+
+
+class Installer(object):
+
+ def __init__(self):
+ self.name = 'saml2'
+ self.ptype = 'provider'
+
+ def install_args(self, group):
+ group.add_argument('--saml2', choices=['yes', 'no'], default='yes',
+ help='Configure SAML2 Provider')
+ group.add_argument('--saml2-secure',
+ choices=['yes', 'no'], default='yes',
+ help='Configure SAML2 Provider')
+
+ def configure(self, opts):
+ if opts['saml2'] != 'yes':
+ return
+
+ # Check storage path is present or create it
+ path = os.path.join(opts['data_dir'], 'saml2')
+ if not os.path.exists(path):
+ os.makedirs(path, 0700)
+
+ # Use the same cert for signing and ecnryption for now
+ cert = Certificate(path)
+ cert.generate('idp', opts['hostname'])
+
+ # Generate Idp Metadata
+ proto = 'https'
+ if opts['saml2_secure'].lower() == 'no':
+ proto = 'http'
+ url = '%s://%s/%s/saml2' % (proto, opts['hostname'], opts['instance'])
+ meta = metadata.Metadata(metadata.IDP_ROLE)
+ meta.set_entity_id(url + '/metadata')
+ meta.add_certs(cert, cert)
+ meta.add_service(metadata.SAML2_SERVICE_MAP['sso-post'],
+ url + '/SSO/POST')
+ meta.add_service(metadata.SAML2_SERVICE_MAP['sso-redirect'],
+ url + '/SSO/Redirect')
+
+ meta.add_allowed_name_format(
+ lasso.SAML2_NAME_IDENTIFIER_FORMAT_TRANSIENT)
+ meta.add_allowed_name_format(
+ lasso.SAML2_NAME_IDENTIFIER_FORMAT_PERSISTENT)
+ meta.add_allowed_name_format(
+ lasso.SAML2_NAME_IDENTIFIER_FORMAT_EMAIL)
+ if 'krb' in opts and opts['krb'] == 'yes':
+ meta.add_allowed_name_format(
+ lasso.SAML2_NAME_IDENTIFIER_FORMAT_KERBEROS)
+
+ meta.output(os.path.join(path, 'metadata.xml'))
+
+ # Add configuration data to database
+ po = PluginObject()
+ po.name = 'saml2'
+ po.wipe_data()
+
+ po.wipe_config_values(FACILITY)
+ config = {'idp storage path': path,
+ 'idp metadata file': 'metadata.xml',
+ 'idp certificate file': cert.cert,
+ 'idp key file': cert.key,
+ 'enabled': '1'}
+ po.set_config(config)
+ po.save_plugin_config(FACILITY)
+
+ # Fixup permissions so only the ipsilon user can read these files
+ files.fix_user_dirs(path, opts['system_user'])