Simo Sorce [Mon, 20 Oct 2014 20:08:06 +0000 (16:08 -0400)]
In configure we do not need to set_config()
All we care about in configure is to store the config in the db,
so skip setting the config explicitly in the plugin object and go
straight to the database.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Mon, 10 Nov 2014 19:57:53 +0000 (14:57 -0500)]
Add simple SqlSession implementation
This allows us to store session data in the DB. This way session data can
be shared by multiple servers behind a balancer.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Wed, 29 Oct 2014 14:22:36 +0000 (10:22 -0400)]
Add test to check a real database (pgsql) works
Change config template to e able to set up ipsilon with an extrenal
database.
For the easy install the database server must have 3 datbases configured,
and named exactly: admincondif, userprefs, transactions
If different names are required manual instalation will be necessary.
Database URLs (including credentials) can be set using the new option
named --database-url
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 24 Oct 2014 15:20:00 +0000 (11:20 -0400)]
Fix plugins enablement code
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Sun, 19 Oct 2014 20:02:22 +0000 (16:02 -0400)]
Add SVG Image to the Home administration page
This SVG image contain HREF links that are template in jinja to link
images/text i the SVG to the menu pages.
Clicking on elements of the SVG thus redirects to the relevant menu item.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 16 Oct 2014 00:26:24 +0000 (20:26 -0400)]
Update style of plugins config page too
Also fix a bug that would cause the config page to show no fields
when saving.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 16 Oct 2014 00:04:14 +0000 (20:04 -0400)]
Reuse the AdminPlugins class for the providers too
This way we can remove even more duplicated code... \o/
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Wed, 15 Oct 2014 04:17:53 +0000 (00:17 -0400)]
Improve UI for enabling/disabling plugins config
Use the same templates for both info and login plugins
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 17 Oct 2014 16:54:06 +0000 (12:54 -0400)]
Change default font-size to a bigger one
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 17 Oct 2014 16:54:57 +0000 (12:54 -0400)]
Disable clean-css for now
During developemtn it makes it easier to have a human readbale css file.
In future we may change the code to strip unnecessary chracters on the fly
or restore clean-css generation.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 17 Oct 2014 17:03:14 +0000 (13:03 -0400)]
Add default link to system fonts
This avoids annoying 404s to the browser if open-sans fonts are installed
If they are not installed fallback fonts will be used by the browser.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Wed, 15 Oct 2014 02:30:32 +0000 (22:30 -0400)]
Allow to call forms from any of the admin pages
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 24 Oct 2014 22:01:04 +0000 (18:01 -0400)]
Use self.log in authpam.py
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 24 Oct 2014 21:45:45 +0000 (17:45 -0400)]
Fix lp-test target compaints
This was making make test fail even though make tests was working
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Patrick Uiterwijk [Fri, 24 Oct 2014 20:14:45 +0000 (22:14 +0200)]
infoldap is of course LDAP
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Patrick Uiterwijk [Fri, 24 Oct 2014 17:25:19 +0000 (19:25 +0200)]
Map some common attributes from fas to userdata
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Signed-off-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Tue, 14 Oct 2014 22:39:19 +0000 (18:39 -0400)]
Properly handle empty values in storage
Do not return default values if an actual empty string is found
in the database.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Tue, 14 Oct 2014 03:41:12 +0000 (23:41 -0400)]
Return to provider if user cancels login
When the cancel button is hit return to the provider and eventually to the
original application via return urls.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 10 Oct 2014 17:34:00 +0000 (13:34 -0400)]
Handle invalid/expired transactions gracefully
Return a useful error page every time and invalid or expired
transaction is requested, instead of ending up with an internal
backtrace and an ugly 500 error.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Sat, 11 Oct 2014 16:14:20 +0000 (12:14 -0400)]
Remove useless log file
Tests do not log into this log file, so remove it for now, it just clutters
the tests dir without reason.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Patrick Uiterwijk [Fri, 10 Oct 2014 18:21:25 +0000 (20:21 +0200)]
Make the template directory configurable
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Patrick Uiterwijk [Fri, 10 Oct 2014 18:11:59 +0000 (20:11 +0200)]
Show login target on the login screen
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Fri, 10 Oct 2014 18:24:27 +0000 (14:24 -0400)]
Drop custom FAS template
The form and fas template are identical so just drop the fas.html
template and use the default.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 10 Oct 2014 17:26:34 +0000 (13:26 -0400)]
Add group and CLA support to FAS login plugin
Add support for returning groups and other information from the FAS
login plugin.
If the openid module is available also split out cla group information
into a spearate item so the openid CLA extension can make use of it
and cla groups are not regarded as real groups.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 9 Oct 2014 03:38:18 +0000 (23:38 -0400)]
Add OpenId extensions
Implement:
Simple Registration
Attribute Exchange
(Fedora) Teams
CLAs
Signed-off-by: Simo Sorce <simo@redhat.com>
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 9 Oct 2014 18:44:04 +0000 (14:44 -0400)]
Add attribute mapping for user information
When user information is retrieved we map any wellknown data to a
standardized set of names.
A ne InfoMapping class takes cares of helping the info modules to
map the data they retrieve so that providers can find it in wellknown
attribute names for further use.
Mapping of attribute names for diplay purposes is also provided.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Patrick Uiterwijk [Mon, 6 Oct 2014 17:12:13 +0000 (19:12 +0200)]
Add OpenIDP Provider
This commit implements all the core functionality needed to expose
an OpenID Identity Provider including a framework to dynamycally add
extensions.
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Tue, 14 Oct 2014 15:57:28 +0000 (11:57 -0400)]
Handle lists type options in plugins configuration
Autodetect and convert config values based on the options definition.
If the option is marked as list split a string on setting the configuration
or join the list into a string before saving it to the database.
Signed-off-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Fri, 10 Oct 2014 19:52:01 +0000 (15:52 -0400)]
Do not overwrite default plugin options
Change the admin plugin to not overwrite the plugin default options,
and only use the sanctioned pluginObject interfaces to read/write
config values.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Wed, 8 Oct 2014 22:13:15 +0000 (18:13 -0400)]
Add helpers to store per plugin user preferences
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Tue, 7 Oct 2014 15:00:37 +0000 (11:00 -0400)]
Move some exceptions into provider.common
These are generically useful and can be rused as they are by other
providers.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 9 Oct 2014 22:09:54 +0000 (18:09 -0400)]
Fix storing info plugin status and order
This is the same issue already resolved for the login plugins in
commit
a6ed2bba137df5fb8a9fb2931ccb2d92ca3fa0e0
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Wed, 8 Oct 2014 20:02:42 +0000 (16:02 -0400)]
Add sqlalchemy dependency to contrib rpm
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 9 Oct 2014 15:30:25 +0000 (11:30 -0400)]
Fix mod_auth_kerb based authentication
Recent changes in how self.user is populated broke krb based auth.
Explicitly check the remote user in the module to fix it.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Patrick Uiterwijk [Mon, 6 Oct 2014 19:08:51 +0000 (21:08 +0200)]
The quickrun workdir and cscope.out should be ignored
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Tue, 7 Oct 2014 03:32:34 +0000 (23:32 -0400)]
Add auto-auth requirement to all admin pages
Instead ofhaving to explicitly decorate all methods with auth_protect()
use the fact all pages go through Page.__call__ to conditionally check
if the user is anoynous and set a default when instantiating AdminPage
so that all admin pages require authentication.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Tue, 7 Oct 2014 02:48:07 +0000 (22:48 -0400)]
Add AdminPage abstraction on top of util.Page
This is to allow different default headers between Admin pages and
other pages.
In particular we set no-caching headers to all admin pages to force
browsers to refresh as often as possible.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Tue, 7 Oct 2014 02:18:56 +0000 (22:18 -0400)]
Add way to set default headers
When a Page is called automatically sets default headers by adding
headers on the default_headers variable.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Tue, 7 Oct 2014 01:48:58 +0000 (21:48 -0400)]
Add pretty handler for 404
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Tue, 7 Oct 2014 03:22:10 +0000 (23:22 -0400)]
Fix exposed functions
The Page util is supposed to intercept and enable exposed pages on
its own so that additional functions can be run in the generic __call__
Fix the code to check for the function argument correctly and use a
different argument than the standard cherrypy one for admin pages so
that we do actually land in the Page.__call__ all the time for those
pages.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Mon, 6 Oct 2014 19:58:10 +0000 (15:58 -0400)]
Fix make cscope and clean
clean should clean more and cscope should not try to read an unexisting file.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 3 Oct 2014 17:24:37 +0000 (13:24 -0400)]
Redirect anonymous users away
It makes no sense to let anonymous users interact with the admin
pages so tighten up access and redirect away users that have no
rights.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 26 Sep 2014 21:41:04 +0000 (17:41 -0400)]
Additional data store refactoring
Use sqlalchemy to access Sql databases, which are the only implemented
database backends for now.
If no database type is specified we assume a sqlite3 database file path
is configured (this is backwards compatible with current configuration
statements)
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 26 Sep 2014 21:38:30 +0000 (17:38 -0400)]
Fix storing login plugin status and order
When plugins were enabled or disabled their status was not stored
in the database, unless the order was explicitly manipulated.
Moreover if the order was changed that fact would not be refrlected
in the actual authntication order until a restart.
Fix the code to always permanently store the enabled/disabled status,
and to immediately change the authentication order.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 25 Sep 2014 19:59:07 +0000 (15:59 -0400)]
Move wipe_data into Store() as reset_data
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 25 Sep 2014 20:05:04 +0000 (16:05 -0400)]
Databases must be configured in cherrypy.config
There was annoying duplicated init code in the data store classes that was
unused. Just require configuration to be present in cherrypy.config or bail.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Sun, 5 Oct 2014 16:49:11 +0000 (12:49 -0400)]
Remove unused dependency
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 25 Sep 2014 18:54:53 +0000 (14:54 -0400)]
Provide cleanup switch to quickrun
Easier to wipe old test and start with fresh data for a quickrun
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 25 Sep 2014 18:54:08 +0000 (14:54 -0400)]
Use installation template in quickrun
Instead of using a duplicate use installation template so there is
less risk of forgetting something in either.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 25 Sep 2014 20:09:39 +0000 (16:09 -0400)]
Add make cscope target
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 25 Sep 2014 18:36:32 +0000 (14:36 -0400)]
Add transactions db default paths
Fixes installation and quickrun
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 2 Oct 2014 23:51:34 +0000 (19:51 -0400)]
Make Transaction code more robust
Avoid raising exceptions when transactions are not found, just return
no cookies or empty dicts with no transactions in them.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Sun, 5 Oct 2014 18:00:25 +0000 (14:00 -0400)]
Fix transaction handling in providers
When a provider redirects to the login code, it must retain 'ownership'
of the transaction, otherwise the login code will wipe the transaction
data as sson as the authentication is completed but before the provider
has completed its part of the transaction.
Make sure the transaction code retrieves the 'owner' from the data for
pre-existing transactions.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Sun, 5 Oct 2014 17:33:16 +0000 (13:33 -0400)]
Fix login session's userdata acquisition
With the transaction code changes th session.login() function was
incorrectly moved before all the userdata was gathered. An incomplete
set was stored in the session.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Patrick Uiterwijk [Wed, 24 Sep 2014 18:53:14 +0000 (20:53 +0200)]
Add testdir/ to gitignore.
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Thu, 28 Aug 2014 18:59:13 +0000 (14:59 -0400)]
Add very simple LDAP authentication plugin
Uses python-ldap to perform a simple bind after connecting to
the LDAP server using (by default) a TLS encrypted connection.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 19 Sep 2014 19:10:27 +0000 (15:10 -0400)]
Test transactions code with full redirect login
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Wed, 10 Sep 2014 21:20:02 +0000 (17:20 -0400)]
Use transactions throughout the code
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Wed, 10 Sep 2014 21:19:55 +0000 (17:19 -0400)]
Add transactions support
In some cases a user may end up having multiple login pags in diffeent tabs in
the borwser (session restore after a crash, or simply opening multiple urls
which all redirect to the same IdP).
Without transactions multiple authentication requests in fly may step on each
other causing potentially all of them to fail to properly authenticate and
redirect back to the original web site.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Mon, 8 Sep 2014 19:55:34 +0000 (15:55 -0400)]
Refactor the data store a bit
Reduce code duplication, and clearly separates admin and user dbs.
Move plugin wrapper away and let plugin code use native functions.
This patch also changes the indexed data to use a uuid and assumes
2 identical uuid cannot be created concurrently.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Tue, 16 Sep 2014 21:07:18 +0000 (17:07 -0400)]
Add abstraction class to handle cookies
This handles secure cokies with useful helpers and defaults.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Tue, 2 Sep 2014 21:41:07 +0000 (17:41 -0400)]
Add Info providers Admin pages
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Sat, 28 Jun 2014 03:10:12 +0000 (23:10 -0400)]
Add test that checks attrs are properly returned
Uses the info_nss module to source attirbutes from the system user
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Mon, 16 Jun 2014 23:36:03 +0000 (19:36 -0400)]
Add support for returning user attributes
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 27 Jun 2014 23:29:27 +0000 (19:29 -0400)]
Add Info Provider plugin framework
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 28 Aug 2014 18:25:15 +0000 (14:25 -0400)]
Add error log facility to Log utility
Also improve debug errors by adding the originating function
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 29 Aug 2014 22:03:34 +0000 (18:03 -0400)]
Add proper ordering to login plugins config opts
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 29 Aug 2014 21:50:45 +0000 (17:50 -0400)]
Allow plugins to determine config options order
Ordering may also be partial, for any option not specified they will be
appended in lexycographic order.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 29 Aug 2014 22:04:49 +0000 (18:04 -0400)]
Remove service name from the form plugin
When using the external apache modules for form based authentication,
the pam service name is set in the apache config files and cannot be
dynamically changed, do not offr it as a configuration option.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 1 Aug 2014 14:22:04 +0000 (10:22 -0400)]
Use an instance specific session id cookie name
Avoids issues if multiple instances are used on the same server
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 1 Aug 2014 14:19:53 +0000 (10:19 -0400)]
Confine session to the instance
Set session path so that the session is sent only for the specific instance
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 1 Aug 2014 12:15:49 +0000 (08:15 -0400)]
Use helper cookie to remember the username
This makes the login page a lot more friendy
Available only over HTTPS
Max age set to 15 days
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 1 Aug 2014 12:14:58 +0000 (08:14 -0400)]
Create common form handler page
Reduce duplication
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 1 Aug 2014 11:59:52 +0000 (07:59 -0400)]
Rename form login page
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Thu, 28 Aug 2014 18:44:43 +0000 (14:44 -0400)]
Remove unused option from the FAS login plugin
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 19 Sep 2014 19:08:52 +0000 (15:08 -0400)]
Handle the presence of additional form fields
For exampe hidden fields which must be preserved and POSTed back to the
action url.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 12 Sep 2014 21:13:14 +0000 (17:13 -0400)]
Cast db value to string before comparison
Avoid false negatives when the sqlite3 db is 'smart' and automatically
converts the type to integer.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 12 Sep 2014 21:17:59 +0000 (17:17 -0400)]
Allow deferred initialization of providers
This fixes enabling a provider after the sever is started.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Mon, 8 Sep 2014 21:36:02 +0000 (17:36 -0400)]
Do not reprovision if conf is already available
Also use a more meaningful directory name by default
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Mon, 8 Sep 2014 20:00:48 +0000 (16:00 -0400)]
Declare admin attribute
Makes lint happier
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Patrick Uiterwijk [Fri, 5 Sep 2014 21:37:28 +0000 (17:37 -0400)]
Fix the check for hasattr(., 'admin')
Avoid crashing if a provider does not have an admin interface
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Tue, 26 Aug 2014 20:38:14 +0000 (16:38 -0400)]
Add FAS login plugin
This plugin simply take a Fedora username and password and authenticates
the user against the FAS Server.
FAS returned data is saved as userdata in the 'fas' attribute.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Mon, 25 Aug 2014 20:40:21 +0000 (16:40 -0400)]
Restore ability to run from checkout
also adds quickrun.py script to make it easy.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Fri, 27 Jun 2014 23:36:56 +0000 (19:36 -0400)]
Move user attribute storage into session functions
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Sat, 28 Jun 2014 00:26:22 +0000 (20:26 -0400)]
Use new Log class everywhere
Replace copies of _debug function sprinkled all over the code
with a single implementation
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
- Removed replace of self._debug to self.debug
Simo Sorce [Sat, 28 Jun 2014 00:17:00 +0000 (20:17 -0400)]
Add Log class that can be inherited from safely
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Tue, 17 Jun 2014 19:16:55 +0000 (15:16 -0400)]
Prefer the 'form' login manager in ipa setups
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk
- Replaced "all(lm not in" with "not any(lm in"
Simo Sorce [Mon, 16 Jun 2014 16:25:30 +0000 (12:25 -0400)]
Add External form auth plugin
This plugin uses mod_intercept_form_submit to perform authentication.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Wed, 18 Jun 2014 04:04:08 +0000 (00:04 -0400)]
Rework remote_login and remove protect decorator
The protect decorator was not really being used for anything, remove it.
Change the way UserSession's remote_login() works.
If called now it either sets a REMOTE_USER (if found) or nukes the current
user data in the session.
This means this function can be safely called only in a login plugin now.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Simo Sorce [Mon, 16 Jun 2014 20:26:31 +0000 (16:26 -0400)]
Change test executables into modules
Create a common tests framework and convert tests into modules loaded
at runtime using the ipsilon plugin framework.
Signed-off-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Mon, 16 Jun 2014 15:22:18 +0000 (11:22 -0400)]
Fix warning
Signed-off-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Mon, 16 Jun 2014 15:22:02 +0000 (11:22 -0400)]
Add tests to source distribution too
Signed-off-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Mon, 16 Jun 2014 15:21:15 +0000 (11:21 -0400)]
Add project url and maintainer data to setup file
Signed-off-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Tue, 17 Jun 2014 13:13:38 +0000 (09:13 -0400)]
Strenghten default Security options in IDP
Always deny access to the IDP if not using SSL by default.
Always turn on secure/httponly cookies by default.
Add a switch to disable all security options for testing.
Signed-off-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Tue, 17 Jun 2014 18:46:25 +0000 (14:46 -0400)]
Fix non-'make test' installation
Signed-off-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Sun, 15 Jun 2014 21:46:47 +0000 (17:46 -0400)]
Move parsing code into helpers module
This way common test actions can be easily reused by multiple tests.
Signed-off-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Fri, 6 Jun 2014 20:04:15 +0000 (16:04 -0400)]
Add server install option to turn on debugging
Use this in the testsuite so we can get meaningful output in the logs
when something fails.
Signed-off-by: Simo Sorce <simo@redhat.com>
Simo Sorce [Fri, 6 Jun 2014 19:09:24 +0000 (15:09 -0400)]
Print more info about the steps being performed
Signed-off-by: Simo Sorce <simo@redhat.com>
Jan Pazdziora [Fri, 6 Jun 2014 14:18:08 +0000 (16:18 +0200)]
Clean up only after package removal, not during upgrades.
Signed-off-by: Jan Pazdziora <jpazdziora@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Jan Pazdziora [Fri, 6 Jun 2014 14:07:11 +0000 (16:07 +0200)]
Make sure semanage and restorecon are installed when we want to use them.
Addressing
Installing : ipsilon-0.2.4-3.fc20.x86_64 1/1
/var/tmp/rpm-tmp.pDkQSL: line 1: semanage: command not found
Signed-off-by: Jan Pazdziora <jpazdziora@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
projects / cascardo / ipsilon.git / log