Fix transaction check

[cascardo/ipsilon.git] / ipsilon / providers / openid / auth.py

diff --git a/ipsilon/providers/openid/auth.py b/ipsilon/providers/openid/auth.py
old mode 100755 (executable)
new mode 100644 (file)
index fba8d10..1ecbe43
--- a/ipsilon/providers/openid/auth.py
+++ b/ipsilon/providers/openid/auth.py
@@ -1,11 +1,10 @@
-#!/usr/bin/python
-#
-# Copyright (C) 2014  Ipsilon project Contributors, for licensee see COPYING
+# Copyright (C) 2014 Ipsilon project Contributors, for license see COPYING

 
 from ipsilon.providers.common import ProviderPageBase
 from ipsilon.providers.common import AuthenticationError, InvalidRequest
 from ipsilon.providers.openid.meta import XRDSHandler, UserXRDSHandler
 from ipsilon.providers.openid.meta import IDHandler
 
 from ipsilon.providers.common import ProviderPageBase
 from ipsilon.providers.common import AuthenticationError, InvalidRequest
 from ipsilon.providers.openid.meta import XRDSHandler, UserXRDSHandler
 from ipsilon.providers.openid.meta import IDHandler

+from ipsilon.util.policy import Policy

 from ipsilon.util.trans import Transaction
 from ipsilon.util.user import UserSession
 
 from ipsilon.util.trans import Transaction
 from ipsilon.util.user import UserSession
 


@@ -27,7 +26,8 @@ class AuthenticateRequest(ProviderPageBase):
         try:
             # generate a new id or get current one
             self.trans = Transaction('openid', **kwargs)
         try:
             # generate a new id or get current one
             self.trans = Transaction('openid', **kwargs)

-            if self.trans.cookie.value != self.trans.provider:
+            if (self.trans.cookie and
+                    self.trans.cookie.value != self.trans.provider):

                 self.debug('Invalid transaction, %s != %s' % (
                            self.trans.cookie.value, self.trans.provider))
         except Exception, e:  # pylint: disable=broad-except
                 self.debug('Invalid transaction, %s != %s' % (
                            self.trans.cookie.value, self.trans.provider))
         except Exception, e:  # pylint: disable=broad-except


@@ -45,7 +45,7 @@ class AuthenticateRequest(ProviderPageBase):
         if args is not None:
             first = args[0] if len(args) > 0 else None
             second = first[0] if len(first) > 0 else None
         if args is not None:
             first = args[0] if len(args) > 0 else None
             second = first[0] if len(first) > 0 else None

-            if type(second) is dict:
+            if isinstance(second, dict):

                 form = second.get('form', None)
         return form
 
                 form = second.get('form', None)
         return form
 


@@ -62,6 +62,16 @@ class AuthenticateRequest(ProviderPageBase):
                 raise cherrypy.HTTPError(e.code, e.msg)
             return self._respond(request.answer(False))
 
                 raise cherrypy.HTTPError(e.code, e.msg)
             return self._respond(request.answer(False))
 

+    # get attributes, and apply policy mapping and filtering
+    def _source_attributes(self, session):
+        policy = Policy(self.cfg.default_attribute_mapping,
+                        self.cfg.default_allowed_attributes)
+        userattrs = session.get_user_attrs()
+        mappedattrs, _ = policy.map_attributes(userattrs)
+        attributes = policy.filter_attributes(mappedattrs)
+        self.debug('Filterd attributes: %s' % repr(attributes))
+        return attributes
+

     def _parse_request(self, **kwargs):
         request = None
         try:
     def _parse_request(self, **kwargs):
         request = None
         try:


@@ -110,13 +120,13 @@ class AuthenticateRequest(ProviderPageBase):
         else:
             return self._respond(self.cfg.server.handleRequest(request))
 
         else:
             return self._respond(self.cfg.server.handleRequest(request))
 

-        # check if this is discovery or ned identity matching checks
+        # check if this is discovery or needs identity matching checks

         if not request.idSelect():
             idurl = self.cfg.identity_url_template % {'username': user.name}
             if request.identity != idurl:
                 raise AuthenticationError("User ID mismatch!", 401)
 
         if not request.idSelect():
             idurl = self.cfg.identity_url_template % {'username': user.name}
             if request.identity != idurl:
                 raise AuthenticationError("User ID mismatch!", 401)
 

-        # check if the ralying party is trusted
+        # check if the relying party is trusted

         if request.trust_root in self.cfg.untrusted_roots:
             raise AuthenticationError("Untrusted Relying party", 401)
 
         if request.trust_root in self.cfg.untrusted_roots:
             raise AuthenticationError("Untrusted Relying party", 401)
 


@@ -167,7 +177,7 @@ class AuthenticateRequest(ProviderPageBase):
             ad = {
                 "Trust Root": request.trust_root,
             }
             ad = {
                 "Trust Root": request.trust_root,
             }

-            userattrs = us.get_user_attrs()
+            userattrs = self._source_attributes(us)

             for n, e in self.cfg.extensions.available().items():
                 data = e.get_display_data(request, userattrs)
                 self.debug('%s returned %s' % (n, repr(data)))
             for n, e in self.cfg.extensions.available().items():
                 data = e.get_display_data(request, userattrs)
                 self.debug('%s returned %s' % (n, repr(data)))


@@ -182,7 +192,6 @@ class AuthenticateRequest(ProviderPageBase):
                 "authz_details": ad,
             }
             context.update(dict((self.trans.get_POST_tuple(),)))
                 "authz_details": ad,
             }
             context.update(dict((self.trans.get_POST_tuple(),)))

-            # pylint: disable=star-args

             return self._template('openid/consent_form.html', **context)
 
     def _response(self, request, session):
             return self._template('openid/consent_form.html', **context)
 
     def _response(self, request, session):


@@ -193,7 +202,7 @@ class AuthenticateRequest(ProviderPageBase):
             identity=identity_url,
             claimed_id=identity_url
         )
             identity=identity_url,
             claimed_id=identity_url
         )

-        userattrs = session.get_user_attrs()
+        userattrs = self._source_attributes(session)

         for _, e in self.cfg.extensions.available().items():
             resp = e.get_response(request, userattrs)
             if resp is not None:
         for _, e in self.cfg.extensions.available().items():
             resp = e.get_response(request, userattrs)
             if resp is not None: