summaryrefslogtreecommitdiffstats
path: root/ipsilon
Commit message (Collapse)AuthorAgeFilesLines
* Strenghten default Security options in IDPSimo Sorce2014-06-172-4/+10
| | | | | | | | Always deny access to the IDP if not using SSL by default. Always turn on secure/httponly cookies by default. Add a switch to disable all security options for testing. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix non-'make test' installationSimo Sorce2014-06-171-0/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Add server install option to turn on debuggingSimo Sorce2014-06-061-1/+4
| | | | | | | Use this in the testsuite so we can get meaningful output in the logs when something fails. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add basic testing infrastructureSimo Sorce2014-06-041-0/+3
| | | | | | | | | | | | | | make test will now run some sanity tests to make sure basic installation procedures work in a sinthetic test environment. Adds: - custom httpd setup for tests - use profiles to driver ipsilon servers and clients installation - starts multiple httpd servers This way we can test interaction between IDP and SP servers Signed-off-by: Simo Sorce <simo@redhat.com>
* Add test login moduleSimo Sorce2014-06-041-0/+154
| | | | | | | This is useful to do automated testing. It accepts authentication as long as the password is 'ipsilon'. Signed-off-by: Simo Sorce <simo@redhat.com>
* Additional parametrization of template filesSimo Sorce2014-06-041-1/+7
| | | | | | To allow for testing in a custom rootdir, and with a custom user. Signed-off-by: Simo Sorce <simo@redhat.com>
* Do not make directory unwritableSimo Sorce2014-06-041-1/+1
| | | | | | | | This does not stop the user, but makes it hard to deal wit the directory in testing. Let file fixing use the default 700 permissions. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add support for passing configuration profileSimo Sorce2014-06-042-0/+75
| | | | | | | | | | | | | | | | | | The new option --config-profile accepts a INI style file, so that installation options are passed in via a file. this is useful for testing and automated installs. This file can have 2 sections: globals, arguments. The globals section can change global variable in the install script like: TEMPLATES, CONFDIR, DATADIR, HTTPDCONFD and so on, so that an installation can use non-standad directories. The argumets section accepts any argument option. The config profile file is parsed after all arguments have parsed and can override any plugin argument. Signed-off-by: Simo Sorce <simo@redhat.com>
* Allow turning off security at install timeSimo Sorce2014-06-042-2/+18
| | | | | | This should be used only for testing purposes Signed-off-by: Simo Sorce <simo@redhat.com>
* Add optional field to allow pasting the metadataSimo Sorce2014-06-041-1/+16
| | | | | | | This way a user can avoid copying the metadata file arund but paste the content straight from a terminal window. Signed-off-by: Simo Sorce <simo@redhat.com>
* If krb is explicitly 'no' do not check for ipaSimo Sorce2014-05-291-0/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix typoSimo Sorce2014-05-291-1/+1
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix handling of SP renamesSimo Sorce2014-05-201-4/+5
| | | | | | Properly replace page self.url Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix referer checks with escaped URLsSimo Sorce2014-05-201-4/+16
| | | | | | | | | | | | | When a SP name included spaces the referer checker would fail to match the url. It would try to return a 403 error, unfortunately this would also trip as a return instead of an exception was used, ending up with a 500 error being returned to the user. Fix url checks by unquoting before comparing. Fix error reporting by rasing an exception when needed instead of returning. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix E501 line too long errorsSimo Sorce2014-05-201-2/+4
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix E256 with stricter pep8 error checkerSimo Sorce2014-05-206-8/+8
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix E713 with stricter pep8 error checkerSimo Sorce2014-05-204-4/+4
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix typo in selinux boolean nameSimo Sorce2014-05-201-1/+1
| | | | | | This was causing pam auth to fail, as the boolean was not being turned on. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix generation fo server's metadata fileSimo Sorce2014-05-191-2/+2
| | | | | | | At some point a '/' got lost, causing the generation of wrong endpoints. Clients would then be redirected to an unexisting path and get a 404. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix broken login plugins order config handlingNathan Kinder2014-05-101-13/+18
| | | | | | | | | | | | | | | | | | | | | | The administrative page for configuring login plugins order had a number of problems. The html template expects a list of plugin names to be supplied, but a list of the actual plugin objects was being supplied. This caused a 500 error since join() would throw an exception when it encounters something other than a string. Even after fixing the 500 error, actually modifying the plugin order would not work due to further issues with plugin objects being used when strings representing the plugin names are expected (and vice-versa). This patch ensures that strings representing plugin names are supplied to the html template, and that plugin objects are used when re-ordering the live plugin list. Resolves: https://fedorahosted.org/ipsilon/ticket/2 Signed-off-by: Nathan Kinder <nkinder@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add 500 Error handler for krb moduleSimo Sorce2014-05-071-0/+2
| | | | | | | If mod_auth_kerb encounters an internal error, catch it so we can fall back to the next authentication module, if any, or return a proper failure message. Signed-off-by: Simo Sorce <simo@redhat.com>
* Remind the user to restart HTTPD when doneSimo Sorce2014-05-071-0/+1
| | | | | | | On a successful install you need to retsart apache to enable the instance, remind the user that is necessary. Signed-off-by: Simo Sorce <simo@redhat.com>
* Give more user feedback around keytab issuesSimo Sorce2014-05-071-0/+16
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Add IPA helper for server installSimo Sorce2014-05-011-0/+170
| | | | | | | | | | | The IPa helper chcks a krb keytab is available for the local HTTPD service at the standard ipa location, and if not available, tries to register the sevice and retrieve one from the IPA server. At the end of the process forces the activation of the krb plugin as well as the fallback to pam for authentication. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add Environment Helpers installer frameworkSimo Sorce2014-05-013-2/+34
| | | | | | | | | | | | | | | Environment helpers are meta-plugins that allow to set ipsilon in well defined environments. For example when ipsilon is install in a FreeIPA or AD domains and authentication methods, cetificate, keytabs etc, can be pre-configured and deployed at the same time the server is installed with minimal effort and wellknown methods. These are run before any of the other plugins as they can chage the configuration option for any of the plugins, enable or disable plugins, or pre-configure some elements. Signed-off-by: Simo Sorce <simo@redhat.com>
* Always use saml by defaultSimo Sorce2014-05-012-6/+7
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Make SELinux happySimo Sorce2014-05-012-0/+14
| | | | | | | | | | Add proper context to shared state directories so that httpd can write there. Relax SElinux boolans to allow use of pam modules This allows running Ipsilon in fully enforcing mode when pam auth using the python-pam modules is used. Signed-off-by: Simo Sorce <simo@redhat.com>
* Avoid failing install if sessions directory existsSimo Sorce2014-05-011-1/+3
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Eliminte stale locksSimo Sorce2014-05-011-1/+16
| | | | | | | | | If the server crashes stale lock files may e left behind. This will cause the application to deadlock for the user that has the misfortune of having a stale lock. Forcibly remove all locks on startup. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix typo in ipsilon-client-installSimo Sorce2014-05-011-1/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Make it easy to install mutiple server instancesSimo Sorce2014-04-213-23/+40
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Move templatized file creation to toolsSimo Sorce2014-04-212-15/+19
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Move fixing files functionality to toolsSimo Sorce2014-04-213-21/+40
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Convert all forms to use util.Page form supportSimo Sorce2014-04-213-26/+4
| | | | | | This way all forms will get Referer checking automaticaly Signed-off-by: Simo Sorce <simo@redhat.com>
* Add New form helper to Page objectSimo Sorce2014-04-201-4/+19
| | | | | | | | This removes the need to define a root funciton only to redirect to a GET/POST one. Also adds basic CSRF protection if the page is declared a form. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix warningSimo Sorce2014-04-181-2/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix NameId exceptionSimo Sorce2014-04-151-2/+2
| | | | | | | Report what invalid name was used and fix exception on raising the exception on line 129 Signed-off-by: Simo Sorce <simo@redhat.com>
* Add nameid values validationSimo Sorce2014-04-142-0/+15
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Refactor argument validation for SP formsSimo Sorce2014-04-141-61/+105
| | | | | | | Use helper functions to make the code more readbale and exceptions to reduce error hndling duplication. Signed-off-by: Simo Sorce <simo@redhat.com>
* Validate Service Provider namesSimo Sorce2014-04-111-0/+16
| | | | | | We use the name to construct the admin page path, avoid odd characters Signed-off-by: Simo Sorce <simo@redhat.com>
* Add basic installation script with saml supportSimo Sorce2014-04-111-0/+259
| | | | | | | | | Generates (self signed) certificates and a metdata.xml file. Optionally configures an Apache Httpd server. If the admin does not configure a specific application at install time a default landing page is made available to be able to test that the SP configuration works. Uninstall removes all certificates and metadata file and is irreversible.
* Allow to set additional custom keys on servicesSimo Sorce2014-04-111-1/+3
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Simplify metadata add_service signatureSimo Sorce2014-04-112-15/+19
| | | | | | Add a map that takes care of the lower level lasso-related details Signed-off-by: Simo Sorce <simo@redhat.com>
* Store full path immediatelySimo Sorce2014-04-111-6/+5
| | | | | | | | Allows to query .key and .cert to e used to find the files on the system directly w/o having to know what path was previously used to initialize the class. Signed-off-by: Simo Sorce <simo@redhat.com>
* If no path is provided use current directorySimo Sorce2014-04-111-1/+4
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Move accessory functions to a generic tools moduleSimo Sorce2014-04-115-22/+22
| | | | | | | This will allow to easly share the module with install tools, without the need to install server side modules in clients Signed-off-by: Simo Sorce <simo@redhat.com>
* Rename scripts and mark them as suchSimo Sorce2014-04-113-0/+0
| | | | | | | | | | | | Mark actual top level scripts as such instead of disguising them as modules. Also remove __init__.py from ipsilon/install as this is not a module just the place where install scripts are kept, for now. Note: Scripts are installed in the bin directory but the contrib spec file moves them to sbin. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add debug logging of lasso librarySimo Sorce2014-04-111-0/+7
| | | | | | | | | | | If debug is enabled make lasso spit debug messages to stderr too, to aid admins in resolving issues related to saml2 issues, like finding out why a metadata file may be rejected. This is very simple for now, a future enhancement may involve piping the logs into a calss so they can be spat out as feedback to users. Signed-off-by: Simo Sorce <simo@redhat.com>
* Return Idps metadata file on requestSimo Sorce2014-04-111-0/+11
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix generation of endopint URLsSimo Sorce2014-04-111-2/+2
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
generated by cgit (git 2.34.1) at 2024-06-17 12:09:09 +0000