0002-views-allow-adapter-to-force-authentication-55953.patch

Benjamin Dauvergne, 03 août 2021 16:46

Voir les différences: en ligne côte à côte

Subject: [PATCH 2/2] views: allow adapter to force authentication (#55953)

 mellon/utils.py       |  8 ++++++++
 mellon/views.py       |  3 +--
 tests/__init__.py     |  0
 tests/adapters.py     | 19 +++++++++++++++++++
 tests/test_sso_slo.py | 20 +++++++++++++++++---
 tests/test_utils.py   |  2 +-
 tests/test_views.py   |  4 ++--
 testsettings.py       |  2 +-
 8 files changed, 49 insertions(+), 9 deletions(-)
 create mode 100644 tests/__init__.py
 create mode 100644 tests/adapters.py

             auth.login(request, user)
     def should_force_authn(request):
         result = False
         for adapter in get_adapters():
             if hasattr(adapter, 'should_force_authn'):
                 result |= adapter.should_force_authn(request)
         return result
     def get_xml_encoding(content):
         xml_encoding = 'utf-8'

                 # link the nonce to the request-id
                 if 'nonce' in request.GET:
                     self.set_nonce(request.GET['nonce'][:128])
                 if force_authn:
                     authn_request.forceAuthn = True
                 authn_request.forceAuthn = force_authn or utils.should_force_authn(request)
                 if request.GET.get('passive') == '1':
                     authn_request.isPassive = True
                 # configure requested AuthnClassRef

     # django-mellon - SAML2 authentication for Django
     # Copyright (C) 2014-2021 Entr'ouvert
     # This program is free software: you can redistribute it and/or modify
     # it under the terms of the GNU Affero General Public License as
     # published by the Free Software Foundation, either version 3 of the
     # License, or (at your option) any later version.
     # This program is distributed in the hope that it will be useful,
     # but WITHOUT ANY WARRANTY; without even the implied warranty of
     # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     # GNU Affero General Public License for more details.
     # You should have received a copy of the GNU Affero General Public License
     # along with this program.  If not, see <http://www.gnu.org/licenses/>.
     class ShouldForceAuthnAdapter:
         def should_force_authn(self, request):
             return True

             self.session_dump = None
         def process_authn_request_redirect(self, url, auth_result=True, consent=True, msg=None):
             login = lasso.Login(self.server)
             login = self.login = lasso.Login(self.server)
             if self.identity_dump:
                 login.setIdentityFromDump(self.identity_dump)
             if self.session_dump:
-...
+            )
     @pytest.mark.urls('urls_tests_template_base')
     @pytest.mark.urls('tests.urls_tests_template_base')
     def test_template_base(db, app, idp, caplog, sp_settings):
         response = app.get(reverse('mellon_metadata'))
         response = app.get(reverse('mellon_login'))
-...
         assert urlparse.urlparse(response['Location']).path == '/singleLogout'
     @pytest.mark.urls('urls_tests_template_hook')
     @pytest.mark.urls('tests.urls_tests_template_hook')
     def test_template_hook(db, app, idp, caplog, sp_settings):
         response = app.get(reverse('mellon_metadata'))
         response = app.get(reverse('mellon_login'))
-...
         url, body, relay_state = idp.process_authn_request_redirect(response['Location'])
         response = app.post(reverse('mellon_login'), params={'SAMLResponse': body, 'RelayState': relay_state})
         assert app.session['mellon_session']['nonce'] == '1234'
     def test_adapter_should_force_authn(db, app, idp, caplog, sp_settings):
         response = app.get(reverse('mellon_login'))
         idp.process_authn_request_redirect(response['Location'])
         assert not idp.login.request.forceAuthn
         sp_settings.MELLON_ADAPTER = [
             'mellon.adapters.DefaultAdapter',
             'tests.adapters.ShouldForceAuthnAdapter',
+        ]
         response = app.get(reverse('mellon_login'))
         idp.process_authn_request_redirect(response['Location'])
         assert idp.login.request.forceAuthn

     from mellon.utils import create_metadata, iso8601_to_datetime, flatten_datetime
     from mellon.views import check_next_url
     from xml_utils import assert_xml_constraints
     from .xml_utils import assert_xml_constraints
     def test_create_metadata(rf, private_settings, caplog):

     from django.utils.encoding import force_text
     from django.utils.http import urlencode
     from xml_utils import assert_xml_constraints
     from .xml_utils import assert_xml_constraints
     from utils import error_500, html_response
     from .utils import error_500, html_response
     pytestmark = pytest.mark.django_db

testsettings.py
31	31	)
32	32
33	33	AUTHENTICATION_BACKENDS = ('mellon.backends.SAMLBackend',)
34		ROOT_URLCONF = 'urls_tests'
	34	ROOT_URLCONF = 'tests.urls_tests'
35	35	TEMPLATE_DIRS = [
36	36	'tests/templates/',
37	37	]
38		-

Projet

Général

Profil

Produits Entr'ouvert » django-mellon

0002-views-allow-adapter-to-force-authentication-55953.patch