Add Cache-Control header to prevent browser caching of SAML auth location

[cascardo/ipsilon.git] / ipsilon / install / ipsilon-client-install

diff --git a/ipsilon/install/ipsilon-client-install b/ipsilon/install/ipsilon-client-install
index 2b3d2f2..237b439 100755 (executable)
--- a/ipsilon/install/ipsilon-client-install
+++ b/ipsilon/install/ipsilon-client-install
@@ -23,6 +23,7 @@ from ipsilon.tools.saml2metadata import SAML2_SERVICE_MAP
 from ipsilon.tools.certs import Certificate
 from ipsilon.tools import files
 import argparse
+import ConfigParser
 import logging
 import os
 import pwd
@@ -114,6 +115,7 @@ def saml2():
             saml_protect = 'info'
             saml_auth = '<Location %s>\n' \
                         '    MellonEnable "auth"\n' \
+                        '    Header append Cache-Control "no-cache"\n' \
                         '</Location>\n' % args['saml_auth']
 
         psp = '# '
@@ -122,8 +124,12 @@ def saml2():
             psp = ''
 
         saml_secure = 'Off'
+        ssl_require = '#'
+        ssl_rewrite = '#'
         if args['saml_secure_setup']:
             saml_secure = 'On'
+            ssl_require = ''
+            ssl_rewrite = ''
 
         samlopts = {'saml_base': args['saml_base'],
                     'saml_protect': saml_protect,
@@ -134,6 +140,9 @@ def saml2():
                     'saml_sp': args['saml_sp'],
                     'saml_secure_on': saml_secure,
                     'saml_auth': saml_auth,
+                    'ssl_require': ssl_require,
+                    'ssl_rewrite': ssl_rewrite,
+                    'sp_hostname': args['hostname'],
                     'sp': psp}
         files.write_from_template(SAML2_CONFFILE, SAML2_TEMPLATE, samlopts)
 
@@ -178,6 +187,42 @@ def log_exception(e):
         logger.error(e)
 
 
+def parse_config_profile(args):
+    config = ConfigParser.ConfigParser()
+    files = config.read(args['config_profile'])
+    if len(files) == 0:
+        raise ConfigurationError('Config Profile file %s not found!' %
+                                 args['config_profile'])
+
+    if 'globals' in config.sections():
+        G = config.options('globals')
+        for g in G:
+            val = config.get('globals', g)
+            if val == 'False':
+                val = False
+            elif val == 'True':
+                val = True
+            if g in globals():
+                globals()[g] = val
+            else:
+                for k in globals().keys():
+                    if k.lower() == g.lower():
+                        globals()[k] = val
+                        break
+
+    if 'arguments' in config.sections():
+        A = config.options('arguments')
+        for a in A:
+            val = config.get('arguments', a)
+            if val == 'False':
+                val = False
+            elif val == 'True':
+                val = True
+            args[a] = val
+
+    return args
+
+
 def parse_args():
     global args
 
@@ -212,11 +257,16 @@ def parse_args():
                         default=True, help="Turn on all security checks")
     parser.add_argument('--debug', action='store_true', default=False,
                         help="Turn on script debugging")
+    parser.add_argument('--config-profile', default=None,
+                        help="File containing install options")
     parser.add_argument('--uninstall', action='store_true',
                         help="Uninstall the server and all data")
 
     args = vars(parser.parse_args())
 
+    if args['config_profile']:
+        args = parse_config_profile(args)
+
     if len(args['hostname'].split('.')) < 2:
         raise ValueError('Hostname: %s is not a FQDN.')