Revision ac3c3a4b
| b/aai/middleware.py | ||
|---|---|---|
| 31 | 31 |
return |
| 32 | 32 |
|
| 33 | 33 |
#A user authenticated by Shibboleth, must include a uniq id |
| 34 |
if Tokens.SIB_EPPN in request.META: |
|
| 35 |
#We must somehow make sure that we only process |
|
| 36 |
#SIB headers when coming from a URL whitelist, |
|
| 37 |
#or a similar form of restriction |
|
| 38 |
#if request.get_host() not in settings.SHIBBOLETH_WHITELIST.keys(): |
|
| 39 |
# return HttpResponseRedirect(settings.APP_INSTALL_URL + settings.LOGIN_PATH) |
|
| 40 |
|
|
| 34 |
if Tokens.SIB_EPPN in request.META and Tokens.SIB_SESSION_ID in request.META: |
|
| 41 | 35 |
user = None |
| 42 | 36 |
try: |
| 43 | 37 |
user = SynnefoUser.objects.get( |
| ... | ... | |
| 51 | 45 |
if register_shibboleth_user(request.META): |
| 52 | 46 |
user = SynnefoUser.objects.get( |
| 53 | 47 |
uniq = request.META[Tokens.SIB_EPPN]) |
| 54 |
response = HttpResponse() |
|
| 55 |
response[self.auth_token] = user.auth_token |
|
| 56 |
response['Location'] = settings.APP_INSTALL_URL |
|
| 57 |
response.status_code = 302 |
|
| 58 |
return response |
|
| 48 |
return self._redirect_shib_auth_user(user) |
|
| 59 | 49 |
else: |
| 60 | 50 |
return HttpResponseRedirect(settings.APP_INSTALL_URL + settings.LOGIN_PATH) |
| 61 | 51 |
|
| 62 | 52 |
#User and authentication token valid, user allowed to proceed |
| 63 |
return |
|
| 53 |
return self._redirect_shib_auth_user(user)
|
|
| 64 | 54 |
|
| 65 | 55 |
#An API authentication request |
| 66 | 56 |
if self.auth_user in request.META and self.auth_key in request.META and 'GET' == request.method: |
| ... | ... | |
| 90 | 80 |
else: |
| 91 | 81 |
#Avoid redirect loops |
| 92 | 82 |
if request.path.endswith(settings.LOGIN_PATH): |
| 93 |
return
|
|
| 83 |
return |
|
| 94 | 84 |
else : |
| 95 | 85 |
#No authentication info found in headers, redirect to Shibboleth |
| 96 | 86 |
return HttpResponseRedirect(settings.APP_INSTALL_URL + settings.LOGIN_PATH) |
| ... | ... | |
| 102 | 92 |
response['Vary'] = self.auth_token |
| 103 | 93 |
return response |
| 104 | 94 |
|
| 95 |
|
|
| 96 |
def _redirect_shib_auth_user(self, user): |
|
| 97 |
response = HttpResponse() |
|
| 98 |
response[self.auth_token] = user.auth_token |
|
| 99 |
response['Location'] = settings.APP_INSTALL_URL |
|
| 100 |
response.status_code = 302 |
|
| 101 |
return response |
|
| b/aai/shibboleth.py | ||
|---|---|---|
| 15 | 15 |
SIB_EDU_PERSON_AFFILIATION = "shib_ep_primaryaffiliation" |
| 16 | 16 |
SIB_SCHAC_PERSONAL_UNIQUE_CODE = "schacPersonalUniqueCode" |
| 17 | 17 |
SIB_GR_EDU_PERSON_UNDERGRADUATE_BRANCH = "grEduPersonUndergraduateBranch" |
| 18 |
SIB_SESSION_ID = "Shib-Session-ID" |
|
| 18 | 19 |
|
| 19 | 20 |
class NoUniqueToken(object): |
| 20 | 21 |
|
| ... | ... | |
| 36 | 37 |
http://aai.grnet.gr/policy |
| 37 | 38 |
""" |
| 38 | 39 |
realname = None |
| 39 |
print tokens |
|
| 40 | 40 |
|
| 41 | 41 |
if Tokens.SIB_SURNAME in tokens: |
| 42 | 42 |
realname = tokens[Tokens.SIB_SURNAME] |
| 43 |
else: |
|
| 44 |
realname = '' |
|
| 43 | 45 |
|
| 44 | 46 |
if Tokens.SIB_NAME in tokens: |
| 45 | 47 |
realname = tokens[Tokens.SIB_NAME] + ' ' + realname |
| b/aai/tests.py | ||
|---|---|---|
| 26 | 26 |
"""test request that should succeed and register a user |
| 27 | 27 |
""" |
| 28 | 28 |
response = self.client.get(self.apibase + '/servers', {},
|
| 29 |
**{Tokens.SIB_GIVEN_NAME: 'Jimmy',
|
|
| 30 |
Tokens.SIB_EDU_PERSON_PRINCIPAL_NAME: 'jh@gmail.com', |
|
| 31 |
Tokens.SIB_DISPLAY_NAME: 'Jimmy Hendrix', |
|
| 29 |
**{Tokens.SIB_NAME: 'Jimmy',
|
|
| 30 |
Tokens.SIB_EPPN: 'jh@gmail.com', |
|
| 31 |
Tokens.SIB_CN: 'Jimmy Hendrix', |
|
| 32 |
Tokens.SIB_SESSION_ID: '123321', |
|
| 32 | 33 |
'TEST-AAI' : 'true'}) |
| 33 | 34 |
user = None |
| 34 | 35 |
try: |
| ... | ... | |
| 37 | 38 |
self.assertNotEqual(user, None) |
| 38 | 39 |
self.assertNotEqual(user, None) |
| 39 | 40 |
self.assertEquals(response.status_code, 302) |
| 40 |
self.assertEquals(response['Location'], "http://testserver/")
|
|
| 41 |
self.assertEquals(response['Location'], settings.APP_INSTALL_URL)
|
|
| 41 | 42 |
self.assertTrue('X-Auth-Token' in response)
|
| 42 | 43 |
self.assertEquals(response['X-Auth-Token'], user.auth_token) |
| 43 | 44 |
|
| 45 |
response = self.client.get(self.apibase + '/servers', {},
|
|
| 46 |
**{Tokens.SIB_NAME: 'Jimmy',
|
|
| 47 |
Tokens.SIB_EPPN: 'jh@gmail.com', |
|
| 48 |
Tokens.SIB_CN: 'Jimmy Hendrix', |
|
| 49 |
Tokens.SIB_SESSION_ID: '123321', |
|
| 50 |
'TEST-AAI' : 'true'}) |
|
| 51 |
|
|
| 52 |
user1 = None |
|
| 53 |
try: |
|
| 54 |
user1 = SynnefoUser.objects.get(uniq = "jh@gmail.com") |
|
| 55 |
except SynnefoUser.DoesNotExist: |
|
| 56 |
self.assertNotEqual(user1, None) |
|
| 57 |
|
|
| 58 |
self.assertEquals(user1.auth_token , user.auth_token) |
|
| 59 |
self.assertTrue(response['Location'].endswith, '/servers') |
|
| 60 |
|
|
| 44 | 61 |
def test_shibboleth_no_uniq_request(self): |
| 45 | 62 |
"""test a request with no unique field |
| 46 | 63 |
""" |
| 47 | 64 |
response = self.client.get(self.apibase + '/servers', {},
|
| 48 |
**{Tokens.SIB_GIVEN_NAME: 'Jimmy',
|
|
| 49 |
Tokens.SIB_DISPLAY_NAME: 'Jimmy Hendrix',
|
|
| 65 |
**{Tokens.SIB_NAME: 'Jimmy',
|
|
| 66 |
Tokens.SIB_CN: 'Jimmy Hendrix',
|
|
| 50 | 67 |
'TEST-AAI' : 'true'}) |
| 51 | 68 |
self._test_redirect(response) |
| 52 | 69 |
|
| 53 |
def test_shibboleth_wrong_from_request(self): |
|
| 54 |
""" test request from wrong host |
|
| 55 |
""" |
|
| 56 |
response = self.client.get(self.apibase + '/servers', {},
|
|
| 57 |
**{Tokens.SIB_GIVEN_NAME: 'Jimmy',
|
|
| 58 |
Tokens.SIB_EDU_PERSON_PRINCIPAL_NAME: 'jh@gmail.com', |
|
| 59 |
Tokens.SIB_DISPLAY_NAME: 'Jimmy Hendrix', |
|
| 60 |
'REMOTE_ADDR': '1.2.3.4', |
|
| 61 |
'SERVER_NAME': 'nohost.nodomain', |
|
| 62 |
'TEST-AAI' : 'true'}) |
|
| 63 |
self._test_redirect(response) |
|
| 64 |
|
|
| 65 | 70 |
def test_shibboleth_expired_token(self): |
| 66 | 71 |
""" test request from expired token |
| 67 | 72 |
""" |
| ... | ... | |
| 90 | 95 |
self.assertTrue('Vary' in response)
|
| 91 | 96 |
self.assertTrue('X-Auth-Token' in response['Vary'])
|
| 92 | 97 |
|
| 93 |
|
|
| 94 |
def test_shibboleth_redirect_loop(self): |
|
| 95 |
""" |
|
| 96 |
""" |
|
| 97 |
response = self.client.get(self.apibase + '/servers', {},
|
|
| 98 |
**{'Referer' : settings.LOGIN_PATH,
|
|
| 99 |
'TEST-AAI' : 'true'}) |
|
| 100 |
self.assertEquals(response.status_code, 200) |
|
| 101 |
|
|
| 102 |
|
|
| 103 | 98 |
def test_fail_oapi_auth(self): |
| 104 | 99 |
""" test authentication from not registered user using OpenAPI |
| 105 | 100 |
""" |
| b/settings.py.dist | ||
|---|---|---|
| 119 | 119 |
) |
| 120 | 120 |
|
| 121 | 121 |
INSTALLED_APPS = ( |
| 122 |
'django.contrib.auth', |
|
| 123 | 122 |
'django.contrib.contenttypes', |
| 124 | 123 |
'django.contrib.sessions', |
| 125 | 124 |
'django.contrib.sites', |
| ... | ... | |
| 171 | 170 |
|
| 172 | 171 |
LOGIN_PATH = "/login" |
| 173 | 172 |
|
| 174 |
SHIBBOLETH_WHITELIST = {
|
|
| 175 |
'localhost' : '127.0.0.1', |
|
| 176 |
'testserver' : '127.0.0.1' |
|
| 177 |
} |
|
| 178 |
|
|
| 179 | 173 |
#Number of hours during which a user token is active |
| 180 | 174 |
AUTH_TOKEN_DURATION = 24 |
| 181 | 175 |
|
Also available in: Unified diff