1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
|
# -*- coding: UTF-8 -*-
# Python Lasso Simulator
#
# Copyright (C) 2004 Entr'ouvert
# http://lasso.entrouvert.org
#
# Author: Emmanuel Raviart <eraviart@entrouvert.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
# FIXME: Replace principal with client in most methods.
# FIXME: Rename webUser to userAccount.
import lasso
from Provider import Provider
from websimulator import *
class ServiceProvider(Provider):
idpSite = None # The identity provider, this service provider will use to authenticate users.
def assertionConsumer(self, httpRequest):
server = self.getServer()
login = lasso.Login.new(server)
login.init_request(httpRequest.query, lasso.httpMethodRedirect)
login.build_request_msg()
soapEndpoint = login.msg_url
self.failUnless(soapEndpoint)
soapRequestMsg = login.msg_body
self.failUnless(soapRequestMsg)
httpResponse = HttpRequest(self, 'POST', soapEndpoint, body = soapRequestMsg).ask()
self.failUnlessEqual(httpResponse.statusCode, 200)
try:
login.process_response_msg(httpResponse.body)
except lasso.Error, error:
if error.code == -7: # FIXME: This will change, he said.
return HttpResponse(
401, 'Access Unauthorized: User authentication failed on identity provider.')
else:
raise
nameIdentifier = login.nameIdentifier
self.failUnless(nameIdentifier)
# Retrieve session dump, using name identifier or else try to use the client web session.
# If session dump exists, give it to Lasso, so that it updates it.
webSession = self.getWebSessionFromNameIdentifier(nameIdentifier)
if webSession is None:
webSession = self.getWebSession(httpRequest.client)
if webSession is not None:
sessionDump = webSession.sessionDump
if sessionDump is not None:
login.set_session_from_dump(sessionDump)
# Retrieve identity dump, using name identifier or else try to retrieve him from web
# session. If identity dump exists, give it to Lasso, so that it updates it.
webUser = self.getWebUserFromNameIdentifier(nameIdentifier)
if webUser is None:
webUser = self.getWebUserFromWebSession(webSession)
if webUser is not None:
identityDump = webUser.identityDump
if identityDump is not None:
login.set_identity_from_dump(identityDump)
login.accept_sso()
if webUser is not None and identityDump is None:
self.failUnless(login.is_identity_dirty())
identity = login.get_identity()
self.failUnless(identity)
identityDump = identity.dump()
self.failUnless(identityDump)
self.failUnless(login.is_session_dirty())
session = login.get_session()
self.failUnless(session)
sessionDump = session.dump()
self.failUnless(sessionDump)
# User is now authenticated.
# If there was no web session yet, create it. Idem for the web user account.
if webSession is None:
webSession = self.createWebSession(httpRequest.client)
if webUser is None:
# A real service provider would ask user to login locally to create federation. Or it
# would ask user informations to create a local account.
webUserId = httpRequest.client.keyring.get(self.url, None)
userAuthenticated = webUserId in self.webUsers
if not userAuthenticated:
return HttpResponse(401, 'Access Unauthorized: User has no account.')
webUser = self.webUsers[webUserId]
webSession.webUserId = webUser.uniqueId
# Store the updated identity dump and session dump.
if login.is_identity_dirty():
webUser.identityDump = identityDump
webSession.sessionDump = sessionDump
self.webUserIdsByNameIdentifier[nameIdentifier] = webUser.uniqueId
self.webSessionIdsByNameIdentifier[nameIdentifier] = webSession.uniqueId
return HttpResponse(200)
def loginUsingRedirect(self, httpRequest):
server = self.getServer()
login = lasso.Login.new(server)
login.init_authn_request(self.idpSite.providerId)
self.failUnlessEqual(login.request_type, lasso.messageTypeAuthnRequest)
forceAuthn = httpRequest.getQueryBoolean('forceAuthn', False)
if forceAuthn:
login.request.set_forceAuthn(forceAuthn)
isPassive = httpRequest.getQueryBoolean('isPassive', False)
if not isPassive:
login.request.set_isPassive(isPassive)
login.request.set_nameIDPolicy(lasso.libNameIDPolicyTypeFederated)
login.request.set_consent(lasso.libConsentObtained)
relayState = 'fake'
login.request.set_relayState(relayState)
login.build_authn_request_msg()
authnRequestUrl = login.msg_url
self.failUnless(authnRequestUrl)
return httpRequest.client.redirect(authnRequestUrl)
def logoutUsingSoap(self, httpRequest):
webSession = self.getWebSession(httpRequest.client)
if webSession is None:
return HttpResponse(401, 'Access Unauthorized: User has no session opened.')
webUser = self.getWebUserFromWebSession(webSession)
if webUser is None:
return HttpResponse(401, 'Access Unauthorized: User is not logged in.')
server = self.getServer()
logout = lasso.Logout.new(server, lasso.providerTypeSp)
identityDump = self.getIdentityDump(httpRequest.client)
if identityDump is not None:
logout.set_identity_from_dump(identityDump)
sessionDump = self.getSessionDump(httpRequest.client)
if sessionDump is not None:
logout.set_session_from_dump(sessionDump)
logout.init_request()
logout.build_request_msg()
soapEndpoint = logout.msg_url
self.failUnless(soapEndpoint)
soapRequestMsg = logout.msg_body
self.failUnless(soapRequestMsg)
httpResponse = HttpRequest(self, 'POST', soapEndpoint, body = soapRequestMsg).ask()
self.failUnlessEqual(httpResponse.statusCode, 200)
logout.process_response_msg(httpResponse.body, lasso.httpMethodSoap)
self.failIf(logout.is_identity_dirty())
identity = logout.get_identity()
self.failUnless(identity)
identityDump = identity.dump()
self.failUnless(identityDump)
self.failUnless(logout.is_session_dirty())
session = logout.get_session()
if session is None:
# The user is no more authenticated on any identity provider. Log him out.
del webSession.sessionDump
del webSession.webUserId
# We also delete the session, but it is not mandantory, since the user is logged out
# anyway.
del self.webSessions[webSession.uniqueId]
else:
# The user is still logged in on some other identity providers.
sessionDump = session.dump()
self.failUnless(sessionDump)
webSession.sessionDump = sessionDump
nameIdentifier = logout.nameIdentifier
self.failUnless(nameIdentifier)
del self.webSessionIdsByNameIdentifier[nameIdentifier]
return HttpResponse(200)
|
