+
+ def init_idp(self):
+ idp = None
+ self.sessionfactory = SAMLSessionFactory(
+ database_url=self.get_config_value('session database url')
+ )
+ # Init IDP data
+ try:
+ idp = IdentityProvider(self,
+ sessionfactory=self.sessionfactory)
+ except Exception, e: # pylint: disable=broad-except
+ self.debug('Failed to init SAML2 provider: %r' % e)
+ return None
+
+ self._root.logout.add_handler(self.name, self.idp_initiated_logout)
+
+ # Import all known applications
+ data = self.get_data()
+ for idval in data:
+ sp = data[idval]
+ if 'type' not in sp or sp['type'] != 'SP':
+ continue
+ if 'name' not in sp or 'metadata' not in sp:
+ continue
+ try:
+ idp.add_provider(sp)
+ except Exception, e: # pylint: disable=broad-except
+ self.debug('Failed to add SP %s: %r' % (sp['name'], e))
+
+ return idp
+
+ def on_enable(self):
+ super(IdpProvider, self).on_enable()
+ self.idp = self.init_idp()
+ if hasattr(self, 'admin'):
+ if self.admin:
+ self.admin.add_sps()
+
+ def idp_initiated_logout(self):
+ """
+ Logout all SP sessions when the logout comes from the IdP.
+
+ For the current user only.
+
+ Only use HTTP-Redirect to start the logout. This is guaranteed
+ to be supported in SAML 2.
+ """
+ self.debug("IdP-initiated SAML2 logout")
+ us = UserSession()
+ user = us.get_user()
+
+ saml_sessions = self.sessionfactory
+ # pylint: disable=unused-variable
+ (mech, session) = saml_sessions.get_next_logout(
+ logout_mechs=[lasso.SAML2_METADATA_BINDING_REDIRECT])
+ if session is None:
+ return
+
+ logout = self.idp.get_logout_handler()
+ logout.setSessionFromDump(session.login_session)
+ logout.initRequest(session.provider_id)
+ try:
+ logout.buildRequestMsg()
+ except lasso.Error, e:
+ self.error('failure to build logout request msg: %s' % e)
+ raise cherrypy.HTTPRedirect(400, 'Failed to log out user: %s '
+ % e)
+
+ # Add a fake session to indicate where the user should
+ # be redirected to when all SP's are logged out.
+ idpurl = self._root.instance_base_url()
+ session_id = "_" + uuid.uuid4().hex.upper()
+ saml_sessions.add_session(session_id, idpurl, user.name, "", "",
+ [lasso.SAML2_METADATA_BINDING_REDIRECT])
+ init_session = saml_sessions.get_session_by_id(session_id)
+ saml_sessions.start_logout(init_session, relaystate=idpurl)
+
+ # Add the logout request id we just created to the session to be
+ # logged out so that when it responds we can find the right
+ # session.
+ session.set_logoutstate(request_id=logout.request.id)
+ saml_sessions.start_logout(session, initial=False)
+
+ self.debug('Sending initial logout request to %s' % logout.msgUrl)
+ raise cherrypy.HTTPRedirect(logout.msgUrl)
+
+
+class IdpMetadataGenerator(object):
+
+ def __init__(self, url, idp_cert, expiration=None):
+ self.meta = metadata.Metadata(metadata.IDP_ROLE, expiration)
+ self.meta.set_entity_id('%s/saml2/metadata' % url)
+ self.meta.add_certs(idp_cert, idp_cert)
+ self.meta.add_service(metadata.SAML2_SERVICE_MAP['sso-post'],
+ '%s/saml2/SSO/POST' % url)
+ self.meta.add_service(metadata.SAML2_SERVICE_MAP['sso-redirect'],
+ '%s/saml2/SSO/Redirect' % url)
+ if is_lasso_ecp_enabled():
+ self.meta.add_service(metadata.SAML2_SERVICE_MAP['sso-soap'],
+ '%s/saml2/SSO/SOAP' % url)
+ self.meta.add_service(metadata.SAML2_SERVICE_MAP['logout-redirect'],
+ '%s/saml2/SLO/Redirect' % url)
+ self.meta.add_allowed_name_format(
+ lasso.SAML2_NAME_IDENTIFIER_FORMAT_PERSISTENT)
+ self.meta.add_allowed_name_format(
+ lasso.SAML2_NAME_IDENTIFIER_FORMAT_TRANSIENT)
+ self.meta.add_allowed_name_format(
+ lasso.SAML2_NAME_IDENTIFIER_FORMAT_EMAIL)
+
+ def output(self, path=None):
+ return self.meta.output(path)
+
+
+class Installer(ProviderInstaller):
+
+ def __init__(self, *pargs):
+ super(Installer, self).__init__()
+ self.name = 'saml2'
+ self.pargs = pargs
+
+ def install_args(self, group):
+ group.add_argument('--saml2', choices=['yes', 'no'], default='yes',
+ help='Configure SAML2 Provider')
+ group.add_argument('--saml2-metadata-validity',
+ default=METADATA_DEFAULT_VALIDITY_PERIOD,
+ help=('Metadata validity period in days '
+ '(default - %d)' %
+ METADATA_DEFAULT_VALIDITY_PERIOD))
+ group.add_argument('--saml2-session-dburl',
+ help='session database URL')
+
+ def configure(self, opts, changes):
+ if opts['saml2'] != 'yes':
+ return
+
+ # Check storage path is present or create it
+ path = os.path.join(opts['data_dir'], 'saml2')
+ if not os.path.exists(path):
+ os.makedirs(path, 0700)
+
+ # Use the same cert for signing and ecnryption for now
+ cert = Certificate(path)
+ cert.generate('idp', opts['hostname'])
+
+ # Generate Idp Metadata
+ proto = 'https'
+ if opts['secure'].lower() == 'no':
+ proto = 'http'
+ url = '%s://%s/%s' % (proto, opts['hostname'], opts['instance'])
+ validity = int(opts['saml2_metadata_validity'])
+ meta = IdpMetadataGenerator(url, cert,
+ timedelta(validity))
+ if 'gssapi' in opts and opts['gssapi'] == 'yes':
+ meta.meta.add_allowed_name_format(
+ lasso.SAML2_NAME_IDENTIFIER_FORMAT_KERBEROS)
+
+ meta.output(os.path.join(path, 'metadata.xml'))
+
+ # Add configuration data to database
+ po = PluginObject(*self.pargs)
+ po.name = 'saml2'
+ po.wipe_data()
+ po.wipe_config_values()
+ config = {'idp storage path': path,
+ 'idp metadata file': 'metadata.xml',
+ 'idp certificate file': cert.cert,
+ 'idp key file': cert.key,
+ 'idp nameid salt': uuid.uuid4().hex,
+ 'idp metadata validity': opts['saml2_metadata_validity'],
+ 'session database url': opts['saml2_session_dburl'] or
+ opts['database_url'] % {
+ 'datadir': opts['data_dir'],
+ 'dbname': 'saml2.sessions.db'}}
+ po.save_plugin_config(config)
+
+ # Update global config to add login plugin
+ po.is_enabled = True
+ po.save_enabled_state()
+
+ # Fixup permissions so only the ipsilon user can read these files
+ files.fix_user_dirs(path, opts['system_user'])