ipsilon/providers/saml2/admin.py

   1 # Copyright (C) 2014  Simo Sorce <simo@redhat.com>
   2 #
   3 # see file 'COPYING' for use and warranty information
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation, either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17
  18 import cherrypy
  19 from ipsilon.util import config as pconfig
  20 from ipsilon.admin.common import AdminPage
  21 from ipsilon.admin.common import ADMIN_STATUS_OK
  22 from ipsilon.admin.common import ADMIN_STATUS_ERROR
  23 from ipsilon.admin.common import ADMIN_STATUS_WARN
  24 from ipsilon.admin.common import get_mapping_list_value
  25 from ipsilon.admin.common import get_complex_list_value
  26 from ipsilon.providers.saml2.provider import ServiceProvider
  27 from ipsilon.providers.saml2.provider import ServiceProviderCreator
  28 from ipsilon.providers.saml2.provider import InvalidProviderId
  29 from copy import deepcopy
  30 import requests
  31
  32
  33 class NewSPAdminPage(AdminPage):
  34
  35     def __init__(self, site, parent):
  36         super(NewSPAdminPage, self).__init__(site, form=True)
  37         self.parent = parent
  38         self.title = 'New Service Provider'
  39         self.back = parent.url
  40         self.url = '%s/new' % (parent.url,)
  41
  42     def form_new(self, message=None, message_type=None):
  43         return self._template('admin/providers/saml2_sp_new.html',
  44                               title=self.title,
  45                               message=message,
  46                               message_type=message_type,
  47                               name='saml2_sp_new_form',
  48                               back=self.back, action=self.url)
  49
  50     def GET(self, *args, **kwargs):
  51         return self.form_new()
  52
  53     def POST(self, *args, **kwargs):
  54
  55         if self.user.is_admin:
  56             # TODO: allow authenticated user to create SPs on their own
  57             #       set the owner in that case
  58             name = None
  59             meta = None
  60             if 'content-type' not in cherrypy.request.headers:
  61                 self.debug("Invalid request, missing content-type")
  62                 message = "Malformed request"
  63                 message_type = ADMIN_STATUS_ERROR
  64                 return self.form_new(message, message_type)
  65             ctype = cherrypy.request.headers['content-type'].split(';')[0]
  66             if ctype != 'multipart/form-data':
  67                 self.debug("Invalid form type (%s), trying to cope" % (
  68                            cherrypy.request.content_type,))
  69             for key, value in kwargs.iteritems():
  70                 if key == 'name':
  71                     name = value
  72                 elif key == 'metatext':
  73                     if len(value) > 0:
  74                         meta = value
  75                 elif key == 'metafile':
  76                     if hasattr(value, 'content_type'):
  77                         meta = value.fullvalue()
  78                     else:
  79                         self.debug("Invalid format for 'meta'")
  80                 elif key == 'metaurl':
  81                     if len(value) > 0:
  82                         try:
  83                             r = requests.get(value)
  84                             r.raise_for_status()
  85                             meta = r.content
  86                         except Exception, e:  # pylint: disable=broad-except
  87                             self.debug("Failed to fetch metadata: " + repr(e))
  88                             message = "Failed to fetch metadata: " + repr(e)
  89                             message_type = ADMIN_STATUS_ERROR
  90                             return self.form_new(message, message_type)
  91
  92             if name and meta:
  93                 try:
  94                     spc = ServiceProviderCreator(self.parent.cfg)
  95                     sp = spc.create_from_buffer(name, meta)
  96                     sp_page = self.parent.add_sp(name, sp)
  97                     message = "SP Successfully added"
  98                     message_type = ADMIN_STATUS_OK
  99                     return sp_page.root_with_msg(message, message_type)
 100                 except InvalidProviderId, e:
 101                     message = str(e)
 102                     message_type = ADMIN_STATUS_ERROR
 103                 except Exception, e:  # pylint: disable=broad-except
 104                     self.debug(repr(e))
 105                     message = "Failed to create Service Provider!"
 106                     message_type = ADMIN_STATUS_ERROR
 107             else:
 108                 message = "A name and a metadata file must be provided"
 109                 message_type = ADMIN_STATUS_ERROR
 110         else:
 111             message = "Unauthorized"
 112             message_type = ADMIN_STATUS_ERROR
 113
 114         return self.form_new(message, message_type)
 115
 116
 117 class InvalidValueFormat(Exception):
 118     pass
 119
 120
 121 class UnauthorizedUser(Exception):
 122     pass
 123
 124
 125 class SPAdminPage(AdminPage):
 126
 127     def __init__(self, sp, site, parent):
 128         super(SPAdminPage, self).__init__(site, form=True)
 129         self.parent = parent
 130         self.sp = sp
 131         self.title = sp.name
 132         self.url = '%s/sp/%s' % (parent.url, sp.name)
 133         self.menu = [parent]
 134         self.back = parent.url
 135
 136     def root_with_msg(self, message=None, message_type=None):
 137         return self._template('admin/option_config.html', title=self.title,
 138                               menu=self.menu, action=self.url, back=self.back,
 139                               message=message, message_type=message_type,
 140                               name='saml2_sp_%s_form' % (self.sp.name),
 141                               config=self.sp.get_config_obj())
 142
 143     def GET(self, *args, **kwargs):
 144         return self.root_with_msg()
 145
 146     def POST(self, *args, **kwargs):
 147
 148         message = "Nothing was modified."
 149         message_type = "info"
 150         new_db_values = dict()
 151
 152         conf = self.sp.get_config_obj()
 153
 154         for name, option in conf.iteritems():
 155             if name in kwargs:
 156                 value = kwargs[name]
 157                 if isinstance(option, pconfig.List):
 158                     value = [x.strip() for x in value.split('\n')]
 159                 elif isinstance(option, pconfig.Condition):
 160                     value = True
 161             else:
 162                 if isinstance(option, pconfig.Condition):
 163                     value = False
 164                 elif isinstance(option, pconfig.Choice):
 165                     value = list()
 166                     for a in option.get_allowed():
 167                         aname = '%s_%s' % (name, a)
 168                         if aname in kwargs:
 169                             value.append(a)
 170                 elif type(option) is pconfig.ComplexList:
 171                     current = deepcopy(option.get_value())
 172                     value = get_complex_list_value(name,
 173                                                    current,
 174                                                    **kwargs)
 175                     # if current value is None do nothing
 176                     if value is None:
 177                         if option.get_value() is None:
 178                             continue
 179                         # else pass and let it continue as None
 180                 elif type(option) is pconfig.MappingList:
 181                     current = deepcopy(option.get_value())
 182                     value = get_mapping_list_value(name,
 183                                                    current,
 184                                                    **kwargs)
 185                     # if current value is None do nothing
 186                     if value is None:
 187                         if option.get_value() is None:
 188                             continue
 189                         # else pass and let it continue as None
 190                 else:
 191                     continue
 192
 193             if value != option.get_value():
 194                 if (type(option) is pconfig.List and
 195                         set(value) == set(option.get_value())):
 196                     continue
 197                 cherrypy.log.error("Storing %s = %s" %
 198                                    (name, value))
 199                 new_db_values[name] = value
 200
 201         if len(new_db_values) != 0:
 202             try:
 203                 # Validate user can make these changes
 204                 for (key, value) in new_db_values.iteritems():
 205                     if key == 'Name':
 206                         if (not self.user.is_admin and
 207                                 self.user.name != self.sp.owner):
 208                             raise UnauthorizedUser("Unauthorized to set owner")
 209                     elif key in ['Owner', 'Default NameID', 'Allowed NameIDs',
 210                                  'Attribute Mapping', 'Allowed Attributes']:
 211                         if not self.user.is_admin:
 212                             raise UnauthorizedUser(
 213                                 "Unauthorized to set %s" % key
 214                             )
 215
 216                 # Make changes in current config
 217                 for name, option in conf.iteritems():
 218                     value = new_db_values.get(name, False)
 219                     # A value of None means remove from the data store
 220                     if value is False or value == []:
 221                         continue
 222                     if name == 'Name':
 223                         if not self.sp.is_valid_name(value):
 224                             raise InvalidValueFormat(
 225                                 'Invalid name! Use only numbers and'
 226                                 ' letters'
 227                             )
 228                         self.sp.name = value
 229                         self.url = '%s/sp/%s' % (self.parent.url, value)
 230                         self.parent.rename_sp(option.get_value(), value)
 231                     elif name == 'User Owner':
 232                         self.sp.owner = value
 233                     elif name == 'Default NameID':
 234                         self.sp.default_nameid = value
 235                     elif name == 'Allowed NameIDs':
 236                         self.sp.allowed_nameids = value
 237                     elif name == 'Attribute Mapping':
 238                         self.sp.attribute_mappings = value
 239                     elif name == 'Allowed Attributes':
 240                         self.sp.allowed_attributes = value
 241             except InvalidValueFormat, e:
 242                 message = str(e)
 243                 message_type = ADMIN_STATUS_WARN
 244                 return self.root_with_msg(message, message_type)
 245             except UnauthorizedUser, e:
 246                 message = str(e)
 247                 message_type = ADMIN_STATUS_ERROR
 248                 return self.root_with_msg(message, message_type)
 249             except Exception as e:  # pylint: disable=broad-except
 250                 self.debug("Error: %s" % repr(e))
 251                 message = "Internal Error"
 252                 message_type = ADMIN_STATUS_ERROR
 253                 return self.root_with_msg(message, message_type)
 254
 255             try:
 256                 self.sp.save_properties()
 257                 message = "Properties successfully changed"
 258                 message_type = ADMIN_STATUS_OK
 259             except Exception as e:  # pylint: disable=broad-except
 260                 self.error('Failed to save data: %s' % e)
 261                 message = "Failed to save data!"
 262                 message_type = ADMIN_STATUS_ERROR
 263             else:
 264                 self.sp.refresh_config()
 265
 266         return self.root_with_msg(message=message,
 267                                   message_type=message_type)
 268
 269     def delete(self):
 270         self.parent.del_sp(self.sp.name)
 271         self.sp.permanently_delete()
 272         return self.parent.root()
 273     delete.public_function = True
 274
 275
 276 class Saml2AdminPage(AdminPage):
 277     def __init__(self, site, config):
 278         super(Saml2AdminPage, self).__init__(site)
 279         self.name = 'admin'
 280         self.cfg = config
 281         self.providers = []
 282         self.menu = []
 283         self.url = None
 284         self.sp = AdminPage(self._site)
 285
 286     def add_sp(self, name, sp):
 287         page = SPAdminPage(sp, self._site, self)
 288         self.sp.add_subtree(name, page)
 289         self.providers.append(sp)
 290         return page
 291
 292     def rename_sp(self, oldname, newname):
 293         page = getattr(self.sp, oldname)
 294         self.sp.del_subtree(oldname)
 295         self.sp.add_subtree(newname, page)
 296
 297     def del_sp(self, name):
 298         try:
 299             page = getattr(self.sp, name)
 300             self.providers.remove(page.sp)
 301             self.sp.del_subtree(name)
 302         except Exception, e:  # pylint: disable=broad-except
 303             self.debug("Failed to remove provider %s: %s" % (name, str(e)))
 304
 305     def add_sps(self):
 306         if self.cfg.idp:
 307             for p in self.cfg.idp.get_providers():
 308                 try:
 309                     sp = ServiceProvider(self.cfg, p)
 310                     self.del_sp(sp.name)
 311                     self.add_sp(sp.name, sp)
 312                 except Exception, e:  # pylint: disable=broad-except
 313                     self.debug("Failed to find provider %s: %s" % (p, str(e)))
 314
 315     def mount(self, page):
 316         self.menu = page.menu
 317         self.url = '%s/%s' % (page.url, self.name)
 318         self.add_sps()
 319         self.add_subtree('new', NewSPAdminPage(self._site, self))
 320         page.add_subtree(self.name, self)
 321
 322     def root(self, *args, **kwargs):
 323         return self._template('admin/providers/saml2.html',
 324                               title='SAML2 Administration',
 325                               providers=self.providers,
 326                               baseurl=self.url,
 327                               menu=self.menu)