing request endpointsRob Crittenden2015-02-271-0/+82
| | | | | | | | | | | An Endpoint is different from a Page in that it doesn't have menus, templates, transactions, etc. It is only defines a URL that can be mounted. https://fedorahosted.org/ipsilon/ticket/38 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make the configparser case sensitive.Patrick Uiterwijk2015-02-241-0/+1
| | | | | | | | Per the instructions of https://docs.python.org/2/library/configparser.html#ConfigParser.RawConfigParser.optionxform Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make available case insensitive mapping matchingSimo Sorce2015-02-241-19/+96
| | | | | | | | | | | | If ignore_case is True then the incomping attributes are matched case-insensitively in the policy engine. The CAse of the incoming attribute is not changed on wildcard matches. On ther matches attributes will be replaced according to the mapping tables and the case used will be that of the mapped attributes. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Do not crash on failure to load configSimo Sorce2015-02-241-1/+5
| | | | | | | Just report an error and continue with default values. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add config option to load mapping listsSimo Sorce2015-02-241-1/+47
| | | | | | | This requires careful handling, and should be used sparingly Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add Policy class to help filter attributesSimo Sorce2015-02-241-0/+319
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add helper to store provider specific dataRob Crittenden2015-02-131-0/+16
| | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add expiration to Idp metadataSimo Sorce2015-01-291-1/+9
| | | | | | | | Also regenerate it frequently, so that any change in configuration can be automatically reflected in the metadata downloaded my clients over time. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix request multipart logging when only 1 part is presentJohn Dennis2015-01-271-10/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | Test to see if the request parameter value is a cherrypy Part class. This was already being done for the case where the value was a list, but it was omitted for single values. Logic was combined into new local function print_param(). Changed the test for the class back to using if isinstance(item, cherrypy._cpreqbody.Part): instead of: if getattr(item, "part_class", None): because using isinstance() clearly indicates what is being done. The use of getattr() was introduced to prevent a pylint warning concering use of protected values. The getattr() hack is confusing and proably not robust if the class implementation changes. The patch now disables this warning. I cannot explain why cherrypy marks these modules as protected when clearly one has to utilize them and they are documented in the cherrypy API doc. Disabling the warning seems the cleanest and most robust approach. Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix int/pep8 errors in latest patchesSimo Sorce2015-01-261-9/+11
| | | | | | | Mea culpa for not checking before pushing Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: John Dennis <jdennis@redhat.com>
* Add source code context information to debug logsJohn Dennis2015-01-261-3/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The log.debug() function helpfully adds the name of the function invoking it but in a complicated software package there are many functions/methods which share the same name. Thus a debug message like this: DEBUG(__init__): xxx does not give you much context, there are probably hundreds of __init__ methods. It would help to qualify the method name which it's class name, that gives a lot more context when reading the log. Sometimes it's also helpful to know the file and line number. This patch adds the class name to the function and included the filename and line number as well. The file path is trimmed to the last 3 components, sufficient to give context but not too verbose. Now the debug message might look like this instead: DEBUG(ipsilon/providers/common.py:129 LoadProviders.__init__()): xxx Also included is a config option 'stacktrace_on_error' which will include a stacktrace when the log.error function is called. It can be very useful to see a stacktrace when logging an error, it defaults to off. Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add request/response logging via cherrypy tool hooksJohn Dennis2015-01-261-0/+238
| | | | | | | | | | | | | | | | | | | | | | The ability to easily review the HTTP Ipsilon request and response is boon for development and issue debugging. Normally these HTTP conversations occur on SSL/TLS encrypted connections making it difficult to use other tools to view the traffic. Client side tools have known pitfalls (e.g. Firebug) and not all conversations are browser initiated (e.g. SAML ECP). Logging performed by the server hosting Ipsilon makes logging at the server level server specific (e.g. Apache's dumpio requires post-processing the log file to extract and reassamble the HTTP conversation). The best place to log requests and responses is within Ipsilon using the cherrypy framework Ipsilon is embedded in. Cherrypy provides user defined hooks that can be invoked at specific places in the request pipeline. We establish a hook at the last stage just before the response is written to the client, it logs the incoming request and outgoing response. Resolves: https://fedorahosted.org/ipsilon/ticket/44 Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Use referer too as source of transaction IDsSimo Sorce2015-01-162-6/+37
| | | | | | | | | This allows us to use apache module that use things like ErrorDocument directives to do internal redirects and still retain the original transaction intact. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix file permissions and remove shebang'sPatrick Uiterwijk2014-12-1610-20/+0
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add defaults to List objectsSimo Sorce2014-12-051-0/+2
| | | | | | | | Otherwise we get backtraces when checking for list members and no configuration have been stored in the database yet. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Allow to pass drectly a URL to the Store classSimo Sorce2014-12-051-4/+9
| | | | | | | | This is useful for plugins that want to use their own database configuration but still want to reuse he Store class for simplicity. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Return proper errors if config is read-onlySimo Sorce2014-11-121-0/+8
| | | | | | | | Do not throw 501 errors, instead return warnings that the configuration changes cannot be applied. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add option to source configuration from a fileSimo Sorce2014-11-121-6/+129
| | | | | | | | | | | | | | | | If the configfile:// schema is used, the data is sourced from an ini style config file instead of being read from a database. The tables in this data source will be considered read-only and all modification functions will throw exceptions. Only 2 and 3 columns tables are supported, and the first column values must not contain spaces (typically a name/identifier). The adminconfig db is the only supported one at this time. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Remove unused optionSimo Sorce2014-11-121-4/+2
| | | | | | | Autotable is always enabled, so remove the option and just alays use it. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Make internal functions privateSimo Sorce2014-11-121-6/+6
| | | | | | | | load_data and reset_data are used only internally, turn them into private functions Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Remove unused functionSimo Sorce2014-11-121-3/+0
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Refactor plugin initialization and enablementSimo Sorce2014-11-121-43/+94
| | | | | | | | | | | | Move most plugin enablement and initialization code in plugin.py to reduce code duplication and simplify and unifify plugin enablement for all base plugin types (login, info, providers). This patch breaks backwards compatibility as it changes how the list of enabled plugins is stored in the database tables. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Refactor plugin configurationSimo Sorce2014-11-122-98/+60
| | | | | | | | | | | | | | | Fork a PluginConfig class out of PluginObject, the base object now supports a simple dictionary config, while using PluginConfig provide access to structured util.config based configuration. Change UI code that deal with plugins configuration to properly use the new structured config objects in order to represent data in appropriate format based on the data type. Use the new util.config objects to represent plugins configuration. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add config utilities to represent data typesSimo Sorce2014-11-121-0/+297
| | | | | | | | This will be used to properly format data in configuration UIs, and to properly import/export data from/to th database for internal use. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add simple SqlSession implementationSimo Sorce2014-11-121-0/+74
| | | | | | | | This allows us to store session data in the DB. This way session data can be shared by multiple servers behind a balancer. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Allow to call forms from any of the admin pagesSimo Sorce2014-10-271-6/+15
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Properly handle empty values in storageSimo Sorce2014-10-241-1/+1
| | | | | | | | Do not return default values if an actual empty string is found in the database. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Handle invalid/expired transactions gracefullySimo Sorce2014-10-241-0/+8
| | | | | | | | | Return a useful error page every time and invalid or expired transaction is requested, instead of ending up with an internal backtrace and an ugly 500 error. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Handle lists type options in plugins configurationSimo Sorce2014-10-241-0/+24
| | | | | | | | Autodetect and convert config values based on the options definition. If the option is marked as list split a string on setting the configuration or join the list into a string before saving it to the database. Signed-off-by: Simo Sorce <simo@redhat.com>
* Do not overwrite default plugin optionsSimo Sorce2014-10-241-2/+12
| | | | | | | | | Change the admin plugin to not overwrite the plugin default options, and only use the sanctioned pluginObject interfaces to read/write config values. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add helpers to store per plugin user preferencesSimo Sorce2014-10-242-2/+19
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add auto-auth requirement to all admin pagesSimo Sorce2014-10-071-10/+4
| | | | | | | | | | Instead ofhaving to explicitly decorate all methods with auth_protect() use the fact all pages go through Page.__call__ to conditionally check if the user is anoynous and set a default when instantiating AdminPage so that all admin pages require authentication. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add way to set default headersSimo Sorce2014-10-071-0/+3
| | | | | | | | When a Page is called automatically sets default headers by adding headers on the default_headers variable. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add pretty handler for 404Simo Sorce2014-10-072-1/+8
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix exposed functionsSimo Sorce2014-10-071-1/+1
| | | | | | | | | | | | The Page util is supposed to intercept and enable exposed pages on its own so that additional functions can be run in the generic __call__ Fix the code to check for the function argument correctly and use a different argument than the standard cherrypy one for admin pages so that we do actually land in the Page.__call__ all the time for those pages. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Redirect anonymous users awaySimo Sorce2014-10-061-0/+10
| | | | | | | | | It makes no sense to let anonymous users interact with the admin pages so tighten up access and redirect away users that have no rights. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Additional data store refactoringSimo Sorce2014-10-061-170/+153
| | | | | | | | | | | Use sqlalchemy to access Sql databases, which are the only implemented database backends for now. If no database type is specified we assume a sqlite3 database file path is configured (this is backwards compatible with current configuration statements) Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-06 21:32:21 +0000