cascardo/ipsilon.git
5 years agoUse helper cookie to remember the username
Simo Sorce [Fri, 1 Aug 2014 12:15:49 +0000 (08:15 -0400)]
Use helper cookie to remember the username

This makes the login page a lot more friendy
Available only over HTTPS
Max age set to 15 days

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoCreate common form handler page
Simo Sorce [Fri, 1 Aug 2014 12:14:58 +0000 (08:14 -0400)]
Create common form handler page

Reduce duplication

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoRename form login page
Simo Sorce [Fri, 1 Aug 2014 11:59:52 +0000 (07:59 -0400)]
Rename form login page

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoRemove unused option from the FAS login plugin
Simo Sorce [Thu, 28 Aug 2014 18:44:43 +0000 (14:44 -0400)]
Remove unused option from the FAS login plugin

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoHandle the presence of additional form fields
Simo Sorce [Fri, 19 Sep 2014 19:08:52 +0000 (15:08 -0400)]
Handle the presence of additional form fields

For exampe hidden fields which must be preserved and POSTed back to the
action url.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoCast db value to string before comparison
Simo Sorce [Fri, 12 Sep 2014 21:13:14 +0000 (17:13 -0400)]
Cast db value to string before comparison

Avoid false negatives when the sqlite3 db is 'smart' and automatically
converts the type to integer.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoAllow deferred initialization of providers
Simo Sorce [Fri, 12 Sep 2014 21:17:59 +0000 (17:17 -0400)]
Allow deferred initialization of providers

This fixes enabling a provider after the sever is started.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoDo not reprovision if conf is already available
Simo Sorce [Mon, 8 Sep 2014 21:36:02 +0000 (17:36 -0400)]
Do not reprovision if conf is already available

Also use a more meaningful directory name by default

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoDeclare admin attribute
Simo Sorce [Mon, 8 Sep 2014 20:00:48 +0000 (16:00 -0400)]
Declare admin attribute

Makes lint happier

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoFix the check for hasattr(., 'admin')
Patrick Uiterwijk [Fri, 5 Sep 2014 21:37:28 +0000 (17:37 -0400)]
Fix the check for hasattr(., 'admin')

Avoid crashing if a provider does not have an admin interface

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
5 years agoAdd FAS login plugin
Simo Sorce [Tue, 26 Aug 2014 20:38:14 +0000 (16:38 -0400)]
Add FAS login plugin

This plugin simply take a Fedora username and password and authenticates
the user against the FAS Server.

FAS returned data is saved as userdata in the 'fas' attribute.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoRestore ability to run from checkout
Simo Sorce [Mon, 25 Aug 2014 20:40:21 +0000 (16:40 -0400)]
Restore ability to run from checkout

also adds quickrun.py script to make it easy.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoMove user attribute storage into session functions
Simo Sorce [Fri, 27 Jun 2014 23:36:56 +0000 (19:36 -0400)]
Move user attribute storage into session functions

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoUse new Log class everywhere
Simo Sorce [Sat, 28 Jun 2014 00:26:22 +0000 (20:26 -0400)]
Use new Log class everywhere

Replace copies of _debug function sprinkled all over the code
with a single implementation

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
- Removed replace of self._debug to self.debug

5 years agoAdd Log class that can be inherited from safely
Simo Sorce [Sat, 28 Jun 2014 00:17:00 +0000 (20:17 -0400)]
Add Log class that can be inherited from safely

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoPrefer the 'form' login manager in ipa setups
Simo Sorce [Tue, 17 Jun 2014 19:16:55 +0000 (15:16 -0400)]
Prefer the 'form' login manager in ipa setups

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk
- Replaced "all(lm not in" with "not any(lm in"

5 years agoAdd External form auth plugin
Simo Sorce [Mon, 16 Jun 2014 16:25:30 +0000 (12:25 -0400)]
Add External form auth plugin

This plugin uses mod_intercept_form_submit to perform authentication.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoRework remote_login and remove protect decorator
Simo Sorce [Wed, 18 Jun 2014 04:04:08 +0000 (00:04 -0400)]
Rework remote_login and remove protect decorator

The protect decorator was not really being used for anything, remove it.

Change the way UserSession's remote_login() works.
If called now it either sets a REMOTE_USER (if found) or nukes the current
user data in the session.
This means this function can be safely called only in a login plugin now.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
5 years agoChange test executables into modules
Simo Sorce [Mon, 16 Jun 2014 20:26:31 +0000 (16:26 -0400)]
Change test executables into modules

Create a common tests framework and convert tests into modules loaded
at runtime using the ipsilon plugin framework.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix warning
Simo Sorce [Mon, 16 Jun 2014 15:22:18 +0000 (11:22 -0400)]
Fix warning

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd tests to source distribution too
Simo Sorce [Mon, 16 Jun 2014 15:22:02 +0000 (11:22 -0400)]
Add tests to source distribution too

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd project url and maintainer data to setup file
Simo Sorce [Mon, 16 Jun 2014 15:21:15 +0000 (11:21 -0400)]
Add project url and maintainer data to setup file

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoStrenghten default Security options in IDP
Simo Sorce [Tue, 17 Jun 2014 13:13:38 +0000 (09:13 -0400)]
Strenghten default Security options in IDP

Always deny access to the IDP if not using SSL by default.
Always turn on secure/httponly cookies by default.
Add a switch to disable all security options for testing.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix non-'make test' installation
Simo Sorce [Tue, 17 Jun 2014 18:46:25 +0000 (14:46 -0400)]
Fix non-'make test' installation

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoMove parsing code into helpers module
Simo Sorce [Sun, 15 Jun 2014 21:46:47 +0000 (17:46 -0400)]
Move parsing code into helpers module

This way common test actions can be easily reused by multiple tests.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd server install option to turn on debugging
Simo Sorce [Fri, 6 Jun 2014 20:04:15 +0000 (16:04 -0400)]
Add server install option to turn on debugging

Use this in the testsuite so we can get meaningful output in the logs
when something fails.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoPrint more info about the steps being performed
Simo Sorce [Fri, 6 Jun 2014 19:09:24 +0000 (15:09 -0400)]
Print more info about the steps being performed

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoClean up only after package removal, not during upgrades.
Jan Pazdziora [Fri, 6 Jun 2014 14:18:08 +0000 (16:18 +0200)]
Clean up only after package removal, not during upgrades.

Signed-off-by: Jan Pazdziora <jpazdziora@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
5 years agoMake sure semanage and restorecon are installed when we want to use them.
Jan Pazdziora [Fri, 6 Jun 2014 14:07:11 +0000 (16:07 +0200)]
Make sure semanage and restorecon are installed when we want to use them.

Addressing
Installing : ipsilon-0.2.4-3.fc20.x86_64                                  1/1
/var/tmp/rpm-tmp.pDkQSL: line 1: semanage: command not found

Signed-off-by: Jan Pazdziora <jpazdziora@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
5 years agoIf there are some errors while semanaging, we want to see them.
Jan Pazdziora [Fri, 6 Jun 2014 14:02:21 +0000 (16:02 +0200)]
If there are some errors while semanaging, we want to see them.

Signed-off-by: Jan Pazdziora <jpazdziora@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
5 years agoBump up release to 0.2.5 v0.2.5
Simo Sorce [Wed, 4 Jun 2014 14:27:33 +0000 (10:27 -0400)]
Bump up release to 0.2.5

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd first test, checks client/server installs work
Simo Sorce [Sun, 1 Jun 2014 19:47:44 +0000 (15:47 -0400)]
Add first test, checks client/server installs work

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd support for socket wrappers if available
Simo Sorce [Mon, 2 Jun 2014 18:05:57 +0000 (14:05 -0400)]
Add support for socket wrappers if available

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd basic testing infrastructure
Simo Sorce [Wed, 28 May 2014 22:29:39 +0000 (18:29 -0400)]
Add basic testing infrastructure

make test will now run some sanity tests to make sure basic installation
procedures work in a sinthetic test environment.

Adds:
- custom httpd setup for tests
- use profiles to driver ipsilon servers and clients installation
- starts multiple httpd servers

This way we can test interaction between IDP and SP servers

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd test login module
Simo Sorce [Thu, 29 May 2014 01:36:12 +0000 (21:36 -0400)]
Add test login module

This is useful to do automated testing.
It accepts authentication as long as the password is 'ipsilon'.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdditional parametrization of template files
Simo Sorce [Thu, 29 May 2014 02:34:33 +0000 (22:34 -0400)]
Additional parametrization of template files

To allow for testing in a custom rootdir, and with a custom user.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoDo not make directory unwritable
Simo Sorce [Wed, 28 May 2014 22:28:14 +0000 (18:28 -0400)]
Do not make directory unwritable

This does not stop the user, but makes it hard to deal wit the directory
in testing.
Let file fixing use the default 700 permissions.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd support for passing configuration profile
Simo Sorce [Tue, 27 May 2014 22:02:29 +0000 (18:02 -0400)]
Add support for passing configuration profile

The new option --config-profile accepts a INI style file, so that
installation options are passed in via a file. this is useful for
testing and automated installs.

This file can have 2 sections: globals, arguments.

The globals section can change global variable in the install script
like: TEMPLATES, CONFDIR, DATADIR, HTTPDCONFD and so on, so that an
installation can use non-standad directories.

The argumets section accepts any argument option.
The config profile file is parsed after all arguments have parsed and
can override any plugin argument.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAllow turning off security at install time
Simo Sorce [Fri, 30 May 2014 14:09:18 +0000 (10:09 -0400)]
Allow turning off security at install time

This should be used only for testing purposes

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd optional field to allow pasting the metadata
Simo Sorce [Thu, 29 May 2014 13:38:18 +0000 (09:38 -0400)]
Add optional field to allow pasting the metadata

This way a user can avoid copying the metadata file arund but paste
the content straight from a terminal window.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd tooltips to SAML forms
Simo Sorce [Tue, 27 May 2014 21:01:38 +0000 (17:01 -0400)]
Add tooltips to SAML forms

This should make clearer what is expected in each field.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoShow the Save button only if it useful
Simo Sorce [Tue, 27 May 2014 20:13:28 +0000 (16:13 -0400)]
Show the Save button only if it useful

If the user cannot perform any action there is no reason to show the
save button.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoIf krb is explicitly 'no' do not check for ipa
Simo Sorce [Tue, 27 May 2014 19:28:30 +0000 (15:28 -0400)]
If krb is explicitly 'no' do not check for ipa

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix location name
Simo Sorce [Thu, 29 May 2014 02:48:57 +0000 (22:48 -0400)]
Fix location name

Must be the same name wher ethe instance is mounted!

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix typo
Simo Sorce [Tue, 27 May 2014 21:31:16 +0000 (17:31 -0400)]
Fix typo

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd sdist and rpms targets to Makefile
Simo Sorce [Tue, 20 May 2014 19:42:24 +0000 (15:42 -0400)]
Add sdist and rpms targets to Makefile

make rpms will now create fedora rpms in dist/[s]rpms

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix sample spec file to use a versioned doc dir
Simo Sorce [Tue, 20 May 2014 13:45:08 +0000 (09:45 -0400)]
Fix sample spec file to use a versioned doc dir

This makes the same spec file work on latest Fedora and RHEL7 too.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix handling of SP renames
Simo Sorce [Tue, 20 May 2014 18:18:21 +0000 (14:18 -0400)]
Fix handling of SP renames

Properly replace page self.url

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix referer checks with escaped URLs
Simo Sorce [Tue, 20 May 2014 19:20:43 +0000 (15:20 -0400)]
Fix referer checks with escaped URLs

When a SP name included spaces the referer checker would fail to match
the url. It would try to return a 403 error, unfortunately this would
also trip as a return instead of an exception was used, ending up with
a 500 error being returned to the user.

Fix url checks by unquoting before comparing.
Fix error reporting by rasing an exception when needed instead of
returning.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix E501 line too long errors
Simo Sorce [Tue, 20 May 2014 19:29:45 +0000 (15:29 -0400)]
Fix E501 line too long errors

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix E256 with stricter pep8 error checker
Simo Sorce [Tue, 20 May 2014 19:28:27 +0000 (15:28 -0400)]
Fix E256 with stricter pep8 error checker

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix E713 with stricter pep8 error checker
Simo Sorce [Tue, 20 May 2014 19:25:29 +0000 (15:25 -0400)]
Fix E713 with stricter pep8 error checker

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoBump up release to 0.2.4 v0.2.4
Simo Sorce [Tue, 20 May 2014 12:05:09 +0000 (14:05 +0200)]
Bump up release to 0.2.4

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoDistribute README file too
Simo Sorce [Tue, 20 May 2014 12:07:19 +0000 (14:07 +0200)]
Distribute README file too

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix typo in selinux boolean name
Simo Sorce [Tue, 20 May 2014 12:03:09 +0000 (14:03 +0200)]
Fix typo in selinux boolean name

This was causing pam auth to fail, as the boolean was not being turned on.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix generation fo server's metadata file
Simo Sorce [Mon, 19 May 2014 19:15:56 +0000 (21:15 +0200)]
Fix generation fo server's metadata file

At some point a '/' got lost, causing the generation of wrong endpoints.
Clients would then be redirected to an unexisting path and get a 404.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoBump up release to 0.2.3 v0.2.3
Simo Sorce [Wed, 7 May 2014 16:23:28 +0000 (12:23 -0400)]
Bump up release to 0.2.3

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix broken login plugins order config handling
Nathan Kinder [Sat, 10 May 2014 00:38:32 +0000 (17:38 -0700)]
Fix broken login plugins order config handling

The administrative page for configuring login plugins order had
a number of problems.  The html template expects a list of plugin
names to be supplied,  but a list of the actual plugin objects
was being supplied.  This caused a 500 error since join() would
throw an exception when it encounters something other than a string.

Even after fixing the 500 error, actually modifying the plugin
order would not work due to further issues with plugin objects
being used when strings representing the plugin names are expected
(and vice-versa).

This patch ensures that strings representing plugin names are
supplied to the html template, and that plugin objects are used
when re-ordering the live plugin list.

Resolves: https://fedorahosted.org/ipsilon/ticket/2

Signed-off-by: Nathan Kinder <nkinder@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
5 years agoWSGI settings incorrectly makes instance global
Nathan Kinder [Fri, 9 May 2014 23:16:11 +0000 (16:16 -0700)]
WSGI settings incorrectly makes instance global

The WSGIProcessGroup directive should only apply to the /idp URI.
Without wrapping this directive in the Location element, multiple
Ipsilon instances or an Ipsilon instance installed on a FreeIPA
server will conflict and encounter problems running in the same
httpd process. All wsgi processes will end up redirected to the
last process grup defined in the configuration in this case and
all other instances of wsgi applications will be unreachable.

Resolves: https://fedorahosted.org/ipsilon/ticket/1

Signed-off-by: Nathan Kinder <nkinder@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
5 years agoAdd details on using a principal for the admin
Nathan Kinder [Fri, 9 May 2014 23:12:31 +0000 (16:12 -0700)]
Add details on using a principal for the admin

When Ipsilon is being installed with IPA, one is most likely going
to use Kerberos to login to Ipsilon as the administrator.  We should
call this out, as the default of 'admin' for the Ipsilon admin user
will conflict with the IPA 'admin' user.  You will be unable to
create a local 'admin' user at this point, requiring you to modify
the sqlite database directly to change the admin user to a full
principal.

I also corrected a typo and wrapped a line that was > 79 chars.

Signed-off-by: Nathan Kinder <nkinder@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
5 years agoAdd 500 Error handler for krb module
Simo Sorce [Wed, 7 May 2014 13:51:25 +0000 (09:51 -0400)]
Add 500 Error handler for krb module

If mod_auth_kerb encounters an internal error, catch it so we can fall back to
the next authentication module, if any, or return a proper failure message.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoRemind the user to restart HTTPD when done
Simo Sorce [Wed, 7 May 2014 13:47:20 +0000 (09:47 -0400)]
Remind the user to restart HTTPD when done

On a successful install you need to retsart apache to enable the instance,
remind the user that is necessary.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoGive more user feedback around keytab issues
Simo Sorce [Wed, 7 May 2014 13:45:32 +0000 (09:45 -0400)]
Give more user feedback around keytab issues

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoVersion bump, go to 0.2.2 v0.2.2
Simo Sorce [Fri, 2 May 2014 00:52:50 +0000 (20:52 -0400)]
Version bump, go to 0.2.2

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd README file with basic installation HOWTO
Simo Sorce [Fri, 2 May 2014 00:50:17 +0000 (20:50 -0400)]
Add README file with basic installation HOWTO

The HowTo cover the simplest scenarios for both the Identiry and
Service Provider applications.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd IPA helper for server install
Simo Sorce [Tue, 29 Apr 2014 21:24:29 +0000 (17:24 -0400)]
Add IPA helper for server install

The IPa helper chcks a krb keytab is available for the local HTTPD
service at the standard ipa location, and if not available, tries
to register the sevice and retrieve one from the IPA server.

At the end of the process forces the activation of the krb plugin
as well as the fallback to pam for authentication.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd Environment Helpers installer framework
Simo Sorce [Mon, 28 Apr 2014 17:58:51 +0000 (13:58 -0400)]
Add Environment Helpers installer framework

Environment helpers are meta-plugins that allow to set ipsilon in
well defined environments.
For example when ipsilon is install in a FreeIPA or AD domains and
authentication methods, cetificate, keytabs etc, can be pre-configured
and deployed at the same time the server is installed with minimal
effort and wellknown methods.

These are run before any of the other plugins as they can chage the
configuration option for any of the plugins, enable or disable plugins,
or pre-configure some elements.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAlways use saml by default
Simo Sorce [Fri, 2 May 2014 01:00:14 +0000 (21:00 -0400)]
Always use saml by default

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoMake SELinux happy
Simo Sorce [Thu, 1 May 2014 17:16:14 +0000 (13:16 -0400)]
Make SELinux happy

Add proper context to shared state directories so that httpd can write there.

Relax SElinux boolans to allow use of pam modules
This allows running Ipsilon in fully enforcing mode when pam auth
using the python-pam modules is used.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAvoid failing install if sessions directory exists
Simo Sorce [Thu, 1 May 2014 19:31:25 +0000 (15:31 -0400)]
Avoid failing install if sessions directory exists

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoEliminte stale locks
Simo Sorce [Thu, 1 May 2014 20:37:12 +0000 (16:37 -0400)]
Eliminte stale locks

If the server crashes stale lock files may e left behind.
This will cause the application to deadlock for the user that has
the misfortune of having a stale lock.
Forcibly remove all locks on startup.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix typo in ipsilon-client-install
Simo Sorce [Fri, 2 May 2014 00:52:02 +0000 (20:52 -0400)]
Fix typo in ipsilon-client-install

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoBump up spec file vesion too
Simo Sorce [Mon, 28 Apr 2014 13:27:30 +0000 (09:27 -0400)]
Bump up spec file vesion too

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoBump version up to 0.2.1
Simo Sorce [Fri, 25 Apr 2014 20:46:00 +0000 (16:46 -0400)]
Bump version up to 0.2.1

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoDo not hardcode sessions directory in spec file
Simo Sorce [Mon, 21 Apr 2014 03:45:18 +0000 (23:45 -0400)]
Do not hardcode sessions directory in spec file

This directory is now generated dynamicaly based on the instance
name at ipsilon-server-install time.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoMake it easy to install mutiple server instances
Simo Sorce [Fri, 18 Apr 2014 04:43:37 +0000 (00:43 -0400)]
Make it easy to install mutiple server instances

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoMove templatized file creation to tools
Simo Sorce [Fri, 18 Apr 2014 04:16:12 +0000 (00:16 -0400)]
Move templatized file creation to tools

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoMove fixing files functionality to tools
Simo Sorce [Fri, 18 Apr 2014 03:59:35 +0000 (23:59 -0400)]
Move fixing files functionality to tools

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoConvert all forms to use util.Page form support
Simo Sorce [Mon, 21 Apr 2014 02:00:08 +0000 (22:00 -0400)]
Convert all forms to use util.Page form support

This way all forms will get Referer checking automaticaly

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd New form helper to Page object
Simo Sorce [Mon, 21 Apr 2014 01:41:24 +0000 (21:41 -0400)]
Add New form helper to Page object

This removes the need to define a root funciton only to redirect to
a GET/POST one.
Also adds basic CSRF protection if the page is declared a form.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoUpdate contrib spec file for version 0.2
Simo Sorce [Fri, 18 Apr 2014 04:51:26 +0000 (00:51 -0400)]
Update contrib spec file for version 0.2

Drop changelog, it's unnecessary, commit logs are available in git

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix warning
Simo Sorce [Fri, 18 Apr 2014 05:28:34 +0000 (01:28 -0400)]
Fix warning

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoRevert incorrect change to template file
Simo Sorce [Fri, 18 Apr 2014 05:27:09 +0000 (01:27 -0400)]
Revert incorrect change to template file

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd missing install file
Simo Sorce [Fri, 18 Apr 2014 04:47:52 +0000 (00:47 -0400)]
Add missing install file

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoBump up to version 0.2
Simo Sorce [Wed, 16 Apr 2014 22:12:52 +0000 (18:12 -0400)]
Bump up to version 0.2

now that we have a basic client and server installers we have reached
a milestone. Bump up the version.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix NameId exception
Simo Sorce [Mon, 14 Apr 2014 22:38:45 +0000 (18:38 -0400)]
Fix NameId exception

Report what invalid name was used and fix exception on raising the exception on
line 129

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd nameid values validation
Simo Sorce [Mon, 14 Apr 2014 20:27:52 +0000 (16:27 -0400)]
Add nameid values validation

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoRefactor argument validation for SP forms
Simo Sorce [Mon, 14 Apr 2014 20:18:06 +0000 (16:18 -0400)]
Refactor argument validation for SP forms

Use helper functions to make the code more readbale and exceptions to reduce
error hndling duplication.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoValidate Service Provider names
Simo Sorce [Fri, 11 Apr 2014 22:20:32 +0000 (18:20 -0400)]
Validate Service Provider names

We use the name to construct the admin page path, avoid odd characters

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoInstall client tools in a separate rpm package
Simo Sorce [Thu, 10 Apr 2014 20:22:53 +0000 (16:22 -0400)]
Install client tools in a separate rpm package

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd basic installation script with saml support
Simo Sorce [Sat, 5 Apr 2014 17:23:02 +0000 (13:23 -0400)]
Add basic installation script with saml support

Generates (self signed) certificates and a metdata.xml file.
Optionally configures an Apache Httpd server.
If the admin does not configure a specific application at install time
a default landing page is made available to be able to test that the SP
configuration works.
Uninstall removes all certificates and metadata file and is irreversible.

5 years agoAllow to set additional custom keys on services
Simo Sorce [Fri, 11 Apr 2014 20:46:24 +0000 (16:46 -0400)]
Allow to set additional custom keys on services

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoSimplify metadata add_service signature
Simo Sorce [Wed, 9 Apr 2014 19:21:55 +0000 (15:21 -0400)]
Simplify metadata add_service signature

Add a map that takes care of the lower level lasso-related details

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoStore full path immediately
Simo Sorce [Fri, 11 Apr 2014 19:42:54 +0000 (15:42 -0400)]
Store full path immediately

Allows to query .key and .cert to e used to find the files on the system
directly w/o having to know what path was previously used to initialize the
class.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoIf no path is provided use current directory
Simo Sorce [Wed, 9 Apr 2014 19:16:02 +0000 (15:16 -0400)]
If no path is provided use current directory

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoMove accessory functions to a generic tools module
Simo Sorce [Wed, 9 Apr 2014 18:02:08 +0000 (14:02 -0400)]
Move accessory functions to a generic tools module

This will allow to easly share the module with install tools, without the
need to install server side modules in clients

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoRename scripts and mark them as such
Simo Sorce [Mon, 7 Apr 2014 20:02:20 +0000 (16:02 -0400)]
Rename scripts and mark them as such

Mark actual top level scripts as such instead of disguising them as modules.

Also remove __init__.py from ipsilon/install as this is not a module just
the place where install scripts are kept, for now.

Note: Scripts are installed in the bin directory but the contrib spec file
moves them to sbin.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoAdd debug logging of lasso library
Simo Sorce [Fri, 11 Apr 2014 20:36:16 +0000 (16:36 -0400)]
Add debug logging of lasso library

If debug is enabled make lasso spit debug messages to stderr too, to aid
admins in resolving issues related to saml2 issues, like finding out why
a metadata file may be rejected.

This is very simple for now, a future enhancement may involve piping the
logs into a calss so they can be spat out as feedback to users.

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoReturn Idps metadata file on request
Simo Sorce [Mon, 7 Apr 2014 22:41:12 +0000 (18:41 -0400)]
Return Idps metadata file on request

Signed-off-by: Simo Sorce <simo@redhat.com>
5 years agoFix generation of endopint URLs
Simo Sorce [Mon, 7 Apr 2014 22:28:41 +0000 (18:28 -0400)]
Fix generation of endopint URLs

Signed-off-by: Simo Sorce <simo@redhat.com>