summaryrefslogtreecommitdiffstats
path: root/ipsilon
Commit message (Collapse)AuthorAgeFilesLines
* Properly handle groups info in SAML providerSimo Sorce2015-03-171-0/+6
| | | | | | | | | Also removes internal attributes (any attribute that starts with _ Fixes: https://fedorahosted.org/ipsilon/ticket/71 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Fix error returned from login pluginsSimo Sorce2015-03-175-0/+7
| | | | | | | | | | | Some login plugins use form based authentication and let the user retry on authentication errors. This is fine, however the wrong error code is returned in this case, 401 should be returned. Fixes: https://fedorahosted.org/ipsilon/ticket/94 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Make SSSD Info enable the httpd_dbus_sssd boolean.Patrick Uiterwijk2015-03-171-0/+7
| | | | | | | https://fedorahosted.org/ipsilon/ticket/23#comment:13 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Save user attributes on subsequent calls to login.Rob Crittenden2015-03-161-0/+2
| | | | | | | | | | | | | | | | | When a login comes in via the remote_login() call no user attributes are set. These may be later filled in by a subsequent call to login() after the info plugins are called but a short-circuit in that function exits if the user matches the current session. Add an extra conditional such that if the user matches, userattributes are passed in and the current user attributes for this user is empty then save the new data. https://fedorahosted.org/ipsilon/ticket/86 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Use the IPA API directly when adding the HTTP principalRob Crittenden2015-03-161-29/+47
| | | | | | | | | | | | | | This is the only way to force in a custom version string so that the remote IPA server doesn't reject the request as being newer than the server. This also removes the need to iterate over all servers as the IPA connection API does this automatically. https://fedorahosted.org/ipsilon/ticket/47 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Don't explicitly save sessionsNathan Kinder2015-03-121-4/+0
| | | | | | | | | | | | | | | | | Saving a session causes it to be unlocked, but sessions have a hook that also performs a save just before the session is finalized. In CherryPy 3.3.0 and later, an assertion was added to ensure that a session is locked when trying to perform a save. Since we perform explicit saves in our code, this causes the assertion to be tripped when the hook executes. This patch removes our explicit save calls. We should rely on the hook to save and unlock the session. https://fedorahosted.org/ipsilon/ticket/84 Signed-off-by: Nathan Kinder <nkinder@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Proper fallback from referer to REQUEST_URISimo Sorce2015-03-121-2/+4
| | | | | | | | | | | | If the referer is present but does not contain a transaction ID we still need to fallback to the REQUEST_URI. Fix the code to check the url and then fallback to REQUEST_URI rathe than decide upfront merely on the fact a referer is available. https://fedorahosted.org/ipsilon/ticket/74 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Validate SP path settings during installationNathan Kinder2015-03-111-0/+21
| | | | | | | | | | | | | | | | | | | | | | There are a number of URL path options that can be specified as options when running ipsilon-client-install. There are certain rules that must be followed to result in a valid mod_auth_mellon configuration: - All path options must be prefixed with '/'. - The mellon endpoint path (--saml-sp) must be a subpath of the httpd 'Location' element is it contained within (--saml-base). - The logout (--saml-sp-logout) and post (--saml-sp-post) paths must be subpaths of the mellon endpoint (--saml-sp). This adds validation for all of the above rules. https://fedorahosted.org/ipsilon/ticket/82 Signed-off-by: Nathan Kinder <nkinder@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add Cache-Control header to prevent browser caching of SAML auth locationNathan Kinder2015-03-101-0/+1
| | | | | | | | | | | | | We should prevent browser caching of the SAML auth location that we configure for an SP. This can be easily done by adding the following directive to that location in the httpd config: Header append Cache-Control "no-cache" https://fedorahosted.org/ipsilon/ticket/81 Signed-off-by: Nathan Kinder <nkinder@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Require SSL on SP when using --saml-secure-setupNathan Kinder2015-03-101-0/+7
| | | | | | | | | | | | | | | | If ipsilon-client-install is used with the --saml-secure-setup option (which is set by default), only https connections will work for authentication. We are not setting the SSLRequireSSL directive though, so we set mellon up to fail. This patch adds the SSLRequireSSL directive to the SP config when --saml-secure-setup is specified. In addition, we add a rewrite rule to rewrite http requests to https for the SP. https://fedorahosted.org/ipsilon/ticket/80 Signed-off-by: Nathan Kinder <nkinder@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Find transaction ids for internal redirectsSimo Sorce2015-03-061-2/+8
| | | | | | | | | | | On internal redirections, such as when ErrorDocument is used to redirect on failed negotiate authentication we need to look harder for the transaction id. Ticket: #74 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Fix transaction ID passing for failed authenticationPatrick Uiterwijk2015-03-031-3/+6
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Require admin when accessing REST pagesRob Crittenden2015-03-032-0/+8
| | | | | Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Load and initialize REST in the SAML2 pluginRob Crittenden2015-02-271-0/+3
| | | | | | | https://fedorahosted.org/ipsilon/ticket/26 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement GET and POST REST API for Service ProvidersRob Crittenden2015-02-271-0/+107
| | | | | | | | | | | | | The mount point is /idp/rest/providers/saml2/SPS. GET .../SPS will retrieve all Service Providers GET .../SPS/foo will retrieve the Service Provider named foo POST .../SPS/foo will create the Service Provider named foo https://fedorahosted.org/ipsilon/ticket/26 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Load REST plugins onto the Root objectRob Crittenden2015-02-271-0/+4
| | | | | | | https://fedorahosted.org/ipsilon/ticket/26 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add base REST provider framework classesRob Crittenden2015-02-274-0/+141
| | | | | | | | | | | These classes handle mounting the REST plugins. The starting mount point is: /idp/rest/providers https://fedorahosted.org/ipsilon/ticket/26 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Change root class of Page from Log to EndpointRob Crittenden2015-02-271-2/+3
| | | | | Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Low-level class for managing request endpointsRob Crittenden2015-02-271-0/+82
| | | | | | | | | | | An Endpoint is different from a Page in that it doesn't have menus, templates, transactions, etc. It is only defines a URL that can be mounted. https://fedorahosted.org/ipsilon/ticket/38 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add uninstallation support.Patrick Uiterwijk2015-02-2615-31/+147
| | | | | | | | | As part of this, made all plugins use a Installer baseclass. https://fedorahosted.org/ipsilon/ticket/38 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Make the configparser case sensitive.Patrick Uiterwijk2015-02-241-0/+1
| | | | | | | | Per the instructions of https://docs.python.org/2/library/configparser.html#ConfigParser.RawConfigParser.optionxform Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Make available case insensitive mapping matchingSimo Sorce2015-02-241-19/+96
| | | | | | | | | | | | If ignore_case is True then the incomping attributes are matched case-insensitively in the policy engine. The CAse of the incoming attribute is not changed on wildcard matches. On ther matches attributes will be replaced according to the mapping tables and the case used will be that of the mapped attributes. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Use the new Policy engine for login/info mappingSimo Sorce2015-02-245-64/+45
| | | | | | | | The InfoMapping class is now only used to prettify the default set of wellknown attributes. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Handle changing MappingList optionsSimo Sorce2015-02-241-0/+85
| | | | | | | | Add admin function to handle getting a MappingList object in form of key/value pair fields. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Handle changing ComplexList optionsSimo Sorce2015-02-241-0/+67
| | | | | | | | Add admin function to handle getting a ComplexList object in form of key/value pair fields. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Do not crash on failure to load configSimo Sorce2015-02-241-1/+5
| | | | | | | Just report an error and continue with default values. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for attribute policies in openidpSimo Sorce2015-02-243-3/+30
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for attribute policies in samlidpSimo Sorce2015-02-242-2/+25
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add config option to load mapping listsSimo Sorce2015-02-241-1/+47
| | | | | | | This requires careful handling, and should be used sparingly Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add Policy class to help filter attributesSimo Sorce2015-02-241-0/+319
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Prefix userdata hives with _ to avoid conflictsSimo Sorce2015-02-248-48/+41
| | | | | | | | | | | The main userdata dict contains common attributes, but we add a sepcial groups list and unmapped extras, as well as indicators like auth_type. All these additional attributes are now prefixed by a _ character so that conflicts with legitimate attributes are improbable. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix typos in openid provider commentsSimo Sorce2015-02-241-2/+2
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add info plugin that utilizes Apache mod_lookup_identity pluginRob Crittenden2015-02-131-0/+180
| | | | | | | | | | mod_look_identity looks up identity information from sssd over dbus, making additional identity attributes available. https://fedorahosted.org/ipsilon/ticket/31 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Let the plugin configure calls notice failures.Rob Crittenden2015-02-131-4/+8
| | | | | | | | | | | | The call to configure the info/login/auth/provider plugins had no way of recognizing that the configuration failed. Have it check for an explicit False return value as an indication of failure. This lets the configuration plugin do a simple return (None) if it isn't enabled. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix typo in nss and infoldap info pluginsRob Crittenden2015-02-132-2/+2
| | | | | Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement Single Logout Service for SP-initiated logoutRob Crittenden2015-02-134-0/+313
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add SAML-specific session data for tracking login/logout sessionsRob Crittenden2015-02-131-0/+226
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Register SingleLogoutService SAML2 metadataRob Crittenden2015-02-131-0/+2
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add helper to store provider specific dataRob Crittenden2015-02-131-0/+16
| | | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Fall back to default templates dir if it does not exist in template_dirPatrick Uiterwijk2015-02-061-5/+13
| | | | | | | | This would enable people to only override the templates they care about overriding, like master.html, while still retaining the rest. Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Remove print lines from openidPatrick Uiterwijk2015-02-031-2/+0
| | | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add expiration to Idp metadataSimo Sorce2015-01-292-6/+41
| | | | | | | | Also regenerate it frequently, so that any change in configuration can be automatically reflected in the metadata downloaded my clients over time. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add Metadata Generator helper classSimo Sorce2015-01-291-16/+24
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add support for expiration in MetadataSimo Sorce2015-01-291-4/+28
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add function to import a cert from a fileSimo Sorce2015-01-291-0/+4
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix request multipart logging when only 1 part is presentJohn Dennis2015-01-271-10/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | Test to see if the request parameter value is a cherrypy Part class. This was already being done for the case where the value was a list, but it was omitted for single values. Logic was combined into new local function print_param(). Changed the test for the class back to using if isinstance(item, cherrypy._cpreqbody.Part): instead of: if getattr(item, "part_class", None): because using isinstance() clearly indicates what is being done. The use of getattr() was introduced to prevent a pylint warning concering use of protected values. The getattr() hack is confusing and proably not robust if the class implementation changes. The patch now disables this warning. I cannot explain why cherrypy marks these modules as protected when clearly one has to utilize them and they are documented in the cherrypy API doc. Disabling the warning seems the cleanest and most robust approach. Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix int/pep8 errors in latest patchesSimo Sorce2015-01-261-9/+11
| | | | | | | Mea culpa for not checking before pushing Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: John Dennis <jdennis@redhat.com>
* Add source code context information to debug logsJohn Dennis2015-01-261-3/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The log.debug() function helpfully adds the name of the function invoking it but in a complicated software package there are many functions/methods which share the same name. Thus a debug message like this: DEBUG(__init__): xxx does not give you much context, there are probably hundreds of __init__ methods. It would help to qualify the method name which it's class name, that gives a lot more context when reading the log. Sometimes it's also helpful to know the file and line number. This patch adds the class name to the function and included the filename and line number as well. The file path is trimmed to the last 3 components, sufficient to give context but not too verbose. Now the debug message might look like this instead: DEBUG(ipsilon/providers/common.py:129 LoadProviders.__init__()): xxx Also included is a config option 'stacktrace_on_error' which will include a stacktrace when the log.error function is called. It can be very useful to see a stacktrace when logging an error, it defaults to off. Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add request/response logging via cherrypy tool hooksJohn Dennis2015-01-261-0/+238
| | | | | | | | | | | | | | | | | | | | | | The ability to easily review the HTTP Ipsilon request and response is boon for development and issue debugging. Normally these HTTP conversations occur on SSL/TLS encrypted connections making it difficult to use other tools to view the traffic. Client side tools have known pitfalls (e.g. Firebug) and not all conversations are browser initiated (e.g. SAML ECP). Logging performed by the server hosting Ipsilon makes logging at the server level server specific (e.g. Apache's dumpio requires post-processing the log file to extract and reassamble the HTTP conversation). The best place to log requests and responses is within Ipsilon using the cherrypy framework Ipsilon is embedded in. Cherrypy provides user defined hooks that can be invoked at specific places in the request pipeline. We establish a hook at the last stage just before the response is written to the client, it logs the incoming request and outgoing response. Resolves: https://fedorahosted.org/ipsilon/ticket/44 Signed-off-by: John Dennis <jdennis@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Fix a copy-paste errorPatrick Uiterwijk2015-01-221-1/+1
| | | | Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-28 18:50:10 +0000