Revision a5f39ab1
Added by Serghei Mihai about 10 years ago
| ckanext/ozwillo_pyoidc/plugin.py | ||
|---|---|---|
| 1 | 1 |
import logging |
| 2 |
import conf |
|
| 2 | 3 |
|
| 3 | 4 |
import ckan.plugins as plugins |
| 4 | 5 |
import ckan.plugins.toolkit as toolkit |
| 5 |
from ckan.common import session |
|
| 6 |
from ckan.common import session, c, request |
|
| 7 |
from ckan import model |
|
| 6 | 8 |
import ckan.lib.base as base |
| 7 | 9 |
|
| 8 | 10 |
from pylons import config, request |
| 9 | 11 |
|
| 10 | 12 |
from oidc import OIDCClients |
| 11 | 13 |
|
| 12 |
import conf |
|
| 13 |
|
|
| 14 |
from oic.oic import Client, AuthorizationRequest |
|
| 15 |
from oic.utils.authn.client import CLIENT_AUTHN_METHOD |
|
| 16 |
|
|
| 17 | 14 |
plugin_config_prefix = 'ckanext.ozwillo_pyoidc.' |
| 18 | 15 |
|
| 19 | 16 |
log = logging.getLogger(__name__) |
| 17 |
plugin_controller = 'ckanext.ozwillo_pyoidc.plugin:OpenidController' |
|
| 20 | 18 |
|
| 21 |
Client = OIDCClients(conf)['ozwillo'] |
|
| 22 |
|
|
| 23 |
def openid_callback(context, data): |
|
| 24 |
print context |
|
| 25 |
print data |
|
| 19 |
CLIENT = None |
|
| 26 | 20 |
|
| 27 | 21 |
class OzwilloPyoidcPlugin(plugins.SingletonPlugin): |
| 28 | 22 |
plugins.implements(plugins.IConfigurer) |
| 29 | 23 |
plugins.implements(plugins.IRoutes) |
| 30 | 24 |
plugins.implements(plugins.IAuthenticator, inherit=True) |
| 31 | 25 |
|
| 32 |
def __init__(self, name=None): |
|
| 33 |
self.client = Client |
|
| 34 |
|
|
| 35 | 26 |
def before_map(self, map): |
| 36 |
map.redirect('/organization/{id:.*}/sso', '/user/login')
|
|
| 37 |
map.connect('/openid/callback',
|
|
| 38 |
controller='ckanext.ozwillo_pyoidc.plugin:OpenidController', |
|
| 39 |
action='openid_callback') |
|
| 27 |
map.connect('/organization/{id:.*}/sso',
|
|
| 28 |
controller=plugin_controller, |
|
| 29 |
action='sso') |
|
| 30 |
map.connect('/organization/{id:.*}/callback',
|
|
| 31 |
controller=plugin_controller, |
|
| 32 |
action='callback') |
|
| 40 | 33 |
return map |
| 41 | 34 |
|
| 42 | 35 |
def after_map(self, map): |
| 43 | 36 |
return map |
| 44 | 37 |
|
| 45 | 38 |
def identify(self): |
| 46 |
# must set toolkit.c.user |
|
| 47 |
pass |
|
| 39 |
user = session.get('user')
|
|
| 40 |
if user and not toolkit.c.userobj: |
|
| 41 |
userobj = model.User.get(user) |
|
| 42 |
toolkit.c.user = userobj.name |
|
| 43 |
toolkit.c.userobj = userobj |
|
| 48 | 44 |
|
| 49 | 45 |
def login(self): |
| 50 |
url, ht_args = self.client.create_authn_request(session, conf.ACR_VALUES) |
|
| 51 |
if ht_args: |
|
| 52 |
toolkit.request.headers.update(ht_args) |
|
| 53 |
toolkit.redirect_to(url) |
|
| 46 |
global CLIENT |
|
| 47 |
if 'organization_id' in session: |
|
| 48 |
g = model.Group.get(session['organization_id']) |
|
| 49 |
conf.CLIENTS['ozwillo']['client_registration'].update({
|
|
| 50 |
'client_id': g._extras['client_id'].value, |
|
| 51 |
'client_secret': g._extras['client_secret'].value, |
|
| 52 |
'redirect_uris': [toolkit.url_for(host=request.host, |
|
| 53 |
controller=plugin_controller, |
|
| 54 |
action='callback', |
|
| 55 |
id=g.name, |
|
| 56 |
qualified=True)] |
|
| 57 |
}) |
|
| 58 |
log.info('registration info for organization "%s" set' % g.name)
|
|
| 59 |
CLIENT = OIDCClients(conf)['ozwillo'] |
|
| 60 |
url, ht_args = CLIENT.create_authn_request(session, conf.ACR_VALUES) |
|
| 61 |
if ht_args: |
|
| 62 |
toolkit.request.headers.update(ht_args) |
|
| 63 |
toolkit.redirect_to(url) |
|
| 64 |
else: |
|
| 65 |
toolkit.redirect_to('/')
|
|
| 54 | 66 |
|
| 55 | 67 |
def logout(self): |
| 56 | 68 |
# revoke all auth tokens |
| 57 | 69 |
# redirect to logout in ozwillo |
| 58 |
revoke_endpoint = 'https://portal.ozwillo-preprod.eu/a/revoke' |
|
| 59 |
toolkit.redirect('/user/_logout')
|
|
| 70 |
# revoke_endpoint = 'https://portal.ozwillo-preprod.eu/a/revoke' |
|
| 71 |
# toolkit.redirect('/user/_logout')
|
|
| 72 |
pass |
|
| 60 | 73 |
|
| 61 | 74 |
def update_config(self, config_): |
| 62 | 75 |
toolkit.add_template_directory(config_, 'templates') |
| ... | ... | |
| 65 | 78 |
|
| 66 | 79 |
class OpenidController(base.BaseController): |
| 67 | 80 |
|
| 68 |
def openid_callback(self): |
|
| 69 |
userinfo = Client.callback(request.GET) |
|
| 70 |
return "userinfo: %s" % userinfo |
|
| 81 |
def sso(self, id): |
|
| 82 |
log.info('SSO for organization "%s"' % id)
|
|
| 83 |
session['organization_id'] = id |
|
| 84 |
session.save() |
|
| 85 |
log.info('redirecting to login page')
|
|
| 86 |
login_url = toolkit.url_for(host=request.host, |
|
| 87 |
controller='user', |
|
| 88 |
action='login', |
|
| 89 |
qualified=True) |
|
| 90 |
toolkit.redirect_to(login_url) |
|
| 91 |
|
|
| 92 |
def callback(self): |
|
| 93 |
global CLIENT |
|
| 94 |
if CLIENT: |
|
| 95 |
userinfo = CLIENT.callback(request.GET) |
|
| 96 |
log.info('Received userinfo: %s' % userinfo)
|
|
| 97 |
userobj = model.User.get(userinfo['nickname']) |
|
| 98 |
if userobj: |
|
| 99 |
userobj.email = userinfo['email'] |
|
| 100 |
if 'given_name' in userinfo: |
|
| 101 |
userobj.fullname = userinfo['given_name'] |
|
| 102 |
if 'family_name' in userinfo: |
|
| 103 |
userobj.fullname += userinfo['family_name'] |
|
| 104 |
userobj.save() |
|
| 105 |
session['user'] = userobj.id |
|
| 106 |
session.save() |
|
| 107 |
|
|
| 108 |
org_url = toolkit.url_for(host=request.host, |
|
| 109 |
controller="organization", |
|
| 110 |
action='read', |
|
| 111 |
id=session['organization_id'], |
|
| 112 |
qualified=True) |
|
| 113 |
toolkit.redirect_to(org_url) |
|
Also available in: Unified diff
retreiving user, update its infos, log in