summaryrefslogtreecommitdiffstats
path: root/ipsilon
Commit message (Collapse)AuthorAgeFilesLines
* Make the template directory configurablePatrick Uiterwijk2014-10-241-1/+5
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Show login target on the login screenPatrick Uiterwijk2014-10-243-2/+7
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Drop custom FAS templateSimo Sorce2014-10-241-1/+1
| | | | | | | | The form and fas template are identical so just drop the fas.html template and use the default. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add group and CLA support to FAS login pluginSimo Sorce2014-10-241-1/+39
| | | | | | | | | | | Add support for returning groups and other information from the FAS login plugin. If the openid module is available also split out cla group information into a spearate item so the openid CLA extension can make use of it and cla groups are not regarded as real groups. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add OpenId extensionsSimo Sorce2014-10-245-0/+193
| | | | | | | | | | | | Implement: Simple Registration Attribute Exchange (Fedora) Teams CLAs Signed-off-by: Simo Sorce <simo@redhat.com> Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add attribute mapping for user informationSimo Sorce2014-10-249-34/+194
| | | | | | | | | | | | When user information is retrieved we map any wellknown data to a standardized set of names. A ne InfoMapping class takes cares of helping the info modules to map the data they retrieve so that providers can find it in wellknown attribute names for further use. Mapping of attribute names for diplay purposes is also provided. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add OpenIDP ProviderPatrick Uiterwijk2014-10-247-1/+584
| | | | | | | | | | This commit implements all the core functionality needed to expose an OpenID Identity Provider including a framework to dynamycally add extensions. Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Handle lists type options in plugins configurationSimo Sorce2014-10-241-0/+24
| | | | | | | | Autodetect and convert config values based on the options definition. If the option is marked as list split a string on setting the configuration or join the list into a string before saving it to the database. Signed-off-by: Simo Sorce <simo@redhat.com>
* Do not overwrite default plugin optionsSimo Sorce2014-10-242-27/+36
| | | | | | | | | Change the admin plugin to not overwrite the plugin default options, and only use the sanctioned pluginObject interfaces to read/write config values. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add helpers to store per plugin user preferencesSimo Sorce2014-10-242-2/+19
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Move some exceptions into provider.commonSimo Sorce2014-10-242-15/+16
| | | | | | | | These are generically useful and can be rused as they are by other providers. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix storing info plugin status and orderSimo Sorce2014-10-242-22/+40
| | | | | | | | This is the same issue already resolved for the login plugins in commit a6ed2bba137df5fb8a9fb2931ccb2d92ca3fa0e0 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix mod_auth_kerb based authenticationSimo Sorce2014-10-091-1/+5
| | | | | | | | Recent changes in how self.user is populated broke krb based auth. Explicitly check the remote user in the module to fix it. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add auto-auth requirement to all admin pagesSimo Sorce2014-10-075-18/+9
| | | | | | | | | | Instead ofhaving to explicitly decorate all methods with auth_protect() use the fact all pages go through Page.__call__ to conditionally check if the user is anoynous and set a default when instantiating AdminPage so that all admin pages require authentication. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add AdminPage abstraction on top of util.PageSimo Sorce2014-10-076-18/+29
| | | | | | | | | | This is to allow different default headers between Admin pages and other pages. In particular we set no-caching headers to all admin pages to force browsers to refresh as often as possible. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add way to set default headersSimo Sorce2014-10-071-0/+3
| | | | | | | | When a Page is called automatically sets default headers by adding headers on the default_headers variable. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add pretty handler for 404Simo Sorce2014-10-073-1/+9
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix exposed functionsSimo Sorce2014-10-075-8/+8
| | | | | | | | | | | | The Page util is supposed to intercept and enable exposed pages on its own so that additional functions can be run in the generic __call__ Fix the code to check for the function argument correctly and use a different argument than the standard cherrypy one for admin pages so that we do actually land in the Page.__call__ all the time for those pages. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Redirect anonymous users awaySimo Sorce2014-10-065-3/+24
| | | | | | | | | It makes no sense to let anonymous users interact with the admin pages so tighten up access and redirect away users that have no rights. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Additional data store refactoringSimo Sorce2014-10-061-170/+153
| | | | | | | | | | | Use sqlalchemy to access Sql databases, which are the only implemented database backends for now. If no database type is specified we assume a sqlite3 database file path is configured (this is backwards compatible with current configuration statements) Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix storing login plugin status and orderSimo Sorce2014-10-061-6/+25
| | | | | | | | | | | | When plugins were enabled or disabled their status was not stored in the database, unless the order was explicitly manipulated. Moreover if the order was changed that fact would not be refrlected in the actual authntication order until a restart. Fix the code to always permanently store the enabled/disabled status, and to immediately change the authentication order. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Move wipe_data into Store() as reset_dataSimo Sorce2014-10-061-15/+19
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Databases must be configured in cherrypy.configSimo Sorce2014-10-061-34/+8
| | | | | | | | There was annoying duplicated init code in the data store classes that was unused. Just require configuration to be present in cherrypy.config or bail. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Make Transaction code more robustSimo Sorce2014-10-061-6/+8
| | | | | | | | Avoid raising exceptions when transactions are not found, just return no cookies or empty dicts with no transactions in them. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix transaction handling in providersSimo Sorce2014-10-062-3/+6
| | | | | | | | | | | | When a provider redirects to the login code, it must retain 'ownership' of the transaction, otherwise the login code will wipe the transaction data as sson as the authentication is completed but before the provider has completed its part of the transaction. Make sure the transaction code retrieves the 'owner' from the data for pre-existing transactions. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix login session's userdata acquisitionSimo Sorce2014-10-061-1/+3
| | | | | | | | | With the transaction code changes th session.login() function was incorrectly moved before all the userdata was gathered. An incomplete set was stored in the session. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add very simple LDAP authentication pluginSimo Sorce2014-09-242-0/+393
| | | | | | | | Uses python-ldap to perform a simple bind after connecting to the LDAP server using (by default) a TLS encrypted connection. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Use transactions throughout the codeSimo Sorce2014-09-249-45/+104
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add transactions supportSimo Sorce2014-09-242-0/+89
| | | | | | | | | | | | In some cases a user may end up having multiple login pags in diffeent tabs in the borwser (session restore after a crash, or simply opening multiple urls which all redirect to the same IdP). Without transactions multiple authentication requests in fly may step on each other causing potentially all of them to fail to properly authenticate and redirect back to the original web site. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Refactor the data store a bitSimo Sorce2014-09-246-330/+251
| | | | | | | | | | | Reduce code duplication, and clearly separates admin and user dbs. Move plugin wrapper away and let plugin code use native functions. This patch also changes the indexed data to use a uuid and assumes 2 identical uuid cannot be created concurrently. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add abstraction class to handle cookiesSimo Sorce2014-09-242-9/+76
| | | | | | | This handles secure cokies with useful helpers and defaults. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add Info providers Admin pagesSimo Sorce2014-09-245-5/+172
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for returning user attributesSimo Sorce2014-09-242-1/+37
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add Info Provider plugin frameworkSimo Sorce2014-09-244-0/+144
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add error log facility to Log utilitySimo Sorce2014-09-241-1/+6
| | | | | | | Also improve debug errors by adding the originating function Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add proper ordering to login plugins config optsSimo Sorce2014-09-243-0/+6
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Allow plugins to determine config options orderSimo Sorce2014-09-241-1/+16
| | | | | | | | Ordering may also be partial, for any option not specified they will be appended in lexycographic order. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Remove service name from the form pluginSimo Sorce2014-09-241-9/+1
| | | | | | | | | When using the external apache modules for form based authentication, the pam service name is set in the apache config files and cannot be dynamically changed, do not offr it as a configuration option. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Use helper cookie to remember the usernameSimo Sorce2014-09-245-5/+29
| | | | | | | | | This makes the login page a lot more friendy Available only over HTTPS Max age set to 15 days Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Create common form handler pageSimo Sorce2014-09-245-119/+50
| | | | | | | Reduce duplication Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Rename form login pageSimo Sorce2014-09-243-5/+5
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Remove unused option from the FAS login pluginSimo Sorce2014-09-241-10/+0
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Cast db value to string before comparisonSimo Sorce2014-09-241-1/+1
| | | | | | | | Avoid false negatives when the sqlite3 db is 'smart' and automatically converts the type to integer. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Allow deferred initialization of providersSimo Sorce2014-09-243-24/+45
| | | | | | | This fixes enabling a provider after the sever is started. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Declare admin attributeSimo Sorce2014-09-241-0/+1
| | | | | | | Makes lint happier Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix the check for hasattr(., 'admin')Patrick Uiterwijk2014-09-051-1/+0
| | | | | | | Avoid crashing if a provider does not have an admin interface Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add FAS login pluginSimo Sorce2014-08-271-0/+194
| | | | | | | | | | This plugin simply take a Fedora username and password and authenticates the user against the FAS Server. FAS returned data is saved as userdata in the 'fas' attribute. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Restore ability to run from checkoutSimo Sorce2014-08-271-6/+7
| | | | | | | also adds quickrun.py script to make it easy. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Move user attribute storage into session functionsSimo Sorce2014-08-272-7/+20
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Use new Log class everywhereSimo Sorce2014-08-276-41/+14
| | | | | | | | | Replace copies of _debug function sprinkled all over the code with a single implementation Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com> - Removed replace of self._debug to self.debug
generated by cgit (git 2.34.1) at 2024-09-29 02:24:45 +0000