+
+ def init_idp(self):
+ idp = None
+ # Init IDP data
+ try:
+ idp = IdentityProvider(self)
+ except Exception, e: # pylint: disable=broad-except
+ self._debug('Failed to init SAML2 provider: %r' % e)
+ return None
+
+ # Import all known applications
+ data = self.get_data()
+ for idval in data:
+ sp = data[idval]
+ if 'type' not in sp or sp['type'] != 'SP':
+ continue
+ if 'name' not in sp or 'metadata' not in sp:
+ continue
+ try:
+ idp.add_provider(sp)
+ except Exception, e: # pylint: disable=broad-except
+ self._debug('Failed to add SP %s: %r' % (sp['name'], e))
+
+ return idp
+
+ def on_enable(self):
+ self.init_idp()
+ if hasattr(self, 'admin'):
+ if self.admin:
+ self.admin.add_sps()
+
+
+class Installer(object):
+
+ def __init__(self):
+ self.name = 'saml2'
+ self.ptype = 'provider'
+
+ def install_args(self, group):
+ group.add_argument('--saml2', choices=['yes', 'no'], default='yes',
+ help='Configure SAML2 Provider')
+
+ def configure(self, opts):
+ if opts['saml2'] != 'yes':
+ return
+
+ # Check storage path is present or create it
+ path = os.path.join(opts['data_dir'], 'saml2')
+ if not os.path.exists(path):
+ os.makedirs(path, 0700)
+
+ # Use the same cert for signing and ecnryption for now
+ cert = Certificate(path)
+ cert.generate('idp', opts['hostname'])
+
+ # Generate Idp Metadata
+ proto = 'https'
+ if opts['secure'].lower() == 'no':
+ proto = 'http'
+ url = '%s://%s/%s/saml2' % (proto, opts['hostname'], opts['instance'])
+ meta = metadata.Metadata(metadata.IDP_ROLE)
+ meta.set_entity_id(url + '/metadata')
+ meta.add_certs(cert, cert)
+ meta.add_service(metadata.SAML2_SERVICE_MAP['sso-post'],
+ url + '/SSO/POST')
+ meta.add_service(metadata.SAML2_SERVICE_MAP['sso-redirect'],
+ url + '/SSO/Redirect')
+
+ meta.add_allowed_name_format(
+ lasso.SAML2_NAME_IDENTIFIER_FORMAT_TRANSIENT)
+ meta.add_allowed_name_format(
+ lasso.SAML2_NAME_IDENTIFIER_FORMAT_PERSISTENT)
+ meta.add_allowed_name_format(
+ lasso.SAML2_NAME_IDENTIFIER_FORMAT_EMAIL)
+ if 'krb' in opts and opts['krb'] == 'yes':
+ meta.add_allowed_name_format(
+ lasso.SAML2_NAME_IDENTIFIER_FORMAT_KERBEROS)
+
+ meta.output(os.path.join(path, 'metadata.xml'))
+
+ # Add configuration data to database
+ po = PluginObject()
+ po.name = 'saml2'
+ po.wipe_data()
+
+ po.wipe_config_values(FACILITY)
+ config = {'idp storage path': path,
+ 'idp metadata file': 'metadata.xml',
+ 'idp certificate file': cert.cert,
+ 'idp key file': cert.key,
+ 'enabled': '1'}
+ po.save_plugin_config(FACILITY, config)
+
+ # Fixup permissions so only the ipsilon user can read these files
+ files.fix_user_dirs(path, opts['system_user'])