Projet

Général

Profil

0001-views-add-a-VERIFY_SSL_CERTIFICATE-setting.patch

Benjamin Dauvergne, 10 juin 2015 15:09

Télécharger (4,52 ko)

Voir les différences: 

Subject: [PATCH] views: add a VERIFY_SSL_CERTIFICATE setting

It controls the validation of certificates by requests on artifact
resolve requests. It's a global and by idp setting.

Also improve logs in errors paths around when calling the artifact
resolver.

fixes #7521

 Changelog              |  6 ++++++
 README                 |  5 +++++
 mellon/app_settings.py |  1 +
 mellon/views.py        | 34 +++++++++++++++++++++++++++-------
 4 files changed, 39 insertions(+), 7 deletions(-)
Changelog
1 
1.2.x
2 
-----
3 

  		




  
  4
  
    
- add setting MELLON_VERIFY_SSL_CERTIFICATE

  		




  
  5
  
    
- improve logs in SAML artifact error paths

  		




  
  6
  
    

  		




  1
  7
  
    
1.2.16

  		




  2
  8
  
    
------

  		




  3
  9
  
    

  		












  

    
      README
    
  





  241
  241
  
    
Timeout in seconds before automatically redirecting the user to the

  		




  242
  242
  
    
continue URL when authentication has failed. Default is 120 seconds.

  		




  243
  243
  
    

  		




  
  244
  
    
MELLON_VERIFY_SSL_CERTIFICATE

  		




  
  245
  
    
-----------------------------

  		




  
  246
  
    

  		




  
  247
  
    
Verify SSL certificate when doing HTTP requests, used when resolving artifacts.

  		




  
  248
  
    
Default is True.

  		




  244
  249
  
    

  		




  245
  250
  
    
Tests

  		




  246
  251
  
    
=====

  		












  

    
      mellon/app_settings.py
    
  





  26
  26
  
    
            'ERROR_URL': None,

  		




  27
  27
  
    
            'ERROR_REDIRECT_AFTER_TIMEOUT': 120,

  		




  28
  28
  
    
            'DEFAULT_ASSERTION_CONSUMER_BINDING': 'post', # or artifact

  		




  
  29
  
    
            'VERIFY_SSL_CERTIFICATE': True,

  		




  29
  30
  
    
    }

  		




  30
  31
  
    

  		




  31
  32
  
    
    @property

  		












  

    
      mellon/views.py
    
  





  1
  1
  
    
import logging

  		




  2
  2
  
    
import requests

  		




  
  3
  
    
from requests.exceptions import RequestException

  		




  3
  4
  
    

  		




  4
  5
  
    
from django.views.generic import View

  		




  5
  6
  
    
from django.http import HttpResponseBadRequest, HttpResponseRedirect, HttpResponse

  		




  ......




  139
  140
  
    
        return HttpResponseRedirect(next_url)

  		




  140
  141
  
    

  		




  141
  142
  
    
    def continue_sso_artifact_get(self, request):

  		




  142
  
  
    
        login = utils.create_login(request)

  		




  143
  
  
    
        login.initRequest(request.META['QUERY_STRING'], lasso.HTTP_METHOD_ARTIFACT_GET)

  		




  144
  
  
    
        login.buildRequestMsg()

  		




  145
  
  
    

  		




  146
  143
  
    
        idp_message = None

  		




  147
  144
  
    
        status_codes = []

  		




  148
  145
  
    

  		




  149
  
  
    
        result = requests.post(login.msgUrl, data=login.msgBody,

  		




  150
  
  
    
                headers={'content-type': 'text/xml'})

  		




  
  146
  
    
        login = utils.create_login(request)

  		




  
  147
  
    
        try:

  		




  
  148
  
    
            login.initRequest(request.META['QUERY_STRING'], lasso.HTTP_METHOD_ARTIFACT_GET)

  		




  
  149
  
    
        except lasso.ServerProviderNotFoundError:

  		




  
  150
  
    
            self.log.warning('no entity id found for artifact %s',

  		




  
  151
  
    
                             request.GET['SAMLart'])

  		




  
  152
  
    
            return HttpResponseBadRequest(

  		




  
  153
  
    
                'no entity id found for this artifact %r' %

  		




  
  154
  
    
                request.GET['SAMLart'])

  		




  
  155
  
    
        idp = utils.get_idp(login.remoteProviderId)

  		




  
  156
  
    
        if not idp:

  		




  
  157
  
    
            self.log.warning('entity id %r is unknown', login.remoteProviderId)

  		




  
  158
  
    
            return HttpResponseBadRequest(

  		




  
  159
  
    
                'entity id %r is unknown' % login.remoteProviderId)

  		




  
  160
  
    
        verify_ssl_certificate = utils.get_setting(

  		




  
  161
  
    
            idp, 'VERIFY_SSL_CERTIFICATE')

  		




  
  162
  
    
        login.buildRequestMsg()

  		




  
  163
  
    
        try:

  		




  
  164
  
    
            result = requests.post(login.msgUrl, data=login.msgBody,

  		




  
  165
  
    
                headers={'content-type': 'text/xml'},

  		




  
  166
  
    
                verify=verify_ssl_certificate)

  		




  
  167
  
    
        except RequestException, e:

  		




  
  168
  
    
            self.log.warning('unable to reach %r: %s', login.msgUrl, e)

  		




  
  169
  
    
            return HttpResponseBadRequest('unable to reach %r: %s' % (login.msgUrl, e))

  		




  151
  170
  
    
        if result.status_code != 200:

  		




  152
  171
  
    
            self.log.warning('SAML authentication failed: '\

  		




  153
  
  
    
                             'IdP returned %s when given artifact' % result.status_code)

  		




  
  172
  
    
                             'IdP returned %s when given artifact', result.status_code)

  		




  154
  173
  
    
            return self.sso_failure(request, login, idp_message, status_codes)

  		




  155
  174
  
    

  		




  156
  175
  
    
        try:

  		




  ......




  174
  193
  
    
                args.append(status.statusMessage)

  		




  175
  194
  
    
            self.log.warning(*args)

  		




  176
  195
  
    
        except lasso.Error, e:

  		




  
  196
  
    
            self.log.exception('unexpected lasso error')

  		




  177
  197
  
    
            return HttpResponseBadRequest('error processing the authentication '

  		




  178
  198
  
    
                    'response: %r' % e)

  		




  179
  199
  
    
        else:

  		




  180
  
  
    
-