commit b08aadc08c3cd1aefc26ba7470f5cdbb1f6a51e1
Author: Kostas Papadimitriou <kpap@grnet.gr>
Date:   Tue Sep 24 17:16:29 2013 +0300

    astakos: Shibboleth EPPN migration functionality
    
    Prior to this commit astakos used the mod_shib2 EPPN header value as the
    unique identifier for associating shibboleth idp users to astakos user entries.
    
    This commit alters this behaviour and from now on astakos resloves unique
    identifier from the REMOTE_USER header. REMOTE_USER is a header mod_shib2 sets
    containing a value of the available shibboleth IdP metadata. The metadata
    key (persistent-id or eppn in most common scenarios) used can be configured
    from within shibboleth2.xml config file.
    
    <ApplicationDefaults id="default" .... .... REMOTE_USER="persistent-id"...>
    
    An additional setting ``ASTAKOS_SHIBBOLETH_MIGRATE_EPPN`` is added in order
    to facilitate migration of existing EPPN entries to persistent-id/targeted-id
    (or whichever metadata the REMOTE_USER maps to). When set to ``True``, after
    each shibboleth login astakos will try to migrate the existing EPPN entry
    by following the below mentioned steps:
    
    * If no REMOTE_USER header exists or is empty, redirect to an error view.
      Otherwise continue to the next step.
    * Resolve EPPN header and check if an account is currently associated with this
      EPPN.
    * If user exists, retrieve user's shibboleth entry (AstakosUserAuthProvider
      instance) and replace stored identifier (EPPN) with the identifier contained
      in REMOTE_USER header.
    * Continue to login or signup process using REMOTE_USER value as the unique
      user identifier that associates astakos user to the shibboleth account.
    
    Conflicts:
    
    	snf-astakos-app/astakos/im/messages.py
    	snf-astakos-app/astakos/im/tests/auth.py

diff --git a/snf-astakos-app/astakos/im/settings.py b/snf-astakos-app/astakos/im/settings.py
index 8b9e5bc..57cb4fd 100644
--- a/snf-astakos-app/astakos/im/settings.py
+++ b/snf-astakos-app/astakos/im/settings.py
@@ -181,6 +181,10 @@ ENABLE_LOCAL_ACCOUNT_MIGRATION = getattr(
 SHIBBOLETH_MIGRATE_EPPN = getattr(settings, 'ASTAKOS_SHIBBOLETH_MIGRATE_EPPN',
                                   False)
 
+# Migrate eppn identifiers to remote id
+SHIBBOLETH_MIGRATE_EPPN = getattr(settings, 'ASTAKOS_SHIBBOLETH_MIGRATE_EPPN',
+                                  False)
+
 # Strict shibboleth usage
 SHIBBOLETH_REQUIRE_NAME_INFO = getattr(settings,
                                        'ASTAKOS_SHIBBOLETH_REQUIRE_NAME_INFO',
diff --git a/snf-astakos-app/astakos/im/tests/auth.py b/snf-astakos-app/astakos/im/tests/auth.py
index 93daccb..2f8c40b 100644
--- a/snf-astakos-app/astakos/im/tests/auth.py
+++ b/snf-astakos-app/astakos/im/tests/auth.py
@@ -384,7 +384,7 @@ class TestLocal(TestCase):
     @im_settings(RECAPTCHA_ENABLED=True, RATELIMIT_RETRIES_ALLOWED=3)
     def test_login_ratelimit(self):
         from django.core.cache import cache
-        cache.clear()
+        [cache.delete(key) for key in cache._cache.keys()]
 
         credentials = {'username': 'γιού τι έφ', 'password': 'password'}
         r = self.client.post(ui_url('local'), credentials, follow=True)
@@ -396,9 +396,6 @@ class TestLocal(TestCase):
         r = self.client.post(ui_url('local'), credentials, follow=True)
         fields = r.context['login_form'].fields.keyOrder
         self.assertTrue('recaptcha_challenge_field' in fields)
-        r = self.client.post(ui_url('local'), follow=True)
-        fields = r.context['login_form'].fields.keyOrder
-        self.assertTrue('recaptcha_challenge_field' in fields)
 
     def test_no_moderation(self):
         # disable moderation
@@ -820,7 +817,7 @@ class TestAuthProviderViews(TestCase):
 
         # new academic user
         self.assertFalse(academic_users.filter(email='newuser@synnefo.org'))
-        cl_newuser.set_tokens(eppn="newusereppn", mail="newuser@synnefo.org",
+        cl_newuser.set_tokens(remote_user="newusereppn", mail="newuser@synnefo.org",
                               surname="Lastname")
         r = cl_newuser.get(ui_url('login/shibboleth?'), follow=True)
         initial = r.context['signup_form'].initial
diff --git a/snf-astakos-app/astakos/im/views/target/shibboleth.py b/snf-astakos-app/astakos/im/views/target/shibboleth.py
index 33e53bd..54d7db5 100644
--- a/snf-astakos-app/astakos/im/views/target/shibboleth.py
+++ b/snf-astakos-app/astakos/im/views/target/shibboleth.py
@@ -72,8 +72,13 @@ def migrate_eppn_to_remote_id(eppn, remote_id):
         pass
 
     pending_users = \
+<<<<<<< HEAD
         PendingThirdPartyUser.objects.filter(third_party_identifier=eppn,
                                              provider='shibboleth')
+=======
+            PendingThirdPartyUser.objects.filter(third_party_identifier=eppn,
+                                                 provider='shibboleth')
+>>>>>>> astakos: Shibboleth EPPN migration functionality
 
     for pending in pending_users:
         msg = "Migrating pending user %s eppn (%s -> %s)"
@@ -158,11 +163,7 @@ def login(request,
         fullname = '%s %s' % (first_name, last_name)
 
         if not any([first_name, last_name]) and \
-<<<<<<< HEAD
-                settings.SHIBBOLETH_REQUIRE_NAME_INFO:
-=======
                     settings.SHIBBOLETH_REQUIRE_NAME_INFO:
->>>>>>> astakos: Set initial signup values if available
             raise KeyError(_(astakos_messages.SHIBBOLETH_MISSING_NAME))
 
     except KeyError, e:
@@ -175,16 +176,8 @@ def login(request,
 
     affiliation = tokens.get(Tokens.SHIB_EP_AFFILIATION, 'Shibboleth')
     email = tokens.get(Tokens.SHIB_MAIL, '')
-<<<<<<< HEAD
     provider_info = {'eppn': eppn, 'email': email, 'name': fullname,
                      'headers': shibboleth_headers, 'user_id': user_id}
-=======
-    eppn_info = tokens.get(Tokens.SHIB_EPPN)
-    provider_info = {'eppn': eppn_info, 'email': email, 'name': fullname,
-                     'headers': shibboleth_headers}
-    userid = eppn
-
->>>>>>> astakos: Set initial signup values if available
 
     try:
         return handle_third_party_login(request, 'shibboleth',
@@ -196,11 +189,7 @@ def login(request,
                      'first_name': first_name,
                      'last_name': last_name,
                      'email': email}
-<<<<<<< HEAD
         return handle_third_party_signup(request, user_id, 'shibboleth',
-=======
-        return handle_third_party_signup(request, userid, 'shibboleth',
->>>>>>> astakos: Set initial signup values if available
                                          third_party_key,
                                          provider_info,
                                          user_info,
