From 4f840dc1b72c61df3977d664a72a5a101cd9b9cf Mon Sep 17 00:00:00 2001
From: Valentin Deniaud <vdeniaud@entrouvert.com>
Date: Thu, 27 Oct 2022 13:44:43 +0200
Subject: [PATCH] authenticators: add idp configuration info for saml and oidc
 (#67987)

---
 .../authenticator_add_form.html               | 12 +++++
 .../authenticators/authenticator_detail.html  | 10 ++++
 .../authenticators/templatetags/__init__.py   |  0
 .../templatetags/authenticator_extras.py      | 10 ++++
 src/authentic2_auth_oidc/models.py            |  1 +
 .../idp_configuration_info.html               |  8 ++++
 src/authentic2_auth_saml/models.py            |  1 +
 .../idp_configuration_info.html               | 25 ++++++++++
 tests/test_manager_authenticators.py          | 47 ++++++++++++++++++-
 9 files changed, 113 insertions(+), 1 deletion(-)
 create mode 100644 src/authentic2/apps/authenticators/templatetags/__init__.py
 create mode 100644 src/authentic2/apps/authenticators/templatetags/authenticator_extras.py
 create mode 100644 src/authentic2_auth_oidc/templates/authentic2_auth_oidc/idp_configuration_info.html
 create mode 100644 src/authentic2_auth_saml/templates/authentic2_auth_saml/idp_configuration_info.html

diff --git a/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_add_form.html b/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_add_form.html
index f6aa9043a..7cbf26821 100644
--- a/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_add_form.html
+++ b/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_add_form.html
@@ -10,6 +10,15 @@
   <form method="post" enctype="multipart/form-data">
     {% csrf_token %}
     {{ form|with_template }}
+
+    {% for authenticator in form.authenticators.values %}
+      {% if authenticator.manager_idp_info_template_name %}
+        <div class="infonotice {{ authenticator.type }} idp-info">
+          {% include authenticator.manager_idp_info_template_name %}
+        </div>
+      {% endif %}
+    {% endfor %}
+
     <div class="buttons">
       <button>{% trans "Add" %}</button>
       <a class="cancel" href="{% url 'a2-manager-authenticators' %}">{% trans 'Cancel' %}</a>
@@ -19,8 +28,11 @@
         $('div#authenticator span.required').remove();
         name_field = $('div#id_name_p');
         $('select#id_authenticator').change(function() {
+          $('div.idp-info').hide();
+          $('div.idp-info.' + this.value).show();
           if(this.value == 'saml' || this.value == 'oidc') {
             name_field.show();
+            $('div#' + this.value + '-idp-info').show();
             $('input#id_name').prop('required', true);
           } else {
             name_field.hide();
diff --git a/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html b/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html
index a368a10bc..d65b930ec 100644
--- a/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html
+++ b/src/authentic2/apps/authenticators/templates/authentic2/authenticators/authenticator_detail.html
@@ -36,6 +36,9 @@
     <div class="pk-tabs">
       <div class="pk-tabs--tab-list" role="tablist">
         <button aria-controls="panel-description" aria-selected="true" id="tab-description" role="tab" tabindex="0">{% trans "Description" %}</button>
+        {% if object.manager_idp_info_template_name %}
+          <button aria-controls="panel-config-info" aria-selected="true" id="tab-config-info" role="tab" tabindex="0">{% trans "Information for configuration" %}</button>
+        {% endif %}
         {% for model in object.related_models %}
           <button aria-controls="panel-{{ model.model_name }}" aria-selected="false" id="tab-{{ model.model_name }}" role="tab" tabindex="-1">{{ model.verbose_name_plural }}</button>
         {% endfor %}
@@ -51,6 +54,13 @@
             {% endfor %}
           </ul>
         </div>
+
+        {% if object.manager_idp_info_template_name %}
+          <div aria-labelledby="tab-config-info" id="panel-config-info" role="tabpanel" tabindex="0">
+            {% include object.manager_idp_info_template_name %}
+          </div>
+        {% endif %}
+
         {% for model, objects in object.related_models.items %}
           <div aria-labelledby="tab-{{ model.model_name }}" hidden="" id="panel-{{ model.model_name }}" role="tabpanel" tabindex="0">
             <p>{{ model.description }}</p>
diff --git a/src/authentic2/apps/authenticators/templatetags/__init__.py b/src/authentic2/apps/authenticators/templatetags/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/src/authentic2/apps/authenticators/templatetags/authenticator_extras.py b/src/authentic2/apps/authenticators/templatetags/authenticator_extras.py
new file mode 100644
index 000000000..240eb275d
--- /dev/null
+++ b/src/authentic2/apps/authenticators/templatetags/authenticator_extras.py
@@ -0,0 +1,10 @@
+from django import template
+
+from authentic2.utils.misc import make_url
+
+register = template.Library()
+
+
+@register.simple_tag(takes_context=True)
+def absolute_url(context, view_name, *args, **kwargs):
+    return make_url(view_name, request=context['request'], absolute=True)
diff --git a/src/authentic2_auth_oidc/models.py b/src/authentic2_auth_oidc/models.py
index 06ac05210..80d982ddc 100644
--- a/src/authentic2_auth_oidc/models.py
+++ b/src/authentic2_auth_oidc/models.py
@@ -123,6 +123,7 @@ class OIDCProvider(BaseAuthenticator):
 
     type = 'oidc'
     how = ['oidc']
+    manager_idp_info_template_name = 'authentic2_auth_oidc/idp_configuration_info.html'
     description_fields = ['show_condition', 'issuer', 'scopes', 'strategy', 'created', 'modified']
 
     class Meta:
diff --git a/src/authentic2_auth_oidc/templates/authentic2_auth_oidc/idp_configuration_info.html b/src/authentic2_auth_oidc/templates/authentic2_auth_oidc/idp_configuration_info.html
new file mode 100644
index 000000000..0dcd75616
--- /dev/null
+++ b/src/authentic2_auth_oidc/templates/authentic2_auth_oidc/idp_configuration_info.html
@@ -0,0 +1,8 @@
+{% load i18n authenticator_extras %}
+
+<strong>{% trans "Configuration information for your identity provider" %}</strong>
+<ul>
+  {% filter urlize %}
+    <li>{% trans "Redirect URI (redirect_uri):" %} {% absolute_url 'oidc-login-callback' %}</li>
+    <li>{% trans "Redirect URI after logout (post_logout_redirect_uri):" %} {% absolute_url 'auth_logout' %}</li>
+  {% endfilter %}
diff --git a/src/authentic2_auth_saml/models.py b/src/authentic2_auth_saml/models.py
index ce8113877..2f0945d50 100644
--- a/src/authentic2_auth_saml/models.py
+++ b/src/authentic2_auth_saml/models.py
@@ -177,6 +177,7 @@ class SAMLAuthenticator(BaseAuthenticator):
     type = 'saml'
     how = ['saml']
     manager_view_template_name = 'authentic2_auth_saml/authenticator_detail.html'
+    manager_idp_info_template_name = 'authentic2_auth_saml/idp_configuration_info.html'
     description_fields = ['show_condition', 'metadata_url', 'metadata', 'provision']
 
     class Meta:
diff --git a/src/authentic2_auth_saml/templates/authentic2_auth_saml/idp_configuration_info.html b/src/authentic2_auth_saml/templates/authentic2_auth_saml/idp_configuration_info.html
new file mode 100644
index 000000000..a3ba80804
--- /dev/null
+++ b/src/authentic2_auth_saml/templates/authentic2_auth_saml/idp_configuration_info.html
@@ -0,0 +1,25 @@
+{% load i18n authenticator_extras %}
+
+<strong>{% trans "Configuration information for your identity provider" %}</strong>
+<ul>
+  {% filter urlize %}
+    <li>{% trans "Metadata URL:" %} {% absolute_url 'mellon_metadata' %}</li>
+  {% endfilter %}
+  {% if object and object.set_attribute_actions.all %}
+    <li>{% trans "Expected attributes:" %}
+      <ul>
+        {% for attribute in object.set_attribute_actions.all %}
+          <li>{{ attribute.saml_attribute }}{% if attribute.mandatory %} ({% trans "mandatory" %}){% endif %}</li>
+        {% endfor %}
+      </ul>
+    </li>
+  {% else %}
+    <li>{% trans "Commonly expected attributes:" %}
+      <ul>
+        <li>{% trans "Email (email)" %}</li>
+        <li>{% trans "First name (first_name)" %}</li>
+        <li>{% trans "Last name (last_name)" %}</li>
+      </ul>
+    </li>
+  {% endif %}
+  <ul>
diff --git a/tests/test_manager_authenticators.py b/tests/test_manager_authenticators.py
index e60b09e18..afe4eb656 100644
--- a/tests/test_manager_authenticators.py
+++ b/tests/test_manager_authenticators.py
@@ -606,7 +606,7 @@ def test_authenticators_saml_attribute_lookup(app, superuser):
 
     resp = resp.click('Remove', href='samlattributelookup')
     resp = resp.form.submit().follow()
-    assert 'mail' not in resp.text
+    assert 'Test (test)' not in resp.text
     assert_event('authenticator.related_object.deletion', user=superuser, session=app.session)
 
 
@@ -718,3 +718,48 @@ def test_authenticators_add_last(app, superuser):
 
     authenticator = SAMLAuthenticator.objects.filter(slug='test-2').get()
     assert authenticator.order == 43
+
+
+def test_authenticators_configuration_info(app, superuser, ou1, ou2):
+    resp = login(app, superuser, path='/manage/authenticators/')
+
+    resp = resp.click('Add new authenticator')
+    assert resp.text.count('infonotice') == 2
+    assert '<div class="infonotice saml idp-info">' in resp.text
+    assert '<div class="infonotice oidc idp-info">' in resp.text
+    assert resp.text.count('Configuration information for your identity provider') == 2
+
+    # saml
+    assert (
+        'Metadata URL: <a href="http://testserver/accounts/saml/metadata/" rel="nofollow">'
+        'http://testserver/accounts/saml/metadata/</a>'
+    ) in resp.text
+    assert 'Commonly expected attributes:' in resp.text
+    assert 'Email (email)' in resp.text
+
+    authenticator = SAMLAuthenticator.objects.create(metadata='meta1.xml', slug='idp1')
+    SetAttributeAction.objects.create(
+        authenticator=authenticator, user_field='email', saml_attribute='mail', mandatory=True
+    )
+    SetAttributeAction.objects.create(
+        authenticator=authenticator, user_field='first_name', saml_attribute='given_name'
+    )
+
+    resp = app.get('/manage/authenticators/%s/detail/' % authenticator.pk)
+    assert 'Information for configuration' in resp.text
+    assert 'Expected attributes' in resp.text
+    assert 'mail (mandatory)' in resp.text
+    assert 'given_name' in resp.text
+
+    # oidc
+    authenticator = OIDCProvider.objects.create(slug='idp2')
+    for url in ('/manage/authenticators/add/', '/manage/authenticators/%s/detail/' % authenticator.pk):
+        resp = app.get(url)
+        assert (
+            'Redirect URI (redirect_uri): <a href="http://testserver/accounts/oidc/callback/" '
+            'rel="nofollow">http://testserver/accounts/oidc/callback/</a>'
+        ) in resp.text
+        assert (
+            'Redirect URI after logout (post_logout_redirect_uri): <a href="http://testserver/logout/" '
+            'rel="nofollow">http://testserver/logout/</a>'
+        ) in resp.text
-- 
2.35.1