Produits Entr'ouvert » w.c.s.

import shutil

import pytest

from quixote import cleanup

from wcs.qommon import sessions

from wcs.qommon.http_request import HTTPRequest

from wcs.formdef import FormDef

from wcs.categories import Category

    formdef2 = FormDef()

    formdef2.category_id = category.id

    formdef2.store()

    assert 'href="category1/test-formdef-1/"' in output

    assert 'href="category1/test-formdef-2/"' in output

def test_private_site_anonymous_access():

    FormDef.wipe()

    create_formdef()

    formdef1.store()

    formdef2.store()

    with pytest.raises(wcs.forms.root.errors.AccessUnauthorizedError):

def test_semi_private_site_anonymous_access():

    FormDef.wipe()

    assert 'href="category1/test-formdef-1/"' not in output

    assert 'href="category1/test-formdef-2/"' in output

def test_private_site_authorized_access():

    FormDef.wipe()

    create_formdef()

    assert 'href="category1/test-formdef-1/"' in output

    assert 'href="category1/test-formdef-2/"' in output

def test_private_site_unauthorized_access():

    FormDef.wipe()

    create_formdef()

    formdef1.store()

    formdef2.store()

    with pytest.raises(wcs.forms.root.errors.AccessUnauthorizedError):

def test_private_site_semi_authorized_access():

    FormDef.wipe()

    assert 'href="category1/test-formdef-1/"' in output

    assert 'href="category1/test-formdef-2/"' not in output

def test_advertized_site_anonymous_access():

    FormDef.wipe()

    create_formdef()

    assert 'href="category1/test-formdef-2/"' not in output

    assert 'authentication required' in output  # locales ?

def test_advertized_site_user_access():

    FormDef.wipe()

    create_formdef()

    assert 'href="category1/test-formdef-2/"' not in output

    assert 'authentication required' in output  # locales ?

def test_static_directories():

    assert get_app(pub).get('/static/css/wcs.css')

    assert get_app(pub).get('/static/images/feed-icon-10x10.png')

    assert 'Directory listing denied' in get_app(pub).get('/static/css/').body

    assert get_app(pub).get('/static/xxx', status=404)

def test_jquery_debug_mode():

    FormDef.wipe()

    create_formdef()

import datetime

import os

import shutil

import urlparse

import pytest

from wcs.qommon.http_request import HTTPRequest

from wcs.qommon.misc import get_lasso_server

from wcs.qommon.saml2 import Saml2Directory

from wcs.roles import Role

from utilities import get_app, create_temporary_pub, clean_temporary_pub

pytestmark = pytest.mark.skipif('lasso is None')

IDP_METADATA = """<?xml version="1.0"?>

  </ns0:IDPSSODescriptor>

</ns0:EntityDescriptor>"""

    if 'pub' in metafunc.fixturenames:

        metafunc.parametrize('pub', ['pickle', 'sql'], indirect=True)

@pytest.fixture

def pub(request):

    pub = create_temporary_pub(sql_mode=(request.param == 'sql'))

        'saml2_metadata': 'saml2-metadata.xml',

        'saml2_base_url': 'http://example.net/saml',

        'saml2_providerid': 'http://example.net/saml/metadata'

    MethodAdminDirectory().generate_rsa_keypair()

    setup_idps(pub)

    pub.user_class.wipe()

            base_id = 'http-sso.example.net-saml2-metadata'

        else:

            base_id = 'http-sso%s.example.net-saml2-metadata' % i

        pub.cfg['idp'][base_id] = {

            'metadata': 'idp-%s-metadata.xml' % base_id,

            'publickey': 'idp-%s-publickey.pem' % base_id,

            'role': lasso.PROVIDER_ROLE_IDP,

        }

        filename = pub.cfg['idp'][base_id]['metadata']

        fd.write(metadata)

        fd.close()

        filename = pub.cfg['idp'][base_id]['publickey']

        fd.write(idp_publickey)

        fd.close()

        filename = pub.cfg['idp'][base_id]['publickey'].replace('public', 'private')

        fd.write(idp_privatekey)

        fd.close()

def teardown_module(module):

    clean_temporary_pub()

def test_login(pub):

    req = HTTPRequest(None, {

        'SERVER_NAME': 'example.net',

        'SCRIPT_NAME': '',

    pub._set_request(req)

    saml2 = Saml2Directory()

    saml2.perform_login()

    assert req.response.status_code == 302

    assert req.response.headers['location'].startswith('http://sso.example.net/saml2/sso?SAMLRequest')

def get_authn_response_msg(pub, ni_format=lasso.SAML2_NAME_IDENTIFIER_FORMAT_PERSISTENT):

    idp = lasso.Server(idp_metadata_filepath, idp_key_filepath, None, None)

    idp.addProvider(lasso.PROVIDER_ROLE_SP,

    login = lasso.Login(idp)

    login.initIdpInitiatedAuthnRequest(pub.cfg['sp']['saml2_providerid'])

    login.request.nameIDPolicy.format = ni_format

    login.request.protocolBinding = lasso.SAML2_METADATA_BINDING_POST

    login.processAuthnRequestMsg(None)

    login.validateRequestMsg(True, True)

    if ni_format == lasso.SAML2_NAME_IDENTIFIER_FORMAT_UNSPECIFIED:

        login.assertion.subject.nameID.content = '1234'

    value = lasso.MiscTextNode.newWithString('John')

    login.buildAuthnResponseMsg()

    return login.msgBody

def get_assertion_consumer_request(pub, ni_format=lasso.SAML2_NAME_IDENTIFIER_FORMAT_PERSISTENT):

    req = HTTPRequest(None, {

        'SERVER_NAME': 'example.net',

        'SCRIPT_NAME': '',

        'PATH_INFO': '/saml/assertionConsumerPost',

    pub._set_request(req)

    pub.session_class.wipe()

    req.session = pub.session_class(id=1)

    req.form['SAMLResponse'] = get_authn_response_msg(pub, ni_format=ni_format)

    return req

def test_saml_metadata(pub):

    req = HTTPRequest(None, {'SERVER_NAME': 'example.net', 'SCRIPT_NAME': '', })

    pub._set_request(req)

    assert '<EntityDescriptor' in body

    assert req.response.content_type == 'text/xml'

def test_saml_public_key(pub):

    req = HTTPRequest(None, {'SERVER_NAME': 'example.net', 'SCRIPT_NAME': '', })

    pub._set_request(req)

    assert body.startswith('-----BEGIN PUBLIC KEY-----')

    assert req.response.content_type == 'application/octet-stream'

def test_assertion_consumer(pub):

    req = get_assertion_consumer_request(pub)

    saml2 = Saml2Directory()

    assert req.response.status_code == 303

    assert req.response.headers['location'] == 'http://example.net'

    assert req.session.user is not None

def test_assertion_consumer_unspecified(pub):

    req = get_assertion_consumer_request(pub, ni_format=lasso.SAML2_NAME_IDENTIFIER_FORMAT_UNSPECIFIED)

    saml2 = Saml2Directory()

    assert req.response.status_code == 303

    assert req.response.headers['location'] == 'http://example.net'

    assert req.session.user is not None

def test_assertion_consumer_existing_federation(pub, caplog):

    # setup an hobo profile

    from wcs.ctl.check_hobos import CmdCheckHobos

        'SERVER_NAME': 'example.net',

        'SCRIPT_NAME': '',

        'PATH_INFO': '/saml/assertionConsumerPost',

    pub._set_request(req)

    req.session.message = ('error', 'blah')

    req.form['SAMLResponse'] = saml_response_body

    assert req.session.user is None

    assert req.session.saml_authn_context == lasso.SAML2_AUTHN_CONTEXT_PASSWORD

    assert req.session.message is None

def test_assertion_consumer_redirect_after_url(pub):

    req = get_assertion_consumer_request(pub)

    req.form['RelayState'] = '/foobar/?test=ok'

    saml2 = Saml2Directory()

    assert req.response.status_code == 303

    assert req.response.headers['location'] == 'http://example.net/foobar/?test=ok'

def test_assertion_consumer_full_url_redirect_after_url(pub):

    req = get_assertion_consumer_request(pub)

    req.form['RelayState'] = 'http://example.org/foobar/?test=ok'

    saml2 = Saml2Directory()

    assert req.response.status_code == 303

    assert req.response.headers['location'] == 'http://example.org/foobar/?test=ok'

def test_saml_login_page(pub):

    resp = get_app(pub).get('/login/')

    assert resp.status_int == 302

    request.initFromQuery(urlparse.urlparse(resp.location).query)

    assert request.forceAuthn is False

def test_saml_login_page_force_authn(pub):

    resp = get_app(pub).get('/login/?forceAuthn=true')

    assert resp.status_int == 302

    request.initFromQuery(urlparse.urlparse(resp.location).query)

    assert request.forceAuthn is True

def test_saml_login_page_several_idp(pub):

    setup_idps(pub, idp_number=4)

    # even if there are multiple IdP, /login/ will initiate SSO with the first

    assert resp.status_int == 302

    assert resp.location.startswith('http://%s/saml2/sso?SAMLRequest=' % first_idp_domain)

def test_saml_backoffice_redirect(pub):

    resp = get_app(pub).get('/backoffice/')

    assert resp.status_int == 302

    request.initFromQuery(urlparse.urlparse(resp.location).query)

    assert ':next_url>http://example.net/backoffice/<' in request.getOriginalXmlnode()

def test_saml_register(pub):

    get_app(pub).get('/register/', status=404)

    pub.cfg['saml_identities'] = {'identity-creation': 'self'}

    assert resp.location.startswith('http://sso.example.net/saml2/sso?SAMLRequest=')

    # check redirection to known registration page

    pub.write_cfg()

    resp = get_app(pub).get('/register/')

    assert resp.location == 'http://sso.example.net/registration'

    # check redirection to known registration page, with a variable

    pub.write_cfg()

    resp = get_app(pub).get('/register/')

    assert resp.location == 'http://sso.example.net/registration?next_url=http%3A%2F%2Fexample.net%2Fregister%2F'

def test_saml_logout(pub):

    req = get_assertion_consumer_request(pub)

    saml2 = Saml2Directory()

    saml2.assertionConsumerPost()

    assert req.session.user is not None

    assert req.response.headers['location'].startswith('http://sso.example.net/saml2/slo?SAMLRequest=')

    assert req.session.user is None

def test_saml_idp_logout(pub):

    req = get_assertion_consumer_request(pub)

    saml2 = Saml2Directory()

    name_id = req.session.name_identifier

    # and recreate an idp session

    idp = lasso.Server(idp_metadata_filepath, idp_key_filepath, None, None)

    login = lasso.Login(idp)

    login.initIdpInitiatedAuthnRequest(pub.cfg['sp']['saml2_providerid'])

    login.request.protocolBinding = lasso.SAML2_METADATA_BINDING_POST

    login.processAuthnRequestMsg(None)

    login.validateRequestMsg(True, True)

    login.assertion.subject.nameID.content = name_id

    login.assertion.id = assertion_id

    login.assertion.authnStatement[0].sessionIndex = assertion_id