def handle_logout_response(self, response, sign_alg=None, digest_alg=None): """ handles a Logout response :param response: A response.Response instance :return: 4-tuple of (session_id of the last sent logout request, response message, response headers and message) """ logger.info("state: %s", self.state) status = self.state[response.in_response_to] logger.info("status: %s", status) issuer = response.issuer() logger.info("issuer: %s", issuer) del self.state[response.in_response_to] if status["entity_ids"] == [issuer]: # done self.local_logout(decode(status["name_id"])) return 0, "200 Ok", [("Content-type", "text/html")], [] else: status["entity_ids"].remove(issuer) if "sign_alg" in status: sign_alg = status["sign_alg"] return self.do_logout(decode(status["name_id"]), status["entity_ids"], status["reason"], status["not_on_or_after"], status["sign"], sign_alg=sign_alg, digest_alg=digest_alg)
def handle_logout_response(self, response, sign_alg=None, digest_alg=None): """ handles a Logout response :param response: A response.Response instance :return: 4-tuple of (session_id of the last sent logout request, response message, response headers and message) """ logger.info("state: %s", self.state) status = self.state[response.in_response_to] logger.info("status: %s", status) issuer = response.issuer() logger.info("issuer: %s", issuer) del self.state[response.in_response_to] if status["entity_ids"] == [issuer]: # done self.local_logout(decode(status["name_id"])) return 0, "200 Ok", [("Content-type", "text/html")], [] else: status["entity_ids"].remove(issuer) if "sign_alg" in status: sign_alg = status["sign_alg"] return self.do_logout(decode(status["name_id"]), status["entity_ids"], status["reason"], status["not_on_or_after"], status["sign"], sign_alg=sign_alg, digest_alg=digest_alg)
def global_logout(self, name_id, reason="", expire=None, sign=None, sign_alg=None, digest_alg=None): """ More or less a layer of indirection :-/ Bootstrapping the whole thing by finding all the IdPs that should be notified. :param name_id: The identifier of the subject that wants to be logged out. :param reason: Why the subject wants to log out :param expire: The latest the log out should happen. If this time has passed don't bother. :param sign: Whether the request should be signed or not. This also depends on what binding is used. :return: Depends on which binding is used: If the HTTP redirect binding then a HTTP redirect, if SOAP binding has been used the just the result of that conversation. """ if isinstance(name_id, six.string_types): name_id = decode(name_id) logger.info("logout request for: %s", name_id) # find out which IdPs/AAs I should notify entity_ids = self.users.issuers_of_info(name_id) return self.do_logout(name_id, entity_ids, reason, expire, sign, sign_alg=sign_alg, digest_alg=digest_alg)
def authenticate(self, environ, identity=None): if identity: if (identity.get("user") and environ.get("s2repoze.sessioninfo") and identity.get("user") == environ.get("s2repoze.sessioninfo").get("ava")): return identity.get("login") tktuser = identity.get("repoze.who.plugins.auth_tkt.userid", None) if tktuser and self.saml_client.is_logged_in(decode(tktuser)): return tktuser return None else: return None
def authenticate(self, environ, identity=None): if identity: if ( identity.get("user") and environ.get("s2repoze.sessioninfo") and identity.get("user") == environ.get("s2repoze.sessioninfo").get("ava") ): return identity.get("login") tktuser = identity.get("repoze.who.plugins.auth_tkt.userid", None) if tktuser and self.saml_client.is_logged_in(decode(tktuser)): return tktuser return None else: return None
def add_metadata(self, environ, identity): """ Add information to the knowledge I have about the user """ name_id = identity["repoze.who.userid"] if isinstance(name_id, six.string_types): try: # Make sure that userids authenticated by another plugin # don't cause problems here. name_id = decode(name_id) except: pass _cli = self.saml_client logger.debug("[add_metadata] for %s", name_id) try: logger.debug("Issuers: %s", _cli.users.sources(name_id)) except KeyError: pass if "user" not in identity: identity["user"] = {} try: (ava, _) = _cli.users.get_identity(name_id) # now = time.gmtime() logger.debug("[add_metadata] adds: %s", ava) identity["user"].update(ava) except KeyError: pass if "pysaml2_vo_expanded" not in identity and _cli.vorg: # is this a Virtual Organization situation for vo in _cli.vorg.values(): try: if vo.do_aggregation(name_id): # Get the extended identity identity["user"] = _cli.users.get_identity(name_id)[0] # Only do this once, mark that the identity has been # expanded identity["pysaml2_vo_expanded"] = 1 except KeyError: logger.exception( "Failed to do attribute aggregation, " "missing common attribute" ) logger.debug("[add_metadata] returns: %s", dict(identity)) if not identity["user"]: # remove cookie and demand re-authentication pass
def add_metadata(self, environ, identity): """ Add information to the knowledge I have about the user """ name_id = identity["repoze.who.userid"] if isinstance(name_id, six.string_types): try: # Make sure that userids authenticated by another plugin # don't cause problems here. name_id = decode(name_id) except: pass _cli = self.saml_client logger.debug("[add_metadata] for %s", name_id) try: logger.debug("Issuers: %s", _cli.users.sources(name_id)) except KeyError: pass if "user" not in identity: identity["user"] = {} try: (ava, _) = _cli.users.get_identity(name_id) # now = time.gmtime() logger.debug("[add_metadata] adds: %s", ava) identity["user"].update(ava) except KeyError: pass if "pysaml2_vo_expanded" not in identity and _cli.vorg: # is this a Virtual Organization situation for vo in _cli.vorg.values(): try: if vo.do_aggregation(name_id): # Get the extended identity identity["user"] = _cli.users.get_identity(name_id)[0] # Only do this once, mark that the identity has been # expanded identity["pysaml2_vo_expanded"] = 1 except KeyError: logger.exception("Failed to do attribute aggregation, " "missing common attribute") logger.debug("[add_metadata] returns: %s", dict(identity)) if not identity["user"]: # remove cookie and demand re-authentication pass
def get(self, name_id, entity_id, check_not_on_or_after=True): """ Get session information about a subject gotten from a specified IdP/AA. :param name_id: The subject identifier, a NameID instance :param entity_id: The identifier of the entity_id :param check_not_on_or_after: if True it will check if this subject is still valid or if it is too old. Otherwise it will not check this. True by default. :return: The session information """ cni = code(name_id) (timestamp, info) = self._db[cni][entity_id] info = info.copy() if check_not_on_or_after and time_util.after(timestamp): raise ToOld("past %s" % str(timestamp)) if 'name_id' in info and isinstance(info['name_id'], six.string_types): info['name_id'] = decode(info['name_id']) return info or None
def global_logout(self, name_id, reason="", expire=None, sign=None, sign_alg=None, digest_alg=None): """ More or less a layer of indirection :-/ Bootstrapping the whole thing by finding all the IdPs that should be notified. :param name_id: The identifier of the subject that wants to be logged out. :param reason: Why the subject wants to log out :param expire: The latest the log out should happen. If this time has passed don't bother. :param sign: Whether the request should be signed or not. This also depends on what binding is used. :return: Depends on which binding is used: If the HTTP redirect binding then a HTTP redirect, if SOAP binding has been used the just the result of that conversation. """ if isinstance(name_id, six.string_types): name_id = decode(name_id) logger.info("logout request for: %s", name_id) # find out which IdPs/AAs I should notify entity_ids = self.users.issuers_of_info(name_id) return self.do_logout(name_id, entity_ids, reason, expire, sign, sign_alg=sign_alg, digest_alg=digest_alg)
def clean_out_user(self, name_id): """ Remove all authentication statements that belongs to a user identified by a NameID instance :param name_id: NameID instance :return: The local identifier for the user """ lid = self.ident.find_local_id(name_id) logger.info("Clean out %s", lid) # remove the authentications try: for _nid in [decode(x) for x in self.ident.db[lid].split(" ")]: try: self.session_db.remove_authn_statements(_nid) except KeyError: pass except KeyError: pass return lid
def clean_out_user(self, name_id): """ Remove all authentication statements that belongs to a user identified by a NameID instance :param name_id: NameID instance :return: The local identifier for the user """ lid = self.ident.find_local_id(name_id) logger.info("Clean out %s", lid) # remove the authentications try: for _nid in [decode(x) for x in self.ident.db[lid].split(" ")]: try: self.session_db.remove_authn_statements(_nid) except KeyError: pass except KeyError: pass return lid
def challenge(self, environ, _status, _app_headers, _forget_headers): _cli = self.saml_client if "REMOTE_USER" in environ: name_id = decode(environ["REMOTE_USER"]) _cli = self.saml_client path_info = environ["PATH_INFO"] if "samlsp.logout" in environ: responses = _cli.global_logout(name_id) return self._handle_logout(responses) if "samlsp.pending" in environ: response = environ["samlsp.pending"] if isinstance(response, HTTPRedirection): response.headers += _forget_headers return response # logger = environ.get('repoze.who.logger','') # Which page was accessed to get here came_from = construct_came_from(environ) environ["myapp.came_from"] = came_from logger.debug("[sp.challenge] RelayState >> '%s'", came_from) # Am I part of a virtual organization or more than one ? try: vorg_name = environ["myapp.vo"] except KeyError: try: vorg_name = _cli.vorg._name except AttributeError: vorg_name = "" logger.info("[sp.challenge] VO: %s", vorg_name) # If more than one idp and if none is selected, I have to do wayf (done, response) = self._pick_idp(environ, came_from) # Three cases: -1 something went wrong or Discovery service used # 0 I've got an IdP to send a request to # >0 ECP in progress logger.debug("_idp_pick returned: %s", done) if done == -1: return response elif done > 0: self.outstanding_queries[done] = came_from return ECP_response(response) else: entity_id = response logger.info("[sp.challenge] entity_id: %s", entity_id) # Do the AuthnRequest _binding = BINDING_HTTP_REDIRECT try: srvs = _cli.metadata.single_sign_on_service(entity_id, _binding) logger.debug("srvs: %s", srvs) dest = srvs[0]["location"] logger.debug("destination: %s", dest) extensions = None cert = None if _cli.config.generate_cert_func is not None: cert_str, req_key_str = _cli.config.generate_cert_func() cert = {"cert": cert_str, "key": req_key_str} spcertenc = SPCertEnc( x509_data=ds.X509Data( x509_certificate=ds.X509Certificate(text=cert_str) ) ) extensions = Extensions( extension_elements=[element_to_extension_element(spcertenc)] ) if _cli.authn_requests_signed: _sid = saml2_tophat.s_utils.sid() req_id, msg_str = _cli.create_authn_request( dest, vorg=vorg_name, sign=_cli.authn_requests_signed, message_id=_sid, extensions=extensions, ) _sid = req_id else: req_id, req = _cli.create_authn_request( dest, vorg=vorg_name, sign=False, extensions=extensions ) msg_str = "%s" % req _sid = req_id if cert is not None: self.outstanding_certs[_sid] = cert ht_args = _cli.apply_binding( _binding, msg_str, destination=dest, relay_state=came_from, sign=_cli.authn_requests_signed, ) logger.debug("ht_args: %s", ht_args) except Exception as exc: logger.exception(exc) raise Exception("Failed to construct the AuthnRequest: %s" % exc) try: ret = _cli.config.getattr("endpoints", "sp")["discovery_response"][0][0] if (environ["PATH_INFO"]) in ret and ret.split(environ["PATH_INFO"])[ 1 ] == "": query = parse_qs(environ["QUERY_STRING"]) sid = query["sid"][0] came_from = self.outstanding_queries[sid] except: pass # remember the request self.outstanding_queries[_sid] = came_from if not ht_args["data"] and ht_args["headers"][0][0] == "Location": logger.debug("redirect to: %s", ht_args["headers"][0][1]) return HTTPSeeOther(headers=ht_args["headers"]) else: return ht_args["data"]
def subjects(self): """ Return identifiers for all the subjects that are in the cache. :return: list of subject identifiers """ return [decode(c) for c in self._db.keys()]
def challenge(self, environ, _status, _app_headers, _forget_headers): _cli = self.saml_client if "REMOTE_USER" in environ: name_id = decode(environ["REMOTE_USER"]) _cli = self.saml_client path_info = environ["PATH_INFO"] if "samlsp.logout" in environ: responses = _cli.global_logout(name_id) return self._handle_logout(responses) if "samlsp.pending" in environ: response = environ["samlsp.pending"] if isinstance(response, HTTPRedirection): response.headers += _forget_headers return response # logger = environ.get('repoze.who.logger','') # Which page was accessed to get here came_from = construct_came_from(environ) environ["myapp.came_from"] = came_from logger.debug("[sp.challenge] RelayState >> '%s'", came_from) # Am I part of a virtual organization or more than one ? try: vorg_name = environ["myapp.vo"] except KeyError: try: vorg_name = _cli.vorg._name except AttributeError: vorg_name = "" logger.info("[sp.challenge] VO: %s", vorg_name) # If more than one idp and if none is selected, I have to do wayf (done, response) = self._pick_idp(environ, came_from) # Three cases: -1 something went wrong or Discovery service used # 0 I've got an IdP to send a request to # >0 ECP in progress logger.debug("_idp_pick returned: %s", done) if done == -1: return response elif done > 0: self.outstanding_queries[done] = came_from return ECP_response(response) else: entity_id = response logger.info("[sp.challenge] entity_id: %s", entity_id) # Do the AuthnRequest _binding = BINDING_HTTP_REDIRECT try: srvs = _cli.metadata.single_sign_on_service( entity_id, _binding) logger.debug("srvs: %s", srvs) dest = srvs[0]["location"] logger.debug("destination: %s", dest) extensions = None cert = None if _cli.config.generate_cert_func is not None: cert_str, req_key_str = _cli.config.generate_cert_func() cert = {"cert": cert_str, "key": req_key_str} spcertenc = SPCertEnc(x509_data=ds.X509Data( x509_certificate=ds.X509Certificate(text=cert_str))) extensions = Extensions(extension_elements=[ element_to_extension_element(spcertenc) ]) if _cli.authn_requests_signed: _sid = saml2_tophat.s_utils.sid() req_id, msg_str = _cli.create_authn_request( dest, vorg=vorg_name, sign=_cli.authn_requests_signed, message_id=_sid, extensions=extensions, ) _sid = req_id else: req_id, req = _cli.create_authn_request( dest, vorg=vorg_name, sign=False, extensions=extensions) msg_str = "%s" % req _sid = req_id if cert is not None: self.outstanding_certs[_sid] = cert ht_args = _cli.apply_binding( _binding, msg_str, destination=dest, relay_state=came_from, sign=_cli.authn_requests_signed, ) logger.debug("ht_args: %s", ht_args) except Exception as exc: logger.exception(exc) raise Exception("Failed to construct the AuthnRequest: %s" % exc) try: ret = _cli.config.getattr("endpoints", "sp")["discovery_response"][0][0] if (environ["PATH_INFO"]) in ret and ret.split( environ["PATH_INFO"])[1] == "": query = parse_qs(environ["QUERY_STRING"]) sid = query["sid"][0] came_from = self.outstanding_queries[sid] except: pass # remember the request self.outstanding_queries[_sid] = came_from if not ht_args["data"] and ht_args["headers"][0][0] == "Location": logger.debug("redirect to: %s", ht_args["headers"][0][1]) return HTTPSeeOther(headers=ht_args["headers"]) else: return ht_args["data"]