Statistics
| Branch: | Tag: | Revision:

root / snf-astakos-app / astakos / im / views / target / shibboleth.py @ c1f65a1e

History | View | Annotate | Download (6 kB)

1
# Copyright 2011-2012 GRNET S.A. All rights reserved.
2
#
3
# Redistribution and use in source and binary forms, with or
4
# without modification, are permitted provided that the following
5
# conditions are met:
6
#
7
#   1. Redistributions of source code must retain the above
8
#      copyright notice, this list of conditions and the following
9
#      disclaimer.
10
#
11
#   2. Redistributions in binary form must reproduce the above
12
#      copyright notice, this list of conditions and the following
13
#      disclaimer in the documentation and/or other materials
14
#      provided with the distribution.
15
#
16
# THIS SOFTWARE IS PROVIDED BY GRNET S.A. ``AS IS'' AND ANY EXPRESS
17
# OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
18
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GRNET S.A OR
20
# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
21
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
22
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
23
# USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
24
# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
26
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27
# POSSIBILITY OF SUCH DAMAGE.
28
#
29
# The views and conclusions contained in the software and
30
# documentation are those of the authors and should not be
31
# interpreted as representing official policies, either expressed
32
# or implied, of GRNET S.A.
33

    
34
from django.conf import settings as global_settings
35
from django.utils.translation import ugettext as _
36
from django.contrib import messages
37
from django.views.decorators.http import require_http_methods
38
from django.http import HttpResponseRedirect
39

    
40
from astakos.im.util import login_url
41
from astakos.im.models import AstakosUser
42
from astakos.im import settings
43
from astakos.im.views.target import get_pending_key, \
44
    handle_third_party_signup, handle_third_party_login, \
45
    init_third_party_session
46
from astakos.im.views.decorators import cookie_fix, requires_auth_provider
47

    
48
import astakos.im.messages as astakos_messages
49
import logging
50

    
51
logger = logging.getLogger(__name__)
52

    
53

    
54
class Tokens:
55
    # these are mapped by the Shibboleth SP software
56
    SHIB_EPPN = "HTTP_EPPN"  # eduPersonPrincipalName
57
    SHIB_NAME = "HTTP_SHIB_INETORGPERSON_GIVENNAME"
58
    SHIB_SURNAME = "HTTP_SHIB_PERSON_SURNAME"
59
    SHIB_CN = "HTTP_SHIB_PERSON_COMMONNAME"
60
    SHIB_DISPLAYNAME = "HTTP_SHIB_INETORGPERSON_DISPLAYNAME"
61
    SHIB_EP_AFFILIATION = "HTTP_SHIB_EP_AFFILIATION"
62
    SHIB_SESSION_ID = "HTTP_SHIB_SESSION_ID"
63
    SHIB_MAIL = "HTTP_SHIB_MAIL"
64
    SHIB_REMOTE_USER = "HTTP_REMOTE_USER"
65

    
66

    
67
@requires_auth_provider('shibboleth')
68
@require_http_methods(["GET", "POST"])
69
@cookie_fix
70
def login(request,
71
          template='im/third_party_check_local.html',
72
          extra_context=None):
73

    
74
    init_third_party_session(request)
75
    extra_context = extra_context or {}
76

    
77
    tokens = request.META
78
    third_party_key = get_pending_key(request)
79

    
80
    shibboleth_headers = {}
81
    for token in dir(Tokens):
82
        if token == token.upper():
83
            shibboleth_headers[token] = request.META.get(getattr(Tokens,
84
                                                                 token),
85
                                                         'NOT_SET')
86

    
87
    # log shibboleth headers
88
    # TODO: info -> debug
89
    logger.info("shibboleth request: %r" % shibboleth_headers)
90

    
91
    try:
92
        eppn = tokens.get(Tokens.SHIB_EPPN)
93
        fullname, first_name, last_name, email = None, None, None, None
94
        if global_settings.DEBUG and not eppn:
95
            eppn = getattr(global_settings, 'SHIBBOLETH_TEST_EPPN', None)
96
            fullname = getattr(global_settings, 'SHIBBOLETH_TEST_FULLNAME',
97
                               None)
98

    
99
        if not eppn:
100
            raise KeyError(_(astakos_messages.SHIBBOLETH_MISSING_EPPN) % {
101
                'domain': settings.BASE_HOST,
102
                'contact_email': settings.CONTACT_EMAIL
103
            })
104
        if Tokens.SHIB_DISPLAYNAME in tokens:
105
            fullname = tokens[Tokens.SHIB_DISPLAYNAME]
106
        elif Tokens.SHIB_CN in tokens:
107
            fullname = tokens[Tokens.SHIB_CN]
108
        if Tokens.SHIB_NAME in tokens:
109
            first_name = tokens[Tokens.SHIB_NAME]
110
        if Tokens.SHIB_SURNAME in tokens:
111
            last_name = tokens[Tokens.SHIB_SURNAME]
112

    
113
        if fullname:
114
            splitted = fullname.split(' ', 1)
115
            if len(splitted) == 2:
116
                first_name, last_name = splitted
117
        fullname = '%s %s' % (first_name, last_name)
118

    
119
        if not any([first_name, last_name]) and \
120
                    settings.SHIBBOLETH_REQUIRE_NAME_INFO:
121
            raise KeyError(_(astakos_messages.SHIBBOLETH_MISSING_NAME))
122

    
123
    except KeyError, e:
124
        # invalid shibboleth headers, redirect to login, display message
125
        messages.error(request, e.message)
126
        return HttpResponseRedirect(login_url(request))
127

    
128
    affiliation = tokens.get(Tokens.SHIB_EP_AFFILIATION, 'Shibboleth')
129
    email = tokens.get(Tokens.SHIB_MAIL, '')
130
    eppn_info = tokens.get(Tokens.SHIB_EPPN)
131
    provider_info = {'eppn': eppn_info, 'email': email, 'name': fullname,
132
                     'headers': shibboleth_headers}
133
    userid = eppn
134

    
135
    try:
136
        return handle_third_party_login(request, 'shibboleth',
137
                                        eppn, provider_info,
138
                                        affiliation, third_party_key)
139
    except AstakosUser.DoesNotExist, e:
140
        third_party_key = get_pending_key(request)
141
        user_info = {'affiliation': affiliation,
142
                     'first_name': first_name,
143
                     'last_name': last_name,
144
                     'email': email}
145
        return handle_third_party_signup(request, userid, 'shibboleth',
146
                                         third_party_key,
147
                                         provider_info,
148
                                         user_info,
149
                                         template,
150
                                         extra_context)