Produits Entr'ouvert » Authentic 2

    python3-djangorestframework (<< 3.10),

    python3-markdown (>= 2.1),

    python3-ldap (>= 2.4),

    python3-jwcrypto (>= 0.3.1),

    python3-cryptography (>= 1.3.4),

    python3-django-filters (>= 1),

XStatic_jquery_ui       python3-xstatic-jquery-ui

django-import-export    python3-django-import-export

django-sekizai          python3-django-sekizai

pycryptodome            python3-pycryptodome

ldaptools               python3-ldaptools

django-mellon           python3-django-mellon

- gadjo>=0.6

- django-import-export>=0.2.7,<=0.4.5

- djangorestframework>=3.3

- Markdown>=2.5

- python-ldap

        'gadjo>=0.53',

        'django-import-export>=1,<2',

        'djangorestframework>=3.3,<3.10',

        'Markdown>=2.1',

        'python-ldap',

        'django-filter>1,<2.3',

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from django.contrib import admin

from django.utils.translation import ugettext_lazy as _

from . import models

    list_select_related = True

    def name(self, obj):

    name.short_description = _('name')

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from django.contrib.contenttypes.models import ContentType

from django.utils.text import slugify

from django.utils.translation import ugettext

from django.utils.translation import ugettext_lazy as _

        # do not create scoped admin roles if the model is not scopable

        if not ou_model:

            continue

        slug = '_a2-' + slugify(name)

        name = scoped_name.format(ou=ou)

        ou_slug = slug + '-' + ou.slug

        if app_settings.MANAGED_CONTENT_TYPES == ():

        if ct_tuple not in MANAGED_CT:

            continue

        # General admin role

        slug = '_a2-' + slugify(name)

        if (

            app_settings.MANAGED_CONTENT_TYPES is not None

from __future__ import unicode_literals

from django.db import migrations

from authentic2.a2_rbac.models import MANAGE_MEMBERS_OP

from django_rbac.models import CHANGE_OP

    Permission = apps.get_model('a2_rbac', 'Permission')

    Operation = apps.get_model('django_rbac', 'Operation')

    ContentType = apps.get_model('contenttypes', 'ContentType')

    ct = ContentType.objects.get_for_model(Role)

    perms_to_delete = []

    for role in Role.objects.all():

from django.core.exceptions import ValidationError

from django.core.validators import MinValueValidator

from django.db import models

from django.utils.text import slugify

from django.utils.translation import pgettext_lazy

from django.utils.translation import ugettext_lazy as _

        admin_role = self.__class__.objects.get_admin_role(

            self,

            permissions=(view_user_perm,),

            self_administered=True,

            update_name=True,

import sys

from django.core.exceptions import ImproperlyConfigured

from django.utils.translation import ugettext_lazy as _

    def __init__(self, default=SENTINEL, definition='', names=None):

        self.names = names or []

            self.names = [self.names]

        self.names = set(self.names)

        self.default = default

from django.core.validators import RegexValidator

from django.db.models import query

from django.urls import reverse

from django.utils.functional import keep_lazy

from django.utils.translation import pgettext_lazy

from django.utils.translation import ugettext_lazy as _

from .plugins import collect_from_plugins

def capfirst(value):

    return value and value[0].upper() + value[1:]

        # Test for the empty string here so that it does not get validated,

        # and so that subclasses do not need to handle it explicitly

        # inside the `to_internal_value()` method.

            if not self.allow_blank:

                self.fail('blank')

            return ''

import abc

    """

    Base class for attribute sources

    """

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from django.contrib.auth import get_user_model

from django.utils.translation import ugettext_lazy as _

from django_rbac.utils import get_role_model

        ctx['django_user_' + str(av.attribute.name)] = serialized

        ctx['django_user_' + str(av.attribute.name) + ':verified'] = av.verified

    ctx['django_user_groups'] = [group for group in user.groups.all()]

    if user.username:

        splitted = user.username.rsplit('@', 1)

        ctx['django_user_domain'] = splitted[1] if '@' in user.username else ''

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from django.core.exceptions import ImproperlyConfigured

from ...decorators import to_list

            config_error(UNEXPECTED_KEYS_ERROR, unexpected)

        if 'name' not in keys or 'template' not in keys:

            config_error(BAD_CONFIG_ERROR)

            config_error(TYPE_ERROR)

        yield d

import inspect

try:

    from django.utils.deprecation import CallableTrue

except ImportError:

            pass

        # try BasicAuthentication

        if (

            in inspect.signature(super(Authentic2Authentication, self).authenticate_credentials).parameters

        ):

            # compatibility with DRF 3.4

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import hashlib

try:

    import ldap

import os

import random

import time

from django.conf import settings

from django.contrib import messages

from django.contrib.auth.models import Group

from django.core.cache import cache

from django.core.exceptions import ImproperlyConfigured

from django.utils.encoding import force_bytes, force_text

from django.utils.translation import ngettext

from django.utils.translation import ugettext as _

def map_text(d):

    if d is None:

        return d

        return force_text(d)

    elif isinstance(d, (list, tuple)):

        return d.__class__(map_text(x) for x in d)

        '''Obtain a Django role'''

        kwargs = {}

        slug = None

            slug = role_id

        elif isinstance(role_id, (tuple, list)):

            try:

                attribute, param = attribute.split(':')

                quote = 'noquote' not in param.split(',')

            if quote:

            else:

                decoded.append((attribute, force_text(value)))

        filters = [filter_format(u'(%s=%s)', (a, b)) for a, b in decoded]

            if isinstance(part, list):

                part = part[0]

            if quote:

            parts.append(part)

        return ' '.join(part for part in parts)

        # convert string to list of strings for settings accepting it

        for i in cls._TO_ITERABLE:

                block[i] = (block[i],)

        for d in cls._DEFAULTS:

                if d == 'user_filter' and app_settings.A2_ACCEPT_EMAIL_AUTHENTICATION:

                    block[d] = '(|(mail=%s)(uid=%s))'

            else:

                        raise ImproperlyConfigured('LDAP_AUTH_SETTINGS: attribute %r must be a string' % d)

                    try:

                        block[d] = force_text(block[d])

        for key in cls._TO_LOWERCASE:

            # we handle strings, list of strings and list of list or tuple whose first element is a

            # string

                block[key] = force_text(block[key]).lower()

            elif isinstance(block[key], (list, tuple)):

                new_seq = []

from __future__ import unicode_literals

from django.contrib.auth import get_user_model

from django.contrib.auth.backends import ModelBackend

from django.db import models

from authentic2.backends import get_user_queryset

from authentic2.user_login_failure import user_login_failure, user_login_success

                        queries.append(models.Q(**{username_field: upn(username, realm)}))

        else:

            queries.append(models.Q(**{username_field: upn(username, realm)}))

        if ou:

            queries &= models.Q(ou=ou)

        return queries

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from django.conf import settings

from . import app_settings, plugins

from .decorators import SessionCache

def make_origin(url):

    '''Build origin of an URL'''

    if ':' in parsed.netloc:

        host, port = parsed.netloc.split(':', 1)

        if parsed.scheme == 'http' and port == 80:

from Cryptodome.Protocol.KDF import PBKDF2

from django.utils.crypto import constant_time_compare

from django.utils.encoding import force_bytes

class DecryptionError(Exception):

    key_size = 16

    hmac_size = key_size

        salt = force_bytes(salt)

    iv = hashmod.new(salt).digest()

        if not crypted or not hmac or prf(key, crypted)[:hmac_size] != hmac:

            raise DecryptionError('invalid HMAC')

            salt = force_bytes(salt)

        iv = hashmod.new(salt).digest()

from django.core.validators import RegexValidator

from django.db import IntegrityError, models

from django.db.transaction import atomic

from django.utils.encoding import force_bytes, force_text

from django.utils.translation import ugettext as _

    encoding = None

    def run(self, fd_or_str, encoding):

            input_fd = io.BytesIO(fd_or_str)

            input_fd = io.StringIO(fd_or_str)

        elif not hasattr(fd_or_str, 'read1'):

            try:

                except Exception:

                    pass

                content = fd_or_str.read()

                    input_fd = io.StringIO(content)

                else:

                    input_fd = io.BytesIO(content)

        form.is_valid()

        def get_form_errors(form, name):

        cells = [

            CsvCell(

from django.core.exceptions import MultipleObjectsReturned, ValidationError

from django.core.mail import send_mail

from django.db import models, transaction

from django.utils.translation import ugettext_lazy as _

try:

        return '%s (%s)' % (human_name, short_id)

    def __repr__(self):

    def clean(self):

        if not (self.username or self.email or (self.first_name and self.last_name)):

from django.core.cache import cache as django_cache

from django.core.exceptions import ValidationError

from django.http import Http404, HttpResponse, HttpResponseBadRequest, HttpResponseForbidden

from django.views.debug import technical_404_response

from . import app_settings, middleware

        for i, arg in enumerate(args):

            if self.args and i not in self.args:

                continue

        for kw, arg in sorted(kwargs.items(), key=lambda x: x[0]):

            if kw not in self.kwargs:

                continue

        return u'|'.join(parts)

import logging

from xml.dom.minidom import parseString

from django.conf.urls import url

from django.http import HttpResponseRedirect

from django.urls import reverse

from django.utils.http import urlquote

from django.utils.translation import ugettext as _

from authentic2 import settings

def is_param_id_in_return_url(return_url, returnIDParam):

        return True

    return False

def add_param_to_url(url, param_name, value):

    if query:

        qs[param_name] = [value]

        query = urlparse.urlencode(qs)

    else:

        query = '%s=%s' % (param_name, value)

def disco(request):

import time

from django.core.cache import cache

class ExponentialRetryTimeout(object):

        self.key_prefix = key_prefix

    def key(self, keys):

        key = key.encode('utf-8')

        return '%s%s' % (self.key_prefix or self.KEY_PREFIX, hashlib.md5(key).hexdigest())

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import logging

import operator

import random

from django.db.models import Q

from django.template.loader import render_to_string

from django.urls import reverse

from django.utils.translation import ugettext as _

import authentic2.idp.saml.saml2_endpoints as saml2_endpoints

                queries.append(

                    q.filter(sp_options_policy__isnull=True, liberty_provider__entity_id__in=sessions_eids)

                )

        # do some prefetching

        qs = qs.prefetch_related('liberty_provider')

        qs = qs.select_related('sp_options_policy')

import string

import xml.etree.cElementTree as ctree

from functools import wraps

from django.conf import settings

from django.contrib import messages

from django.http import HttpResponse, HttpResponseBadRequest, HttpResponseForbidden, HttpResponseRedirect

from django.shortcuts import redirect, render

from django.urls import reverse

from django.utils.encoding import force_bytes, force_str, force_text

from django.utils.translation import ugettext as _

from django.utils.translation import ugettext_noop as N_

from django.views.decorators.cache import never_cache

    if not access_granted:

        logger.debug('access denied, return answer to the requester')

        set_saml2_response_responder_status_code(

        )

        return finish_sso(request, login)

import logging

class RequestContextFilter(logging.Filter):

    DEFAULT_USERNAME = '-'

        if not hasattr(record, 'user'):

            if hasattr(request, 'user') and request.user.is_authenticated:

            else:

                record.user = self.DEFAULT_USERNAME

from django.db.models import Count, Q

from django.db.models.functions import Lower

from django.db.transaction import atomic

from django.utils.timezone import localtime

from authentic2 import app_settings

from __future__ import print_function

import logging

from datetime import timedelta

from django.conf import settings

from django.db import transaction

from django.db.models import F

from django.utils import timezone, translation

from authentic2.backends.ldap_backend import LDAPBackend

from authentic2.utils import send_templated_mail

        ctx = {

            'user': user,

            'days_to_deletion': days_to_deletion,

        }

        with transaction.atomic():

            if not self.fake:

from __future__ import print_function

import logging

import re

import sys

from django.contrib.auth import get_user_model

from django.core.management.base import BaseCommand

from ldap.dn import escape_dn_chars

from ldif import LDIFWriter

    def ldap(self, command, attrs):

        self.logger.debug('received command %s %s', command, attrs)

        if command == 'SEARCH':

            ldif_writer = LDIFWriter(out)

            qs = get_user_model().objects.all()

            if attrs['filter'] != '(objectClass=*)':

            for user in qs:

                o = {}

                for user_attribute, ldap_attribute in MAPPING.items():

                o['objectClass'] = ['inetOrgPerson']

                dn = 'uid=%s,%s' % (escape_dn_chars(o['uid'][0]), attrs['suffix'])

                self.logger.debug(u'sending entry %s %s', dn, o)

from django.contrib.auth import get_user_model

from django.contrib.contenttypes.models import ContentType

from django.core.exceptions import ValidationError

from django.utils.text import slugify

from django.utils.translation import pgettext, ugettext

from django.utils.translation import ugettext_lazy as _

    def save(self, commit=True):

        instance = self.instance

        if not instance.slug:

            qs = instance.__class__.objects.all()

            if instance.pk:

                qs = qs.exclude(pk=instance.pk)

            if self.show_all_ou and (len(self.ou_qs) > 1 or self.search_all_ous):

                choices.append(('all', all_ou_label))

            for ou in self.ou_qs:

            if self.show_none_ou and self.search_all_ous:

                choices.append(('none', pgettext('organizational unit', 'None')))

    @staticmethod

    def raise_validation_error(error_message):

        message_prefix = ugettext('Invalid import file')

class UserNewImportForm(UserImportForm):

from django.db import transaction

from django.http import HttpResponseRedirect

from django.urls import reverse

from django.utils.translation import ugettext as _

from django.views.generic import FormView

    @property

    def title(self):

    def authorize(self, request, *args, **kwargs):

        super(OrganizationalUnitDetailView, self).authorize(request, *args, **kwargs)

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from django.contrib.auth import get_user_model

from import_export.fields import Field

from import_export.resources import ModelResource

from import_export.widgets import Widget

        raise NotImplementedError

    def render(self, value, object):

class UserResource(ModelResource):

            result.add(role)

            for pr in role.parent_relation.all():

                result.add(pr.parent)

    class Meta:

        model = User

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from django.contrib import messages

from django.utils.translation import ugettext as _

from authentic2.models import Service

    @property

    def title(self):

    def get_table_queryset(self):

        return self.object.authorized_roles.all()

from django.conf import settings

from django.core.files.storage import default_storage

from django.db import connection

from django.utils.functional import cached_property

from django.utils.timezone import utc

from django.utils.translation import ugettext_lazy as _

                    logger.exception('error during report %s:%s run', self.user_import.uuid, self.uuid)

                    state = self.STATE_ERROR

                    try:

                    except Exception:

                        exception = repr(repr(e))

                else:

from django.forms import MediaDefiningClass

from django.http import Http404, HttpResponse

from django.urls import reverse, reverse_lazy

from django.utils.encoding import force_text

from django.utils.functional import cached_property

from django.utils.timezone import now

        return super(MultipleOUMixin, self).get_context_data(**kwargs)

    '''Expose needed CSS and JS files as a media object'''

    class Media:

    def get_instance_name(self):

        if hasattr(self, 'get_object'):

        return u''

    def get_context_data(self, **kwargs):

                continue

            menu_entries.append(

                {

                    'slug': entry.get('slug', ''),

                }

            )

        return menu_entries

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import base64

import operator

import pickle

from django.contrib.auth import get_user_model

from django.core import signing

from django.utils.encoding import force_text

from django_select2.forms import ModelSelect2MultipleWidget, ModelSelect2Widget

        queries = []

        for term in term.split():

            queries.append(super(SplitTermMixin, self).filter_queryset(term, queryset=qs))

        return qs

    ]

    def label_from_instance(self, obj):

        if obj.ou and utils.get_ou_count() > 1:

            label = u'{ou} - {obj}'.format(ou=obj.ou, obj=obj)

        return label

except ImportError:

    threading = None

from django import http

from django.conf import settings

from django.contrib import messages

from django.utils.deprecation import MiddlewareMixin

from django.utils.functional import SimpleLazyObject

from django.utils.translation import ugettext as _

from . import app_settings, plugins, utils

            return response

        if not getattr(response, 'display_message', True):

            return response

        if not parsed_url.scheme and not parsed_url.netloc:

            return response

        if (parsed_request_url.scheme == parsed_url.scheme or not parsed_url.scheme) and (

            parsed_request_url.netloc == parsed_url.netloc

        ):

import itertools

from django.db.migrations.operations.base import Operation

class CreatePartialIndexes(Operation):

                for clause in where:

                    if isinstance(clause, tuple):

                        clause, params = clause

                        assert isinstance(params, tuple)

                        clause = clause % tuple(schema_editor.quote_value(param) for param in params)

                    clauses.append(clause)

                where_clause = ' AND '.join(clauses)

                # SQLite does not accept parameters in partial index creations, don't ask why :/

import datetime

import time

import uuid

import django

from django.core.exceptions import ValidationError

from django.db import models, transaction

from django.db.models.query import Q

from django.utils.http import urlquote

from django.utils.translation import ugettext_lazy as _

from model_utils.managers import QueryManager

    def get_logout_url(self, request):

        ok_icon_url = (

            + '?nonce=%s' % time.time()

        )

        return self.logout_url.format(urlquote(ok_icon_url))

        verbose_name_plural = _('password reset')

    def __str__(self):

class Service(models.Model):

        return self.name

    def __repr__(self):

    def authorize(self, user):

        if not self.authorized_roles.exists():

        else:

            return _uuid

            _uuid = _uuid.encode('ascii')

            _uuid = base64url_decode(_uuid)

        return uuid.UUID(bytes=_uuid)

import string

from django.core.exceptions import ValidationError

from django.utils.functional import lazy

from django.utils.module_loading import import_string

from django.utils.translation import ugettext as _

    return ''.join(new_password)

    class Check(object):

        def __init__(self, label, result):

            self.label = label

        return ''

from django.contrib import admin, messages

from django.core.exceptions import ValidationError

from django.forms import ModelForm

from django.utils.translation import ugettext as _

try:

    def render(self, name, value, attrs=None, **kwargs):

        if attrs is None:

            attrs = {}

            attrs['rows'] = value.count('\n') + 5

            attrs['cols'] = min(max((len(x) for x in value.split('\n'))), 150)

        return super(TextAndFileWidget, self).render(name, value, attrs, **kwargs)

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import datetime

import logging

import os.path

import re

from django.http import Http404, HttpResponse, HttpResponseRedirect

from django.shortcuts import render

from django.urls import reverse

from django.utils.encoding import force_text

from authentic2.compat_lasso import lasso

        return None

    logger.debug('loaded %d bytes', len(metadata))

    try:

    except UnicodeDecodeError:

        logging.error('SAML metadata autoload: retrieved metadata for entity id %s is not UTF-8', provider_id)

        return None

                        value,

                    )

    if session_not_on_or_afters:

    return None

from django.core.exceptions import ValidationError

from django.db import models

from django.template.defaultfilters import pluralize

from django.utils.encoding import force_bytes, force_text

from django.utils.text import capfirst

# Initial author: Oliver Beattie

    """A subclass of string so it can be told whether a string is

    a pickled object or not (if the object is an instance of this class

    then it must [well, should] be a pickled one)."""

        return MultiSelectFormField(**defaults)

    def get_db_prep_value(self, value, connection, prepared=False):

            return value

        elif isinstance(value, list):

            return ",".join(value)

from __future__ import print_function

import os

import sys

import warnings

from django.core.management.base import BaseCommand, CommandError

from django.db.transaction import atomic

from django.template.defaultfilters import slugify

from django.utils.translation import gettext as _

from authentic2.compat_lasso import lasso

            response = requests.get(metadata_file_path)

            if not response.ok:

                raise CommandError('Unable to open url %s' % metadata_file_path)

        else:

            try:

                with open(metadata_file_path, 'rb') as fd:

            except IOError:

                raise CommandError('Unable to open file %s' % metadata_file_path)

from django.db import models

from django.db.models import Q

from django.db.models.query import QuerySet

from django.utils.encoding import force_str, force_text

from django.utils.translation import ugettext_lazy as _

        return (self.liberty_provider.slug,)

    def __str__(self):

    class Meta:

        verbose_name = _('SAML service provider')

import time

import xml.etree.ElementTree as etree

from django.utils.encoding import force_text

from authentic2.compat_lasso import lasso

def filter_attribute_private_key(message):

        return re.sub(r' (\w+:)?(PrivateKey=")([&#;\w/ +-=])+(")', '', message)

    else:

        return message

def filter_element_private_key(message):

        return re.sub(

            r'(<saml)(p)?(:PrivateKeyFile>-----BEGIN RSA PRIVATE KEY-----)'

            r'([&#;\w/+=\s])+'

import subprocess

import tempfile

_openssl = 'openssl'

def decapsulate_pem_file(file_or_string):

    '''Remove PEM header lines'''

        content = file_or_string.read()

    else:

        content = file_or_string

from django.core.serializers.json import Serializer as JSONSerializer

from django.core.serializers.python import _get_model

from django.db import DEFAULT_DB_ALIAS

class Serializer(JSONSerializer):

    """

    from django.core.serializers.python import Deserializer as PythonDeserializer

        stream_or_string = stream_or_string.read()

    if isinstance(stream_or_string, bytes):

        stream_or_string = stream_or_string.decode('utf-8')

    except GeneratorExit:

        raise

    except Exception as e:

import logging

import random

import time

import uuid

from functools import wraps

from importlib import import_module

from django.template.context import make_context

from django.template.loader import TemplateDoesNotExist, render_to_string, select_template

from django.urls import reverse

from django.utils.encoding import iri_to_uri, uri_to_iri

from django.utils.formats import localize

from django.utils.translation import ungettext

try:

    backends = []

    for backend_path in getattr(app_settings, setting_name):

        kwargs = {}

            backend_path, kwargs = backend_path

        kwargs_settings = getattr(app_settings, setting_name + '_KWARGS', {})

        backend = load_backend(backend_path, kwargs_settings)

def add_arg(url, key, value=None):

    '''Add a parameter to an URL'''

    if value is not None:

    else:

        add = key

    if '?' in url:

def field_names(list_of_field_name_and_titles):

    for t in list_of_field_name_and_titles:

            yield t

        else:

            yield t[0]

def is_valid_url(url):

    try:

        if parsed.scheme in ('http', 'https', ''):

            return True

    except Exception:

    else:

        url = to

    url = iri_to_uri(url)

    fragment = fragment or o_fragment

    # Django < 1.6 compat, query_string is not optional

    url_params = QueryDict(query_string=query_string, mutable=True)

        if request:

            url = request.build_absolute_uri(url)

        elif hasattr(settings, 'SITE_BASE_URL'):

        else:

            raise TypeError('make_url() absolute cannot be used without request')

    # keep using unicode

    # explicitly state that the session has been modified

    request.session.modified = True

    event = {

        'who_id': getattr(request.user, 'pk', None),

        'how': how,

        'when': int(time.time()),

    }

    kwargs = {

        'how': how,

    }

    nonce = nonce or get_nonce(request)

def normalize_attribute_values(values):

    '''Take a list of values or a single one and normalize it'''

    values_set = set()

        values = [values]

    for value in values:

        if isinstance(value, bool):

            value = str(value).lower()

    return values_set

    """

    from .. import middleware

        template_names = [template_names]

    if per_ou_templates and getattr(user_or_email, 'ou', None):

        new_template_names = []

    if good_next_url(request, next_url):

        if replace:

            for key, value in replace.items():

        return next_url

    return default

    If not scheme and not port are given, port compare is skipped.

    The last two rules allow authorizing complete domains easily.

    """

    p1_host, p1_port = netloc_to_host_port(p1.netloc)

    p2_host, p2_port = netloc_to_host_port(p2.netloc)

import ast

from django.utils.translation import ugettext as _

            # set the nearer expr node as the node of the error

            if e.node is None and hasattr(node, 'col_offset'):

                e.set_node(node)

    @lru_cache(maxsize=1024)

    def __call__(self, expression):

            if e.text is None:

                e.text = expression

            e.params = {'expression': expression}

        return compile(tree, expression, mode='eval')

        super(ConditionValidator, self).__init__(

            authorized_nodes=authorized_nodes, forbidden_nodes=forbidden_nodes

        )

    def check_Name(self, node):

        if node.id.startswith('_'):

            raise ExpressionError(

                _('variable is not defined: %s') % e, code='undefined-variable', text=expression, column=0

            )

        if on_raise is not None:

            return on_raise

from __future__ import unicode_literals

from django.utils.encoding import force_text

from django.utils.functional import keep_lazy

from django.utils.text import format_lazy

    return format_lazy(fstring, *args)

def lazy_label(default, func):

    """Allow using a getter for a label, with late binding.

from django.template import loader

from django.template.loader import render_to_string

from django.urls import reverse

from django.utils.translation import ugettext as _

from django.views.decorators.cache import never_cache

from django.views.decorators.csrf import csrf_exempt, ensure_csrf_cookie

                value = filter(None, value)

                value = [html_value(attribute, at_value) for at_value in value]

                if not title:

            else:

                # fallback to model attributes

                try:

                if not isinstance(value, (list, tuple)):

                    value = (value,)

                raw_value = value

            if value or app_settings.A2_PROFILE_DISPLAY_EMPTY_FIELDS:

                profile.append((title, value))

                attributes.append({'attribute': attribute, 'values': raw_value})

import hashlib

import hmac

import json

from django.conf import settings

from django.db import models

from django.utils.encoding import force_bytes, force_text

from django.utils.timezone import now

from django.utils.translation import ugettext_lazy as _

        return None, 'id_token is expired'

    def check_issuer():

        if 'iss' not in payload:

            return False

        try:

        except Exception:

            return False

        return parsed_issuer.scheme == parsed.scheme and parsed_issuer.netloc == parsed.netloc

import json

import logging

import uuid

import requests

from django.shortcuts import render, resolve_url

from django.urls import reverse

from django.utils.http import is_safe_url, urlencode

from django.utils.translation import ugettext as _

from django.views.generic import FormView, View

from requests_oauthlib import OAuth2Session

            redirect_to = resolve_url(settings.LOGIN_REDIRECT_URL)

        # Prevent errors when redirect_to does not contain fc-login-or-link view

        if parsed_redirect_to.path == reverse('fc-login-or-link'):

                REDIRECT_FIELD_NAME, [a2_utils.make_url('auth_homepage')]

            )[0]

        params = {

import requests

from django.contrib.auth import get_user_model

from django.contrib.auth.backends import ModelBackend

from django.utils.timezone import now

from jwcrypto.jwk import JWK

from jwcrypto.jwt import JWT

            jwt = JWT(jwt=original_id_token, key=key_or_keyset, check_claims={}, algs=algs)

            jwt.claims

            logger.warning(

                'auth_oidc: invalid id_token audience %s != provider client_id %s',

                id_token.aud,

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import datetime

import requests

from django.shortcuts import get_object_or_404

from django.utils.timezone import utc

from django.utils.translation import ugettext as _

from jwcrypto.common import JWException, base64url_encode, json_decode

REQUIRED_ID_TOKEN_KEYS = set(['iss', 'sub', 'aud', 'exp', 'iat'])

KEY_TYPES = {

    'exp': int,

    'iat': int,

    'auth_time': int,

    # aud and amr havec specific checks

}

    nonce = None

    def __init__(self, encoded):

            raise IDTokenError(_('Encoded ID Token must be either binary or string data'))

        self._encoded = encoded

            if key == 'amr':

                if not isinstance(decoded['amr'], list):

                    raise IDTokenError(_('invalid amr value: %s') % decoded['amr'])

                    raise IDTokenError(_('invalid amr value: %s') % decoded['amr'])

            elif key in KEY_TYPES:

                if not isinstance(decoded[key], KEY_TYPES[key]):

def check_https(url):

def register_issuer(name, issuer=None, openid_configuration=None, verify=True, timeout=None, ou=None):

def get_openid_configuration_url(issuer):

    if parsed.query or parsed.fragment or parsed.scheme != 'https':

        raise ValueError(

            _('invalid issuer URL, it must use the https:// scheme and not have a ' 'query or fragment')

        )

    return issuer + '/.well-known/openid-configuration'

from django.contrib import messages

from django.core.exceptions import MultipleObjectsReturned

from django.db.transaction import atomic

from django.utils.translation import ugettext as _

from mellon.adapters import DefaultAdapter, UserCreationError

from mellon.utils import get_setting

        super(MappingError, self).__init__(message)