Projet

Général

Profil

0001-views-add-a-VERIFY_SSL_CERTIFICATE-setting.patch

Benjamin Dauvergne, 10 juin 2015 11:51

Télécharger (3,35 ko)

Voir les différences: 

Subject: [PATCH] views: add a VERIFY_SSL_CERTIFICATE setting

It controls the validation of certificates by requests on artifact
resolve requests. It's a global and by idp setting.

fixes #7521

 README                 |  5 +++++
 mellon/app_settings.py |  1 +
 mellon/views.py        | 25 ++++++++++++++++++-------
 3 files changed, 24 insertions(+), 7 deletions(-)
README
241 241 
Timeout in seconds before automatically redirecting the user to the
242 242 
continue URL when authentication has failed. Default is 120 seconds.
243 243 

  		




  
  244
  
    
MELLON_VERIFY_SSL_CERTIFICATE

  		




  
  245
  
    
-----------------------------

  		




  
  246
  
    

  		




  
  247
  
    
Verify SSL certificate when doing HTTP requests, used when resolving artifacts.

  		




  
  248
  
    
Default is True.

  		




  244
  249
  
    

  		




  245
  250
  
    
Tests

  		




  246
  251
  
    
=====

  		












  

    
      mellon/app_settings.py
    
  





  26
  26
  
    
            'ERROR_URL': None,

  		




  27
  27
  
    
            'ERROR_REDIRECT_AFTER_TIMEOUT': 120,

  		




  28
  28
  
    
            'DEFAULT_ASSERTION_CONSUMER_BINDING': 'post', # or artifact

  		




  
  29
  
    
            'VERIFY_SSL_CERTIFICATE': True,

  		




  29
  30
  
    
    }

  		




  30
  31
  
    

  		




  31
  32
  
    
    @property

  		












  

    
      mellon/views.py
    
  





  20
  20
  
    
        super(LogMixin, self).__init__(*args, **kwargs)

  		




  21
  21
  
    

  		




  22
  22
  
    
class LoginView(LogMixin, View):

  		




  23
  
  
    
    def get_idp(self, request):

  		




  24
  
  
    
        entity_id = request.REQUEST.get('entity_id')

  		




  
  23
  
    
    def get_idp(self, request, entity_id=None):

  		




  
  24
  
    
        if entity_id is None:

  		




  
  25
  
    
            entity_id = request.REQUEST.get('entity_id')

  		




  25
  26
  
    
        if not entity_id:

  		




  26
  27
  
    
            return next(utils.get_idps())

  		




  27
  28
  
    
        else:

  		




  ......




  139
  140
  
    
        return HttpResponseRedirect(next_url)

  		




  140
  141
  
    

  		




  141
  142
  
    
    def continue_sso_artifact_get(self, request):

  		




  142
  
  
    
        login = utils.create_login(request)

  		




  143
  
  
    
        login.initRequest(request.META['QUERY_STRING'], lasso.HTTP_METHOD_ARTIFACT_GET)

  		




  144
  
  
    
        login.buildRequestMsg()

  		




  145
  
  
    

  		




  146
  143
  
    
        idp_message = None

  		




  147
  144
  
    
        status_codes = []

  		




  148
  145
  
    

  		




  
  146
  
    
        login = utils.create_login(request)

  		




  
  147
  
    
        try:

  		




  
  148
  
    
            login.initRequest(request.META['QUERY_STRING'], lasso.HTTP_METHOD_ARTIFACT_GET)

  		




  
  149
  
    
        except lasso.ServerProviderNotFoundError:

  		




  
  150
  
    
            return HttpResponseBadRequest(

  		




  
  151
  
    
                'no entity id found for this artifact %r' %

  		




  
  152
  
    
                request.GET['SAMLart'])

  		




  
  153
  
    
        idp = utils.get_idp(login.remoteProviderId)

  		




  
  154
  
    
        if not idp:

  		




  
  155
  
    
            return HttpResponseBadRequest(

  		




  
  156
  
    
                'entity id %r is unknown' % login.remoteProviderId)

  		




  
  157
  
    
        verify_ssl_certificate = utils.get_setting(

  		




  
  158
  
    
            idp, 'VERIFY_SSL_CERTIFICATE')

  		




  
  159
  
    
        login.buildRequestMsg()

  		




  149
  160
  
    
        result = requests.post(login.msgUrl, data=login.msgBody,

  		




  150
  
  
    
                headers={'content-type': 'text/xml'})

  		




  
  161
  
    
                headers={'content-type': 'text/xml'}, verify=verify_ssl_certificate)

  		




  151
  162
  
    
        if result.status_code != 200:

  		




  152
  163
  
    
            self.log.warning('SAML authentication failed: '\

  		




  153
  164
  
    
                             'IdP returned %s when given artifact' % result.status_code)

  		




  154
  
  
    
-