Projet

Général

Profil

0001-saml-add-login-hint-extension-on-backoffice-access-4.patch

Serghei Mihai (congés, retour 15/05), 27 mai 2020 10:05

Télécharger (3,36 ko)

Voir les différences: 

Subject: [PATCH] saml: add login-hint extension on backoffice access (#42193)


 tests/test_saml_auth.py | 23 +++++++++++++++++++++++
 wcs/qommon/saml2.py     | 13 +++++++++++--
 2 files changed, 34 insertions(+), 2 deletions(-)
tests/test_saml_auth.py
354 354 
    assert ':next_url>http://example.net/backoffice/<' in request.getOriginalXmlnode()
355 355 

  		




  356
  356
  
    

  		




  
  357
  
    
def test_saml_login_hint(pub):

  		




  
  358
  
    
    resp = get_app(pub).get('/login/')

  		




  
  359
  
    
    assert resp.status_int == 302

  		




  
  360
  
    
    assert resp.location.startswith('http://sso.example.net/saml2/sso')

  		




  
  361
  
    
    request = lasso.Samlp2AuthnRequest()

  		




  
  362
  
    
    request.initFromQuery(urlparse.urlparse(resp.location).query)

  		




  
  363
  
    
    assert 'login-hint' not in request.getOriginalXmlnode()

  		




  
  364
  
    

  		




  
  365
  
    
    resp = get_app(pub).get('/backoffice/')

  		




  
  366
  
    
    assert resp.status_int == 302

  		




  
  367
  
    
    assert resp.location.startswith('http://example.net/login/?next=')

  		




  
  368
  
    
    resp = resp.follow()

  		




  
  369
  
    
    assert resp.location.startswith('http://sso.example.net/saml2/sso')

  		




  
  370
  
    
    request = lasso.Samlp2AuthnRequest()

  		




  
  371
  
    
    request.initFromQuery(urlparse.urlparse(resp.location).query)

  		




  
  372
  
    
    assert ':login-hint>backoffice<' in request.getOriginalXmlnode()

  		




  
  373
  
    

  		




  
  374
  
    
    resp = get_app(pub).get('http://example.net/login/?next=/backoffice/')

  		




  
  375
  
    
    request = lasso.Samlp2AuthnRequest()

  		




  
  376
  
    
    request.initFromQuery(urlparse.urlparse(resp.location).query)

  		




  
  377
  
    
    assert ':login-hint>backoffice<' in request.getOriginalXmlnode()

  		




  
  378
  
    

  		




  
  379
  
    

  		




  357
  380
  
    
def test_saml_register(pub):

  		




  358
  381
  
    
    get_app(pub).get('/register/', status=404)

  		




  359
  382
  
    
    pub.cfg['saml_identities'] = {'identity-creation': 'self'}

  		












  

    
      wcs/qommon/saml2.py
    
  





  173
  173
  
    
            login.msgRelayState = get_request().form.get('next')

  		




  174
  174
  
    

  		




  175
  175
  
    
        next_url = login.msgRelayState or get_publisher().get_frontoffice_url()

  		




  
  176
  
    
        parsed_url = urlparse.urlparse(next_url)

  		




  
  177
  
    
        request = get_request()

  		




  
  178
  
    
        scheme = parsed_url.scheme or request.get_scheme()

  		




  
  179
  
    
        netloc = parsed_url.netloc or request.get_server()

  		




  
  180
  
    
        next_url = urlparse.urlunsplit((scheme, netloc, parsed_url.path, parsed_url.query,

  		




  
  181
  
    
                                         parsed_url.fragment))

  		




  176
  182
  
    
        samlp_extensions = '''<samlp:Extensions

  		




  177
  183
  
    
                        xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"

  		




  178
  184
  
    
                        xmlns:eo="https://www.entrouvert.com/">

  		




  179
  
  
    
                      <eo:next_url>%s</eo:next_url>

  		




  180
  
  
    
                   </samlp:Extensions>''' % escape(next_url)

  		




  
  185
  
    
                      <eo:next_url>%s</eo:next_url>''' % escape(next_url)

  		




  
  186
  
    
        # set login-hint only if backoffice is accessed

  		




  
  187
  
    
        if next_url.startswith(get_publisher().get_backoffice_url()):

  		




  
  188
  
    
            samlp_extensions += '<eo:login-hint>backoffice</eo:login-hint>'

  		




  
  189
  
    
        samlp_extensions += '</samlp:Extensions>'

  		




  181
  190
  
    
        # work around lasso bug https://dev.entrouvert.org/issues/23001

  		




  182
  191
  
    
        if hasattr(lasso.Samlp2Extensions, 'any'):

  		




  183
  192
  
    
            login.request.extensions = lasso.Node.newFromXmlNode(samlp_extensions)

  		




  184
  
  
    
-