Statistics
| Branch: | Tag: | Revision:

root / snf-astakos-app / astakos / im / views / target / shibboleth.py @ feebcc02

History | View | Annotate | Download (5.5 kB)

1
# Copyright 2011-2012 GRNET S.A. All rights reserved.
2
#
3
# Redistribution and use in source and binary forms, with or
4
# without modification, are permitted provided that the following
5
# conditions are met:
6
#
7
#   1. Redistributions of source code must retain the above
8
#      copyright notice, this list of conditions and the following
9
#      disclaimer.
10
#
11
#   2. Redistributions in binary form must reproduce the above
12
#      copyright notice, this list of conditions and the following
13
#      disclaimer in the documentation and/or other materials
14
#      provided with the distribution.
15
#
16
# THIS SOFTWARE IS PROVIDED BY GRNET S.A. ``AS IS'' AND ANY EXPRESS
17
# OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
18
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GRNET S.A OR
20
# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
21
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
22
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
23
# USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
24
# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
26
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27
# POSSIBILITY OF SUCH DAMAGE.
28
#
29
# The views and conclusions contained in the software and
30
# documentation are those of the authors and should not be
31
# interpreted as representing official policies, either expressed
32
# or implied, of GRNET S.A.
33

    
34
from django.conf import settings as global_settings
35
from django.utils.translation import ugettext as _
36
from django.contrib import messages
37
from django.views.decorators.http import require_http_methods
38
from django.http import HttpResponseRedirect
39

    
40
from astakos.im.util import login_url
41
from astakos.im.models import AstakosUser
42
from astakos.im import settings
43
from astakos.im.views.target import get_pending_key, \
44
    handle_third_party_signup, handle_third_party_login, \
45
    init_third_party_session
46
from astakos.im.views.decorators import cookie_fix, requires_auth_provider
47

    
48
import astakos.im.messages as astakos_messages
49
import logging
50

    
51
logger = logging.getLogger(__name__)
52

    
53

    
54
class Tokens:
55
    # these are mapped by the Shibboleth SP software
56
    SHIB_EPPN = "HTTP_EPPN"  # eduPersonPrincipalName
57
    SHIB_NAME = "HTTP_SHIB_INETORGPERSON_GIVENNAME"
58
    SHIB_SURNAME = "HTTP_SHIB_PERSON_SURNAME"
59
    SHIB_CN = "HTTP_SHIB_PERSON_COMMONNAME"
60
    SHIB_DISPLAYNAME = "HTTP_SHIB_INETORGPERSON_DISPLAYNAME"
61
    SHIB_EP_AFFILIATION = "HTTP_SHIB_EP_AFFILIATION"
62
    SHIB_SESSION_ID = "HTTP_SHIB_SESSION_ID"
63
    SHIB_MAIL = "HTTP_SHIB_MAIL"
64

    
65

    
66
@requires_auth_provider('shibboleth')
67
@require_http_methods(["GET", "POST"])
68
@cookie_fix
69
def login(
70
    request,
71
    template='im/third_party_check_local.html',
72
    extra_context=None):
73

    
74
    init_third_party_session(request)
75
    extra_context = extra_context or {}
76

    
77
    tokens = request.META
78
    third_party_key = get_pending_key(request)
79

    
80
    shibboleth_headers = {}
81
    for token in dir(Tokens):
82
        if token == token.upper():
83

    
84
            shibboleth_headers[token] = request.META.get(getattr(Tokens,
85
                                                                 token),
86
                                                         'NOT_SET')
87

    
88
    # log shibboleth headers
89
    # TODO: info -> debug
90
    logger.info("shibboleth request: %r" % shibboleth_headers)
91

    
92
    try:
93
        eppn = tokens.get(Tokens.SHIB_EPPN)
94
        if global_settings.DEBUG and not eppn:
95
            eppn = getattr(global_settings, 'SHIBBOLETH_TEST_EPPN', None)
96
            realname = getattr(global_settings, 'SHIBBOLETH_TEST_REALNAME',
97
                               None)
98

    
99
        if not eppn:
100
            raise KeyError(_(astakos_messages.SHIBBOLETH_MISSING_EPPN) % {
101
                'domain': settings.BASE_HOST,
102
                'contact_email': settings.CONTACT_EMAIL
103
            })
104
        if Tokens.SHIB_DISPLAYNAME in tokens:
105
            realname = tokens[Tokens.SHIB_DISPLAYNAME]
106
        elif Tokens.SHIB_CN in tokens:
107
            realname = tokens[Tokens.SHIB_CN]
108
        elif Tokens.SHIB_NAME in tokens and Tokens.SHIB_SURNAME in tokens:
109
            realname = tokens[Tokens.SHIB_NAME] + ' ' + tokens[Tokens.SHIB_SURNAME]
110
        else:
111
            if settings.SHIBBOLETH_REQUIRE_NAME_INFO:
112
                raise KeyError(_(astakos_messages.SHIBBOLETH_MISSING_NAME))
113
            else:
114
                realname = ''
115

    
116
    except KeyError, e:
117
        # invalid shibboleth headers, redirect to login, display message
118
        messages.error(request, e.message)
119
        return HttpResponseRedirect(login_url(request))
120

    
121
    affiliation = tokens.get(Tokens.SHIB_EP_AFFILIATION, 'Shibboleth')
122
    email = tokens.get(Tokens.SHIB_MAIL, '')
123
    provider_info = {'eppn': eppn, 'email': email, 'name': realname}
124
    userid = eppn
125

    
126

    
127
    try:
128
        return handle_third_party_login(request, 'shibboleth',
129
                                        eppn, provider_info,
130
                                        affiliation, third_party_key)
131
    except AstakosUser.DoesNotExist, e:
132
        third_party_key = get_pending_key(request)
133
        user_info = {'affiliation': affiliation, 'realname': realname}
134
        return handle_third_party_signup(request, userid, 'shibboleth',
135
                                         third_party_key,
136
                                         provider_info,
137
                                         user_info,
138
                                         template,
139
                                         extra_context)
140