| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
| |
In case we are going to return a HTTP_UNAUTHORIZED
error we can also redirect the client to an admin chosen
page to let the application handle the error on its own.
Signed-off-by: Simo Sorce <simo@redhat.com>
git-svn-id: https://modmellon.googlecode.com/svn/trunk@227 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Idps may decide to deny authentication for a variety of reasons.
In such a case they will post to the application with an unsuccessful
status error code.
Handle the case by returning a more appropriate 401 Unauthorized
HTTP error code.
iDo this using an extensible mechanism to map arbitrary lasso errors
to HTTP errors.
Signed-off-by: Simo Sorce <simo@redhat.com>
git-svn-id: https://modmellon.googlecode.com/svn/trunk@226 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
|
| |
The -Wunused-but-set-variable option will cause a warning that
idp_public_key_file is set but never used when
HAVE_lasso_server_load_metadata is defined.
Signed-off-by: Simo Sorce <simo@redhat.com>
git-svn-id: https://modmellon.googlecode.com/svn/trunk@225 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
| |
Thanks to Arthur Müller for providing this patch.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@224 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch changes the headers sent to prevent errornous caching of the
responses sent to only use a single header:
Cache-Control: private, must-revalidate
This single header should ensure that the data isn't shared between
multiple users, and that the browser checks that the content is still
valid for each request (enabling logout to work as expected).
This drops the Exires-header, which should be unnecessary since all
modern browsers support the Cache-Control-header.
Thanks to Arthur Müller for providing this patch.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@223 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@222 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
|
| |
In the case where the error "LASSO_PROFILE_ERROR_SESSION_NOT_FOUND"
occurs during lasso_logout_validate_request(), we weren't releasing
the session mutex, which will lead to a deadlock in the next request
that needs to access a session. This patch makes sure we properly
release session in that case.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@221 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
|
|
|
| |
The configuration directive declaration was missing the parameter
describing where the data from the option was stored. The result is
that we access invalid memory during configuration parsing, leading to
a segmentation fault.
As far as I can tell, this error has always been present, so this
option hasn't worked before.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@220 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
| |
The HTTP-Artifact response is also allowed to be sent as a POST request.
This patch adds support for loading those responses.
Thanks to Nikola Ivačič for implementing this!
git-svn-id: https://modmellon.googlecode.com/svn/trunk@217 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
|
|
|
| |
Recent versions of libcurl do not allow CUROPT_SSL_VERIFYHOST to be
set to 1.
The default in cURL has been to validate both the certificate and the
host since 2002. Setting these options is therefore unnecessary.
Thanks to Nikola Ivačič for notifying us about this problem!
git-svn-id: https://modmellon.googlecode.com/svn/trunk@216 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@214 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@213 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@212 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
| |
This option allows you to set environment variables without the
"MELLON_" prefix.
Thanks to Laas Toom for implementing this!
git-svn-id: https://modmellon.googlecode.com/svn/trunk@211 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
| |
Thanks to Thijs Kinkhorst for providing this patch.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@210 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@209 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
| |
Thansk to Thijs Kinkhorst for identifying the changes that were
necessary!
git-svn-id: https://modmellon.googlecode.com/svn/trunk@208 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@207 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Apache has fixed a bug/misfeature where
ap_unescape_url_keep2f() decoded %2f-escapes. This leaves us with no
functions that can be used to urldecode strings, so we have to roll
our own.
If we drop support for Apache 2.2, we can use
ap_unescape_urlencoded().
See: http://svn.apache.org/viewvc?view=revision&revision=578332
git-svn-id: https://modmellon.googlecode.com/svn/trunk@206 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@205 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@204 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@203 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
| |
In the case where we are missing the repost data, we currently
display a 400 Bad Request error. This patch changes the code to
redirect to the end URL instead, which at least has a chance to
work.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@202 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
|
| |
We were mixing microseconds and seconds, causing us to always delete
all the repost data. This patch fixes the comparison, and also
optimizes it a bit.
Thanks to Matthew Slowe for diagnosing this bug!
git-svn-id: https://modmellon.googlecode.com/svn/trunk@201 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@199 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@198 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
| |
I accidentally committed a revert that I had done for debugging.
This commit reverts the revert :)
git-svn-id: https://modmellon.googlecode.com/svn/trunk@197 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@196 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
| |
This reverts commit ee8e7f205d6c7cecdc56491877de88a361e027e3.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@195 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
| |
Instead of relying on the Lasso library including GLib for us,
we should link directly with it.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@194 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
| |
This sets the default indentation to 4 spaces, and disables tabs.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@193 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@190 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@189 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
| |
This file has been replaced with the issue tracker, so remove it.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@188 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
| |
The Debian build files will be moving to a separate repository.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@187 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Accessing the "login"-endpoint with multiple IdPs configured would
bypass the discovery service. This patch changes the behaviour so
that we send a discovery service request instead.
This breaks backwardscompatibility slightly, but hopefully it should
not be a problem.
This fixes issue 13: https://code.google.com/p/modmellon/issues/detail?id=13
git-svn-id: https://modmellon.googlecode.com/svn/trunk@186 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
| |
This doesn't fix any bugs, it just makes the code cleaner.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@185 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
|
|
| |
If we mark the session as logged in before all processing is completed,
a failure during login processing (e.g. too big attribute values) can
cause a user to receive a "half-authenticated" session.
This patch changes the code so that the last task before releaseing the
session is to mark it as logged in.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@184 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
| |
We currently release the session lock only to grab it again a few
instructions later. This patch changes this so that we initialize
the session in one operation.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@183 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
| |
We had forgotten to release the session object in one of the error paths
during login. This could result in us hanging onto the session mutex after
the request has finished, this deadlocking the server. This patch fixes
that error.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@182 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
| |
Since this function is used for both generating session IDs and for
generating POST data identifiers for POST replay, it should have a
generic name.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@181 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
|
|
| |
This patch changes all configuration options that receive paths to files
to convert them to an absolute path. This ensures that relative paths
work correctly after the server changes the current working directory
during session initialization.
Thanks to Jeroen De Ridder for reporting this bug and suggesting a fix!
git-svn-id: https://modmellon.googlecode.com/svn/trunk@180 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@179 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
| |
Now that the POST replay functionality has been disabled by default,
we can force the administrator to create this directory manually. This
saves us from worrying about temp file/directory vulnerabilities.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@178 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
| |
Since we are going to disable autocreation of the POST data directory,
we will need to disable POST replay by default. This patch adds the
MellonPostReplay option, which can be used to enable and disable the
POST replay functionality on a per-location basis.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@177 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
| |
The current code defaults to storing the lock file in /tmp. This patch
changes the default to /var/run, which is where such files belong.
Note that this lock file is only required on some platforms.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@176 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@175 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
| |
The "metadata" and "repost" handlers were tested twice in the
endpoint handler. This patch removes the last occurence, since they
are never reached.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@174 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
| |
git-svn-id: https://modmellon.googlecode.com/svn/trunk@173 a716ebb1-153a-0410-b759-cfb97c6a1b53
|
|
|
|
|
|
|
|
|
|
|
| |
We need to restore the profile state when creating a logout request,
so that Lasso has the information it requires for logging out.
If we do not do this, every logout "fail" with the log message:
User attempted to initiate logout without being loggged in.
git-svn-id: https://modmellon.googlecode.com/svn/trunk@172 a716ebb1-153a-0410-b759-cfb97c6a1b53
|