Revision 57e59589
| b/api/middleware.py | ||
|---|---|---|
| 33 | 33 |
|
| 34 | 34 |
#A user authenticated by Shibboleth, must include a uniq id |
| 35 | 35 |
if Tokens.SIB_EDU_PERSON_PRINCIPAL_NAME in request.META: |
| 36 |
#TODO: We must somehow make sure that we only process
|
|
| 37 |
# SIB headers when coming from a URL whitelist,
|
|
| 38 |
# or a similar form of restriction
|
|
| 36 |
#We must somehow make sure that we only process |
|
| 37 |
#SIB headers when coming from a URL whitelist, |
|
| 38 |
#or a similar form of restriction |
|
| 39 | 39 |
if request.get_host() not in settings.SHIBBOLETH_WHITELIST.keys(): |
| 40 | 40 |
return HttpResponseRedirect(settings.SHIBBOLETH_HOST) |
| 41 | 41 |
|
| ... | ... | |
| 48 | 48 |
|
| 49 | 49 |
#No user with this id could be found in the database |
| 50 | 50 |
if user is None: |
| 51 |
#Try to register incoming user
|
|
| 51 |
#Attempt to register the incoming user
|
|
| 52 | 52 |
if register_shibboleth_user(request.META): |
| 53 |
#Registration succeded, user allowed to proceed |
|
| 54 |
return |
|
| 55 |
#Registration failed, redirect to Shibboleth |
|
| 56 |
return HttpResponseRedirect(settings.SHIBBOLETH_HOST) |
|
| 53 |
user = SynnefoUser.objects.get( |
|
| 54 |
uniq = request.META[Tokens.SIB_EDU_PERSON_PRINCIPAL_NAME]) |
|
| 55 |
response = HttpResponse() |
|
| 56 |
response[self.auth_token] = user.auth_token |
|
| 57 |
response['Location'] = "/" |
|
| 58 |
response.status_code = 302 |
|
| 59 |
return response |
|
| 60 |
else: |
|
| 61 |
return HttpResponseRedirect(settings.SHIBBOLETH_HOST) |
|
| 57 | 62 |
|
| 58 | 63 |
#User and authentication token valid, user allowed to proceed |
| 59 | 64 |
return |
| ... | ... | |
| 76 | 81 |
#Tell proxies and other interested parties that the |
| 77 | 82 |
#request varies based on the auth token, to avoid |
| 78 | 83 |
#caching of results |
| 79 |
response['Vary'] = self.auth_key
|
|
| 84 |
response['Vary'] = self.auth_token
|
|
| 80 | 85 |
return response |
| b/api/tests_auth.py | ||
|---|---|---|
| 35 | 35 |
except SynnefoUser.DoesNotExist: |
| 36 | 36 |
self.assertNotEqual(user, None) |
| 37 | 37 |
self.assertNotEqual(user, None) |
| 38 |
self.assertTrue('X-Auth-Token' in response.META)
|
|
| 39 |
self.assertTrue(len(response['X-Auth-Token'])) |
|
| 38 |
self.assertEquals(response.status_code, 302) |
|
| 39 |
self.assertEquals(response['Location'], "http://testserver/") |
|
| 40 |
self.assertTrue('X-Auth-Token' in response)
|
|
| 41 |
self.assertEquals(response['X-Auth-Token'], user.auth_token) |
|
| 40 | 42 |
|
| 41 | 43 |
def test_shibboleth_no_uniq_request(self): |
| 42 | 44 |
"""test a request with no unique field |
| ... | ... | |
| 69 | 71 |
**{'X-Auth-Token': user.auth_token})
|
| 70 | 72 |
self._test_redirect(response) |
| 71 | 73 |
|
| 72 |
def test_shibboleth_auth(self):
|
|
| 73 |
""" test redirect to shibboleth page
|
|
| 74 |
def test_shibboleth_redirect(self):
|
|
| 75 |
""" test redirect to Sibboleth page
|
|
| 74 | 76 |
""" |
| 75 | 77 |
response = self.client.get(self.apibase + '/servers') |
| 78 |
self._test_redirect(response) |
|
| 79 |
|
|
| 80 |
def test_shibboleth_auth(self): |
|
| 81 |
""" test authentication with X-Auth-Token |
|
| 82 |
""" |
|
| 76 | 83 |
user = SynnefoUser.objects.get(uniq = "test@synnefo.gr") |
| 77 |
self.assertTrue('X-Auth-Token' in response.META)
|
|
| 84 |
response = self.client.get(self.apibase + '/servers', {},
|
|
| 85 |
**{'X-Auth-Token': user.auth_token})
|
|
| 86 |
self.assertTrue(response.status_code, 200) |
|
| 87 |
self.assertTrue('Vary' in response)
|
|
| 88 |
self.assertTrue('X-Auth-Token' in response['Vary'])
|
|
| 78 | 89 |
|
| 79 | 90 |
def test_fail_oapi_auth(self): |
| 80 | 91 |
""" test authentication from not registered user using OpenAPI |
| ... | ... | |
| 104 | 115 |
|
| 105 | 116 |
def _test_redirect(self, response): |
| 106 | 117 |
self.assertEquals(response.status_code, 302) |
| 107 |
self.assertEquals('Location' in response.META)
|
|
| 118 |
self.assertTrue('Location' in response)
|
|
| 108 | 119 |
self.assertEquals(response['Location'], settings.SHIBBOLETH_HOST) |
Also available in: Unified diff