From a1bcbfd426a6c3860edf53e12da32ff6daad4442 Mon Sep 17 00:00:00 2001 From: Nathan Kinder Date: Tue, 10 Mar 2015 20:02:07 -0700 Subject: [PATCH] Validate SP path settings during installation There are a number of URL path options that can be specified as options when running ipsilon-client-install. There are certain rules that must be followed to result in a valid mod_auth_mellon configuration: - All path options must be prefixed with '/'. - The mellon endpoint path (--saml-sp) must be a subpath of the httpd 'Location' element is it contained within (--saml-base). - The logout (--saml-sp-logout) and post (--saml-sp-post) paths must be subpaths of the mellon endpoint (--saml-sp). This adds validation for all of the above rules. https://fedorahosted.org/ipsilon/ticket/82 Signed-off-by: Nathan Kinder Reviewed-by: Patrick Uiterwijk --- ipsilon/install/ipsilon-client-install | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/ipsilon/install/ipsilon-client-install b/ipsilon/install/ipsilon-client-install index 237b439..f7d9883 100755 --- a/ipsilon/install/ipsilon-client-install +++ b/ipsilon/install/ipsilon-client-install @@ -270,6 +270,27 @@ def parse_args(): if len(args['hostname'].split('.')) < 2: raise ValueError('Hostname: %s is not a FQDN.') + # Validate that all path options begin with '/' + path_args = ['saml_base', 'saml_auth', 'saml_sp', 'saml_sp_logout', + 'saml_sp_post'] + for path_arg in path_args: + if not args[path_arg].startswith('/'): + raise ValueError('--%s must begin with a / character.' % + path_arg.replace('_', '-')) + + # The saml_sp setting must be a subpath of saml_base since it is + # used as the MellonEndpointPath. + if not args['saml_sp'].startswith(args['saml_base']): + raise ValueError('--saml-sp must be a subpath of --saml-base.') + + # The saml_sp_logout and saml_sp_post settings must be subpaths + # of saml_sp (the mellon endpoint). + path_args = ['saml_sp_logout', 'saml_sp_post'] + for path_arg in path_args: + if not args[path_arg].startswith(args['saml_sp']): + raise ValueError('--%s must be a subpath of --saml-sp' % + path_arg.replace('_', '-')) + # At least one on this list needs to be specified or we do nothing sp_list = ['saml'] present = False -- 2.20.1