Revision 8f377cd6
| b/aai/middleware.py | ||
|---|---|---|
| 2 | 2 |
from django.conf import settings |
| 3 | 3 |
from django.http import HttpResponse, HttpResponseRedirect |
| 4 | 4 |
from synnefo.db.models import SynnefoUser |
| 5 |
from synnefo.logic.shibboleth import Tokens, register_shibboleth_user
|
|
| 5 |
from synnefo.aai.shibboleth import Tokens, register_shibboleth_user
|
|
| 6 | 6 |
import time |
| 7 | 7 |
|
| 8 | 8 |
class SynnefoAuthMiddleware(object): |
| ... | ... | |
| 85 | 85 |
response['X-CDN-Management-Url'] = "" |
| 86 | 86 |
return response |
| 87 | 87 |
|
| 88 |
#No authentication info found in headers, redirect to Shibboleth |
|
| 89 |
return HttpResponseRedirect(settings.SHIBBOLETH_HOST) |
|
| 88 |
if settings.TESTING: |
|
| 89 |
if 'TEST-AAI' in request.META: |
|
| 90 |
return HttpResponseRedirect(settings.SHIBBOLETH_HOST) |
|
| 91 |
else: |
|
| 92 |
#No authentication info found in headers, redirect to Shibboleth |
|
| 93 |
return HttpResponseRedirect(settings.SHIBBOLETH_HOST) |
|
| 90 | 94 |
|
| 91 | 95 |
def process_response(self, request, response): |
| 92 | 96 |
#Tell proxies and other interested parties that the |
| b/aai/shibboleth.py | ||
|---|---|---|
| 1 |
# |
|
| 2 |
# Business Logic for working with sibbolleth users |
|
| 3 |
# |
|
| 4 |
# Copyright 2010 Greek Research and Technology Network |
|
| 5 |
# |
|
| 6 |
|
|
| 7 |
from synnefo.logic import users |
|
| 8 |
|
|
| 9 |
class Tokens: |
|
| 10 |
SIB_GIVEN_NAME = "givenName" |
|
| 11 |
SIB_SN = "sn" |
|
| 12 |
SIB_CN = "cn" |
|
| 13 |
SIB_DISPLAY_NAME = "displayName" |
|
| 14 |
SIB_EDU_PERSON_PRINCIPAL_NAME = "eduPersonPrincipalName" |
|
| 15 |
SIB_EDU_PERSON_AFFILIATION = "eduPersonAffiliation" |
|
| 16 |
SIB_SCHAC_HOME_ORGANISATION = "schacHomeOrganization" |
|
| 17 |
SIB_SCHAC_PERSONAL_UNIQUE_CODE = "schacPersonalUniqueCode" |
|
| 18 |
SIB_GR_EDU_PERSON_UNDERGRADUATE_BRANCH = "grEduPersonUndergraduateBranch" |
|
| 19 |
|
|
| 20 |
class NoUniqueToken(object): |
|
| 21 |
|
|
| 22 |
def __init__(self, msg): |
|
| 23 |
self.msg = msg |
|
| 24 |
|
|
| 25 |
pass |
|
| 26 |
|
|
| 27 |
class NoRealName(object): |
|
| 28 |
|
|
| 29 |
def __init__(self, msg): |
|
| 30 |
self.msg = msg |
|
| 31 |
|
|
| 32 |
pass |
|
| 33 |
|
|
| 34 |
def register_shibboleth_user(tokens): |
|
| 35 |
"""Registers a sibbolleth user using the input hash as a source for data. |
|
| 36 |
The token requirements are described in: |
|
| 37 |
http://aai.grnet.gr/policy |
|
| 38 |
""" |
|
| 39 |
realname = None |
|
| 40 |
|
|
| 41 |
if Tokens.SIB_GIVEN_NAME in tokens: |
|
| 42 |
realname = tokens[Tokens.SIB_GIVEN_NAME] |
|
| 43 |
|
|
| 44 |
if Tokens.SIB_DISPLAY_NAME in tokens: |
|
| 45 |
realname = tokens[Tokens.SIB_DISPLAY_NAME] |
|
| 46 |
|
|
| 47 |
is_student = Tokens.SIB_SCHAC_PERSONAL_UNIQUE_CODE in tokens or \ |
|
| 48 |
Tokens.SIB_GR_EDU_PERSON_UNDERGRADUATE_BRANCH in tokens |
|
| 49 |
|
|
| 50 |
unq = tokens.get(Tokens.SIB_EDU_PERSON_PRINCIPAL_NAME) |
|
| 51 |
|
|
| 52 |
if unq is None: |
|
| 53 |
raise NoUniqueToken("Authentication does not return a unique token")
|
|
| 54 |
|
|
| 55 |
if realname is None: |
|
| 56 |
raise NoRealName("Authentication does not return the user's name")
|
|
| 57 |
|
|
| 58 |
if is_student: |
|
| 59 |
users.register_student(realname, '' ,unq) |
|
| 60 |
else: |
|
| 61 |
users.register_professor(realname, '' ,unq) |
|
| 62 |
|
|
| 63 |
return True |
|
| b/aai/tests.py | ||
|---|---|---|
| 1 | 1 |
# |
| 2 |
# Unit Tests for api
|
|
| 2 |
# Unit Tests for aai
|
|
| 3 | 3 |
# |
| 4 |
# Provides automated tests for api module
|
|
| 4 |
# Provides automated tests for aai module. The tests
|
|
| 5 | 5 |
# |
| 6 | 6 |
# Copyright 2011 Greek Research and Technology Network |
| 7 | 7 |
# |
| ... | ... | |
| 10 | 10 |
from django.test.client import Client |
| 11 | 11 |
from django.conf import settings |
| 12 | 12 |
|
| 13 |
from synnefo.logic.shibboleth import Tokens, NoUniqueToken
|
|
| 13 |
from synnefo.aai.shibboleth import Tokens, NoUniqueToken
|
|
| 14 | 14 |
from synnefo.db.models import SynnefoUser |
| 15 | 15 |
|
| 16 | 16 |
from datetime import datetime, timedelta |
| ... | ... | |
| 28 | 28 |
response = self.client.get(self.apibase + '/servers', {},
|
| 29 | 29 |
**{Tokens.SIB_GIVEN_NAME: 'Jimmy',
|
| 30 | 30 |
Tokens.SIB_EDU_PERSON_PRINCIPAL_NAME: 'jh@gmail.com', |
| 31 |
Tokens.SIB_DISPLAY_NAME: 'Jimmy Hendrix'}) |
|
| 31 |
Tokens.SIB_DISPLAY_NAME: 'Jimmy Hendrix', |
|
| 32 |
'TEST-AAI' : 'true'}) |
|
| 32 | 33 |
user = None |
| 33 | 34 |
try: |
| 34 | 35 |
user = SynnefoUser.objects.get(uniq = "jh@gmail.com") |
| ... | ... | |
| 45 | 46 |
""" |
| 46 | 47 |
response = self.client.get(self.apibase + '/servers', {},
|
| 47 | 48 |
**{Tokens.SIB_GIVEN_NAME: 'Jimmy',
|
| 48 |
Tokens.SIB_DISPLAY_NAME: 'Jimmy Hendrix'}) |
|
| 49 |
Tokens.SIB_DISPLAY_NAME: 'Jimmy Hendrix', |
|
| 50 |
'TEST-AAI' : 'true'}) |
|
| 49 | 51 |
self._test_redirect(response) |
| 50 | 52 |
|
| 51 | 53 |
def test_shibboleth_wrong_from_request(self): |
| ... | ... | |
| 56 | 58 |
Tokens.SIB_EDU_PERSON_PRINCIPAL_NAME: 'jh@gmail.com', |
| 57 | 59 |
Tokens.SIB_DISPLAY_NAME: 'Jimmy Hendrix', |
| 58 | 60 |
'REMOTE_ADDR': '1.2.3.4', |
| 59 |
'SERVER_NAME': 'nohost.nodomain'}) |
|
| 61 |
'SERVER_NAME': 'nohost.nodomain', |
|
| 62 |
'TEST-AAI' : 'true'}) |
|
| 60 | 63 |
self._test_redirect(response) |
| 61 | 64 |
|
| 62 | 65 |
def test_shibboleth_expired_token(self): |
| ... | ... | |
| 66 | 69 |
self.assertNotEqual(user.auth_token_created, None) |
| 67 | 70 |
self._update_user_ts(user) |
| 68 | 71 |
response = self.client.get(self.apibase + '/servers', {},
|
| 69 |
**{'X-Auth-Token': user.auth_token})
|
|
| 72 |
**{'X-Auth-Token': user.auth_token,
|
|
| 73 |
'TEST-AAI' : 'true'}) |
|
| 70 | 74 |
self._test_redirect(response) |
| 71 | 75 |
|
| 72 | 76 |
def test_shibboleth_redirect(self): |
| 73 | 77 |
""" test redirect to Sibboleth page |
| 74 | 78 |
""" |
| 75 |
response = self.client.get(self.apibase + '/servers') |
|
| 79 |
response = self.client.get(self.apibase + '/servers', {}, **{'TEST-AAI' : 'true'})
|
|
| 76 | 80 |
self._test_redirect(response) |
| 77 | 81 |
|
| 78 | 82 |
def test_shibboleth_auth(self): |
| ... | ... | |
| 80 | 84 |
""" |
| 81 | 85 |
user = SynnefoUser.objects.get(uniq = "test@synnefo.gr") |
| 82 | 86 |
response = self.client.get(self.apibase + '/servers', {},
|
| 83 |
**{'X-Auth-Token': user.auth_token})
|
|
| 87 |
**{'X-Auth-Token': user.auth_token,
|
|
| 88 |
'TEST-AAI' : 'true'}) |
|
| 84 | 89 |
self.assertTrue(response.status_code, 200) |
| 85 | 90 |
self.assertTrue('Vary' in response)
|
| 86 | 91 |
self.assertTrue('X-Auth-Token' in response['Vary'])
|
| ... | ... | |
| 90 | 95 |
""" |
| 91 | 96 |
response = self.client.get(self.apibase + '/servers', {},
|
| 92 | 97 |
**{'X-Auth-User': 'notme',
|
| 93 |
'X-Auth-Key': '0xdeadbabe'}) |
|
| 98 |
'X-Auth-Key': '0xdeadbabe', |
|
| 99 |
'TEST-AAI' : 'true'}) |
|
| 94 | 100 |
self.assertEquals(response.status_code, 401) |
| 95 | 101 |
|
| 96 | 102 |
def test_oapi_auth(self): |
| ... | ... | |
| 98 | 104 |
""" |
| 99 | 105 |
response = self.client.get(self.apibase + '/', {},
|
| 100 | 106 |
**{'X-Auth-User': 'testdbuser',
|
| 101 |
'X-Auth-Key': 'test@synnefo.gr'}) |
|
| 107 |
'X-Auth-Key': 'test@synnefo.gr', |
|
| 108 |
'TEST-AAI' : 'true'}) |
|
| 102 | 109 |
self.assertEquals(response.status_code, 204) |
| 103 | 110 |
self.assertNotEqual(response['X-Auth-Token'], None) |
| 104 | 111 |
self.assertEquals(response['X-Server-Management-Url'], '') |
| ... | ... | |
| 114 | 121 |
user.auth_token_created = (datetime.now() - |
| 115 | 122 |
timedelta(hours = settings.AUTH_TOKEN_DURATION)) |
| 116 | 123 |
user.save() |
| 124 |
|
|
| 125 |
|
|
| /dev/null | ||
|---|---|---|
| 1 |
# |
|
| 2 |
# Business Logic for working with sibbolleth users |
|
| 3 |
# |
|
| 4 |
# Copyright 2010 Greek Research and Technology Network |
|
| 5 |
# |
|
| 6 |
|
|
| 7 |
from synnefo.logic import users |
|
| 8 |
|
|
| 9 |
class Tokens: |
|
| 10 |
SIB_GIVEN_NAME = "givenName" |
|
| 11 |
SIB_SN = "sn" |
|
| 12 |
SIB_CN = "cn" |
|
| 13 |
SIB_DISPLAY_NAME = "displayName" |
|
| 14 |
SIB_EDU_PERSON_PRINCIPAL_NAME = "eduPersonPrincipalName" |
|
| 15 |
SIB_EDU_PERSON_AFFILIATION = "eduPersonAffiliation" |
|
| 16 |
SIB_SCHAC_HOME_ORGANISATION = "schacHomeOrganization" |
|
| 17 |
SIB_SCHAC_PERSONAL_UNIQUE_CODE = "schacPersonalUniqueCode" |
|
| 18 |
SIB_GR_EDU_PERSON_UNDERGRADUATE_BRANCH = "grEduPersonUndergraduateBranch" |
|
| 19 |
|
|
| 20 |
class NoUniqueToken(object): |
|
| 21 |
|
|
| 22 |
def __init__(self, msg): |
|
| 23 |
self.msg = msg |
|
| 24 |
|
|
| 25 |
pass |
|
| 26 |
|
|
| 27 |
class NoRealName(object): |
|
| 28 |
|
|
| 29 |
def __init__(self, msg): |
|
| 30 |
self.msg = msg |
|
| 31 |
|
|
| 32 |
pass |
|
| 33 |
|
|
| 34 |
def register_shibboleth_user(tokens): |
|
| 35 |
"""Registers a sibbolleth user using the input hash as a source for data. |
|
| 36 |
The token requirements are described in: |
|
| 37 |
http://aai.grnet.gr/policy |
|
| 38 |
""" |
|
| 39 |
realname = None |
|
| 40 |
|
|
| 41 |
if Tokens.SIB_GIVEN_NAME in tokens: |
|
| 42 |
realname = tokens[Tokens.SIB_GIVEN_NAME] |
|
| 43 |
|
|
| 44 |
if Tokens.SIB_DISPLAY_NAME in tokens: |
|
| 45 |
realname = tokens[Tokens.SIB_DISPLAY_NAME] |
|
| 46 |
|
|
| 47 |
is_student = Tokens.SIB_SCHAC_PERSONAL_UNIQUE_CODE in tokens or \ |
|
| 48 |
Tokens.SIB_GR_EDU_PERSON_UNDERGRADUATE_BRANCH in tokens |
|
| 49 |
|
|
| 50 |
unq = tokens.get(Tokens.SIB_EDU_PERSON_PRINCIPAL_NAME) |
|
| 51 |
|
|
| 52 |
if unq is None: |
|
| 53 |
raise NoUniqueToken("Authentication does not return a unique token")
|
|
| 54 |
|
|
| 55 |
if realname is None: |
|
| 56 |
raise NoRealName("Authentication does not return the user's name")
|
|
| 57 |
|
|
| 58 |
if is_student: |
|
| 59 |
users.register_student(realname, '' ,unq) |
|
| 60 |
else: |
|
| 61 |
users.register_professor(realname, '' ,unq) |
|
| 62 |
|
|
| 63 |
return True |
|
| b/settings.py.dist | ||
|---|---|---|
| 95 | 95 |
|
| 96 | 96 |
MIDDLEWARE_CLASSES = ( |
| 97 | 97 |
'django.contrib.sessions.middleware.SessionMiddleware', |
| 98 |
#'django.contrib.auth.middleware.AuthenticationMiddleware',
|
|
| 98 |
'synnefo.aai.middleware.SynnefoAuthMiddleware',
|
|
| 99 | 99 |
'django.middleware.locale.LocaleMiddleware', |
| 100 | 100 |
'django.middleware.common.CommonMiddleware', |
| 101 |
'synnefo.middleware.StripURLMiddleware', |
|
| 102 |
#'synnefo.api.middleware.SynnefoAuthMiddleware', |
|
| 103 |
'django.contrib.messages.middleware.MessageMiddleware', |
|
| 101 |
'django.contrib.messages.middleware.MessageMiddleware' |
|
| 104 | 102 |
) |
| 105 | 103 |
|
| 106 | 104 |
ROOT_URLCONF = 'synnefo.urls' |
| ... | ... | |
| 170 | 168 |
|
| 171 | 169 |
#Number of hours during which a user token is active |
| 172 | 170 |
AUTH_TOKEN_DURATION = 24 |
| 171 |
|
|
| 172 |
#Controls whether the system is running tests |
|
| 173 |
#Set as reading the DEBUG variable is not reliable (Django changes its value |
|
| 174 |
# unpredictably) |
|
| 175 |
TESTING = True |
|
Also available in: Unified diff