Produits Entr'ouvert » Hobo

            'hobo.provisionning.middleware.ProvisionningMiddleware',

            'hobo.provisionning.middleware.ProvisionningMiddleware',

import requests

from hobo.signature import sign_url

                            self.notify_agents({

                    self.notify_agents({

            self.notify_agents({

            self.notify_agents({

    def notify_agents(self, data):

        if getattr(settings, 'HOBO_HTTP_PROVISIONNING', False):

            services_by_url = {}

            for services in settings.KNOWN_SERVICES.values():

                for service in services.values():

                    if service.get('provisionning-url'):

                        services_by_url[service['saml-sp-metadata-url']] = service

            audience = data.get('audience')

            rest_audience = [x for x in audience if x in services_by_url]

            amqp_audience = audience

            for audience in rest_audience:

                service = services_by_url[audience]

                data['audience'] = [audience]

                try:

                    response = requests.put(

                        sign_url(service['provisionning-url'] + '?orig=%s' % service['orig'], service['secret']),

                        json=data)

                    response.raise_for_status()

                except requests.RequestException as e:

                    logger.error(u'error provisionning to %s (%s)', audience, e)

                else:

                    amqp_audience.remove(audience)

            data['audience'] = amqp_audience

            if amqp_audience:

                logger.info(u'leftover AMQP audience: %s', amqp_audience)

        if data['audience']:

            notify_agents(data)

from hobo.provisionning.utils import NotificationProcessing, TryAgain

class Command(BaseCommand, NotificationProcessing):

        if self.get_provisionning_url():

            as_dict['provisionning-url'] = self.get_provisionning_url()

    def get_provisionning_url(self):

        return self.get_base_url_path() + '__provision__/'

    def get_provisionning_url(self):

        return None

import hashlib

from hobo.multitenant.settings_loaders import KnownServices

def get_local_key(url):

    secret1 = force_text(settings.SECRET_KEY)

    secret2 = url

    return KnownServices.shared_secret(secret1, secret2)[:40]

def get_local_hobo_dict():

    if not build_absolute_uri:

        return None

    # if there's a known base url hobo can advertise itself.

    return {

        'secret_key': get_local_key(build_absolute_uri('/')),

        'service-id': 'hobo',

        'title': 'Hobo',

        'slug': 'hobo',

        'base_url': build_absolute_uri(reverse('home')),

        'saml-sp-metadata-url': build_absolute_uri(reverse('mellon_metadata')),

        'backoffice-menu-url': build_absolute_uri(reverse('menu_json')),

        'provisionning-url': build_absolute_uri('/__provision__/'),

    }

def get_installed_services_dict():

    from .models import Variable

    hobo_service = []

    hobo_dict = get_local_hobo_dict()

    if hobo_dict:

        hobo_service.append(hobo_dict)

                'provisionning-url': service.get('provisionning-url'),

                'saml-sp-metadata-url': service.get('saml-sp-metadata-url'),

# hobo - portal to configure and deploy applications

# Copyright (C) 2015-2020  Entr'ouvert

#

# This program is free software: you can redistribute it and/or modify it

# under the terms of the GNU Affero General Public License as published

# by the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU Affero General Public License for more details.

#

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import json

from django.conf import settings

from django.http import JsonResponse, HttpResponseBadRequest, HttpResponseForbidden

from django.utils.encoding import force_text

from django.utils.deprecation import MiddlewareMixin

from django.utils.six.moves.urllib.parse import urlparse

from hobo.provisionning.utils import NotificationProcessing, TryAgain

from hobo.rest_authentication import PublikAuthentication, PublikAuthenticationFailed

class ProvisionningMiddleware(MiddlewareMixin, NotificationProcessing):

    def process_request(self, request):

        if not (request.method == 'PUT' and request.path == '/__provision__/'):

            return None

        if 'hobo.environment' in settings.INSTALLED_APPS:

            # much ado about hobo

            from hobo.environment.utils import get_local_hobo_dict

            known_services = getattr(settings, 'KNOWN_SERVICES', None)

            local_hobo_dict = get_local_hobo_dict()

            if not known_services:

                # hobo in a single deployment instance

                settings.KNOWN_SERVICES = known_services = {}

                known_services['hobo'] = {'hobo': local_hobo_dict}

                known_services['authentic'] = {'idp': {}}

            if known_services['hobo']['hobo']['provisionning-url'] == local_hobo_dict['provisionning-url']:

                # hobo in a single deployment instance, or primary hobo in a

                # multi-instances environment

                from hobo.environment.models import Authentic

                from hobo.multitenant.settings_loaders import KnownServices

                authentic = Authentic.objects.all().first()

                orig = urlparse(authentic.base_url).netloc.split(':')[0]

                # create stub settings.KNOWN_SERVICES with just enough to get

                # authentication passing.

                idp_service = list(settings.KNOWN_SERVICES['authentic'].values())[0]

                idp_service['verif_orig'] = orig

                idp_service['secret_key'] = KnownServices.shared_secret(

                        authentic.secret_key, local_hobo_dict['secret_key'])

        try:

            PublikAuthentication().authenticate(request)

        except PublikAuthenticationFailed:

            return HttpResponseForbidden()

        try:

            notification = json.loads(force_text(request.body))

        except ValueError:

            return HttpResponseBadRequest()

        if not isinstance(notification, dict) or 'objects' not in notification:

            return HttpResponseBadRequest()

        object_type = notification['objects'].get('@type')

        issuer = notification.get('issuer')

        action = notification.get('@type')

        if not (object_type and issuer and action):

            return HttpResponseBadRequest()

        full = notification['full'] if 'full' in notification else False

        for i in range(20):

            try:

                getattr(self, 'provision_' + object_type)(issuer, action, notification['objects']['data'], full=full)

            except TryAgain:

                continue

            break

        return JsonResponse({'err': 0})

# hobo - portal to configure and deploy applications

# Copyright (C) 2015-2020  Entr'ouvert

#

# This program is free software: you can redistribute it and/or modify it

# under the terms of the GNU Affero General Public License as published

# by the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU Affero General Public License for more details.

#

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import random

import logging

from django.db.transaction import atomic

from django.db import IntegrityError

from hobo.multitenant.utils import provision_user_groups

from hobo.agent.common.models import Role

class TryAgain(Exception):

    pass

class NotificationProcessing:

    @classmethod

    def check_valid_notification(cls, notification):

        return isinstance(notification, dict) \

            and '@type' in notification \

            and notification['@type'] in ['provision', 'deprovision'] \

            and 'objects' in notification \

            and 'audience' in notification \

            and isinstance(notification['audience'], list) \

            and isinstance(notification['objects'], dict)

    @classmethod

    def check_valid_role(cls, o):

        return 'uuid' in o \

               and 'name' in o \

               and 'description' in o

    @classmethod

    def check_valid_user(cls, o):

        return 'uuid' in o \

               and 'is_superuser' in o \

               and 'email' in o \

               and 'first_name' in o \

               and 'last_name' in o \

               and 'roles' in o

    @classmethod

    def provision_user(cls, issuer, action, data, full=False):

        from django.contrib.auth import get_user_model

        from mellon.models import UserSAMLIdentifier

        User = get_user_model()

        assert not full  # provisionning all users is dangerous, we prefer deprovision

        uuids = set()

        for o in data:

            try:

                with atomic():

                    if action == 'provision':

                        assert cls.check_valid_user(o)

                        try:

                            mellon_user = UserSAMLIdentifier.objects.get(

                                issuer=issuer, name_id=o['uuid'])

                            user = mellon_user.user

                        except UserSAMLIdentifier.DoesNotExist:

                            try:

                                user = User.objects.get(username=o['uuid'][:30])

                            except User.DoesNotExist:

                                # temp user object

                                random_uid = str(random.randint(1, 10000000000000))

                                user = User.objects.create(

                                    username=random_uid)

                            mellon_user = UserSAMLIdentifier.objects.create(

                                user=user, issuer=issuer, name_id=o['uuid'])

                        user.first_name = o['first_name'][:30]

                        user.last_name = o['last_name'][:30]

                        user.email = o['email'][:75]

                        user.username = o['uuid'][:30]

                        user.is_superuser = o['is_superuser']

                        user.is_staff = o['is_superuser']

                        user.save()

                        role_uuids = [role['uuid'] for role in o.get('roles', [])]

                        provision_user_groups(user, role_uuids)

                    elif action == 'deprovision':

                        assert 'uuid' in o

                uuids.add(o['uuid'])

            except IntegrityError:

                raise TryAgain

        if full and action == 'provision':

            for usi in UserSAMLIdentifier.objects.exclude(name_id__in=uuids):

                usi.user.delete()

        elif action == 'deprovision':

            for user in User.objects.filter(saml_identifiers__name_id__in=uuids):

                user.delete()

    @classmethod

    def provision_role(cls, issuer, action, data, full=False):

        logger = logging.getLogger(__name__)

        uuids = set()

        for o in data:

            assert 'uuid' in o

            uuids.add(o['uuid'])

            if action == 'provision':

                assert cls.check_valid_role(o)

                role_name = o['name']

                if len(role_name) > 70:

                    role_name = role_name[:70] + '(...)'

                try:

                    role = Role.objects.get(uuid=o['uuid'])

                    created = False

                except Role.DoesNotExist:

                    try:

                        with atomic():

                            role, created = Role.objects.get_or_create(

                                name=role_name, defaults={

                                    'uuid': o['uuid'],

                                    'description': o['description']})

                    except IntegrityError:

                        # Can happen if uuid and name already exist

                        logger.error(u'cannot provision role "%s" (%s)', o['name'], o['uuid'])

                        continue

                if not created:

                    save = False

                    if role.name != role_name:

                        role.name = role_name

                        save = True

                    if role.uuid != o['uuid']:

                        role.uuid = o['uuid']

                        save = True

                    if role.description != o['description']:

                        role.description = o['description']

                        save = True

                    if role.details != o.get('details', u''):

                        role.details = o.get('details', u'')

                        save = True

                    if save:

                        try:

                            with atomic():

                                role.save()

                        except IntegrityError:

                            # Can happen if uuid and name already exist

                            logger.error(u'cannot provision role "%s" (%s)', o['name'], o['uuid'])

                            continue

        if full and action == 'provision':

            for role in Role.objects.exclude(uuid__in=uuids):

                role.delete()

        elif action == 'deprovision':

            for role in Role.objects.filter(uuid__in=uuids):

                role.delete()

INSTALLED_APPS += ('hobo.contrib.ozwillo', 'hobo.agent.common')

MIDDLEWARE_CLASSES = MIDDLEWARE_CLASSES + (

        'hobo.middleware.RobotsTxtMiddleware',

        'hobo.provisionning.middleware.ProvisionningMiddleware')

def test_provision_using_http(transactional_db, tenant, settings, caplog):

    with tenant_context(tenant):

        # create providers so notification messages have an audience.

        LibertyProvider.objects.create(ou=None, name='provider', slug='provider',

                                       entity_id='http://example.org',

                                       protocol_conformance=lasso.PROTOCOL_SAML_2_0)

        LibertyProvider.objects.create(ou=None, name='provider2', slug='provider2',

                                       entity_id='http://example.com',

                                       protocol_conformance=lasso.PROTOCOL_SAML_2_0)

    with patch('hobo.agent.authentic2.provisionning.notify_agents') as notify_agents:

        call_command('createsuperuser', domain=tenant.domain_url, uuid='coin',

                     username='coin', email='coin@coin.org', interactive=False)

        assert notify_agents.call_count == 1

        assert set(notify_agents.call_args[0][0]['audience']) == {'http://example.org', 'http://example.com'}

    settings.HOBO_HTTP_PROVISIONNING = True

    with patch('hobo.agent.authentic2.provisionning.notify_agents') as notify_agents:

        call_command('createsuperuser', domain=tenant.domain_url, uuid='coin2',

                     username='coin2', email='coin2@coin.org', interactive=False)

        assert notify_agents.call_count == 1

        assert set(notify_agents.call_args[0][0]['audience']) == {'http://example.org', 'http://example.com'}

    settings.HOBO_HTTP_PROVISIONNING = True

    settings.KNOWN_SERVICES = {

        'foo': {

            'bar': {

                'saml-sp-metadata-url': 'http://example.org',

                'provisionning-url': 'http://example.org/__provision__/',

                'orig': 'example.org',

                'secret': 'xxx',

            }

        }

    }

    with patch('hobo.agent.authentic2.provisionning.notify_agents') as notify_agents:

        with patch('hobo.agent.authentic2.provisionning.requests.put') as requests_put:

            call_command('createsuperuser', domain=tenant.domain_url, uuid='coin2',

                         username='coin2', email='coin2@coin.org', interactive=False)

            assert notify_agents.call_count == 1

            assert notify_agents.call_args[0][0]['audience'] == ['http://example.com']

            assert requests_put.call_count == 1

            # cannot check audience passed to requests.put as it's the same

            # dictionary that is altered afterwards and would thus also contain

            # http://example.com.

    settings.KNOWN_SERVICES['foo']['bar2'] = {

        'saml-sp-metadata-url': 'http://example.com',

        'provisionning-url': 'http://example.com/__provision__/',

        'orig': 'example.com',

        'secret': 'xxx',

    }

    with patch('hobo.agent.authentic2.provisionning.notify_agents') as notify_agents:

        with patch('hobo.agent.authentic2.provisionning.requests.put') as requests_put:

            call_command('createsuperuser', domain=tenant.domain_url, uuid='coin2',

                         username='coin2', email='coin2@coin.org', interactive=False)

            assert notify_agents.call_count == 0

            assert requests_put.call_count == 2

                         'saml-sp-metadata-url', 'provisionning-url', 'secondary'])

            "provisionning-url": "https://hobo-instance-name.dev.signalpublik.com/__provision__/",

            "secret_key": "XXX",

            "secret_key": "XXX",

            "use_as_idp_for_self": true,

            "variables": {}

            "provisionning-url": "https://demarches-instance-name.dev.signalpublik.com/__provision__/",

            "secret_key": "XXX",

            "provisionning-url": "https://passerelle-instance-name.dev.signalpublik.com/__provision__/",

            "secret_key": "XXX",

            "provisionning-url": "https://instance-name.dev.signalpublik.com/__provision__/",

            "secret_key": "XXX",

            "provisionning-url": "https://agents-instance-name.dev.signalpublik.com/__provision__/",

            "secret_key": "XXX",

    "timestamp": "XXXXXXXXXX.XX",