Produits Entr'ouvert » Larpe

import libxml2

import urllib

import urlparse

import httplib

from quixote import get_field, get_request, get_response, get_session, get_session_manager, redirect

from quixote.directory import Directory

from quixote.http_request import parse_header

import lasso

import logger

import misc

import storage

from form import *

from template import *

from users import User

class RootDirectory(Directory):

    _q_exports = ["", "login", "assertionConsumer", "soapEndpoint",

            "singleLogout", "singleLogoutReturn",

            "federationTermination", "federationTerminationReturn",

            ('metadata.xml', 'metadata'), 'public_key']

    def perform_login(self, idp = None):

        server = misc.get_lasso_server()

        login = lasso.Login(server)

        login.initAuthnRequest(idp, lasso.HTTP_METHOD_REDIRECT)

        login.request.nameIdPolicy = "federated"

        login.request.forceAuthn = False

        login.request.isPassive = False

        login.request.consent = "urn:liberty:consent:obtained"

        login.buildAuthnRequestMsg()

        return redirect(login.msgUrl)

    def assertionConsumer(self):

        server = misc.get_lasso_server()

        if not server:

            return error_page(_('Liberty support is not yet configured'))

        login = lasso.Login(server)

        request = get_request()

        if request.get_method() == 'GET' or get_field('LAREQ'):

            if request.get_method() == 'GET':

                login.initRequest(request.get_query(), lasso.HTTP_METHOD_REDIRECT)

            else:

                login.initRequest(get_field('LAREQ'), lasso.HTTP_METHOD_POST)

            login.buildRequestMsg()

            try:

                soap_answer = soap_call(login.msgUrl, login.msgBody)

            except SOAPException:

                return error_page(_("Failure to communicate with identity provider"))

            try:

                login.processResponseMsg(soap_answer)

            except lasso.Error, error:

                if error[0] == lasso.LOGIN_ERROR_STATUS_NOT_SUCCESS:

                    return error_page(_('Unknown authentication failure'))

                if hasattr(lasso, 'LOGIN_ERROR_UNKNOWN_PRINCIPAL'):

                    if error[0] == lasso.LOGIN_ERROR_UNKNOWN_PRINCIPAL:

                        return error_page(_('Authentication failure; unknown principal'))

                return error_page(_("Identity Provider didn't accept artifact transaction."))

        else:

            login.processAuthnResponseMsg(get_field('LARES'))

        login.acceptSso()

        session = get_session()

        if login.isSessionDirty:

            if login.session:

                session.lasso_session_dump = login.session.dump()

            else:

                session.lasso_session_dump = None

        user = self.lookup_user(session, login)

        if user:

            session.set_user(user.id)

        else:

            session.set_user('anonymous-%s' % login.nameIdentifier.content)

            session.lasso_anonymous_identity_dump = login.identity.dump()

        response = get_response()

        if session.after_url:

            after_url = session.after_url

            session.after_url = None

            return redirect(after_url)

        response.set_status(303)

        response.headers['location'] = urlparse.urljoin(request.get_url(), str('..'))

        response.content_type = 'text/plain'

        return "Your browser should redirect you"

    def lookup_user(self, session, login):

        ni = login.nameIdentifier.content

        session.name_identifier = ni

        nis = list(User.select(lambda x: ni in x.name_identifiers))

        if nis:

            user = nis[0]

        else:

            if lasso.WSF_SUPPORT and misc.cfg.get('misc', {}).get('grab-user-with-wsf', False):

                disco = lasso.Discovery(login.server)

                disco.setSessionFromDump(session.lasso_session_dump)

                try:

                    disco.initQuery()

                except lasso.Error, error:

                    pass # XXX: there is no defined error code on lasso side

                    service = None

                else:

                    disco.addRequestedServiceType(lasso.PP_HREF)

                    disco.buildRequestMsg()

                    soap_answer = soap_call(disco.msgUrl, disco.msgBody)

                    disco.processQueryResponseMsg(soap_answer)

                    service = disco.getService()

                if not service:

                    return None

                service.initQuery('/pp:PP/pp:InformalName', 'name')

                service.addQueryItem('/pp:PP/pp:MsgContact', 'email')

                service.buildRequestMsg()

                try:

                    soap_answer = soap_call(service.msgUrl, service.msgBody)

                except SOAPException:

                    # it was advertised, it didn't work, too bad.

                    return None

                service.processQueryResponseMsg(soap_answer)

                email, name = None, None

                emailNode = service.getAnswer('/pp:PP/pp:MsgContact')

                if emailNode:

                    # horrible <MsgContact>; rebuild email

                    doc = libxml2.parseDoc(emailNode)

                    node = doc.children.children

                    account, provider = None, None

                    while node:

                        if node.name == 'MsgAccount':

                            account = node.getContent()

                        if node.name == 'MsgProvider':

                            provider = node.getContent()

                        node = node.next

                    if account and provider:

                        email = '%s@%s' % (account, provider)

                    else:

                        email = ''

                nameNode = service.getAnswer('/pp:PP/pp:InformalName')

                if nameNode:

                    doc = libxml2.parseDoc(nameNode)

                    name = unicode(doc.getContent(), 'utf-8').encode('iso-8859-1')

                if email and name:

                    user = User()

                    user.email = email

                    user.name = name

                    user.name_identifiers.append(login.nameIdentifier.content)

                    user.lasso_dump = login.identity.dump()

                    user.store()

                    return user

            return None

        user.lasso_dump = login.identity.dump()

        user.store()

        return user

    def singleLogout(self):

        request = get_request()

        logout = lasso.Logout(misc.get_lasso_server())

        if lasso.isLibertyQuery(request.get_query()):

            request = get_request()

            try:

                logout.processRequestMsg(request.get_query())

            except lasso.Error, error:

                if error[0] == lasso.DS_ERROR_INVALID_SIGNATURE:

                    return error_page(_('Failed to check single logout request signature.'))

                raise

            return self.slo_idp(logout, get_session())

        else:

            return self.slo_sp(logout, get_session())

    def singleLogoutReturn(self):

        logout = lasso.Logout(misc.get_lasso_server())

        try:

            logout.processResponseMsg(get_request().get_query())

        except lasso.Error, error:

            if error[0] == lasso.PROFILE_ERROR_INVALID_QUERY:

                raise AccessError()

            if error[0] == lasso.DS_ERROR_INVALID_SIGNATURE:

                return error_page(_('Failed to check single logout request signature.'))

            if hasattr(lasso, 'LOGOUT_ERROR_REQUEST_DENIED') and \

                    error[0] == lasso.LOGOUT_ERROR_REQUEST_DENIED:

                return redirect('/') # ignore silently

            elif error[0] == lasso.ERROR_UNDEFINED:

                # XXX: unknown status; ignoring for now.

                return redirect('/') # ignore silently

            raise

        return redirect('/')

    def slo_idp(self, logout, session):

        # Single Logout initiated by IdP

        if session.lasso_session_dump:

            logout.setSessionFromDump(session.lasso_session_dump)

        user = get_request().user

        if user and user.lasso_dump:

            logout.setIdentityFromDump(user.lasso_dump)

        if logout.nameIdentifier.content != session.name_identifier:

            raise "no appropriate name identifier in session (%s and %s)" % (

                    logout.nameIdentifier.content, session.name_identifier)

        try:

            logout.validateRequest()

        except lasso.Error, error:

            if error[0] != lasso.PROFILE_ERROR_SESSION_NOT_FOUND:

                raise

        else:

            del get_session_manager()[session.id]

            get_session_manager().expire_session() 

        logout.buildResponseMsg()

        if logout.msgBody: # soap answer

            return logout.msgBody

        else:

            return redirect(logout.msgUrl)

    def slo_sp(self, logout, session):

        if not session.user:

            get_session_manager().expire_session()

            return redirect('/')

        if session.lasso_session_dump:

            logout.setSessionFromDump(session.lasso_session_dump)

        user = get_request().user

        if user and user.lasso_dump:

            logout.setIdentityFromDump(user.lasso_dump)

        return self.slo_sp_redirect(logout)

    def slo_sp_redirect(self, logout):

        try:

            logout.initRequest(None, lasso.HTTP_METHOD_REDIRECT)

        except lasso.Error, error:

            if error[0] == lasso.PROFILE_ERROR_NAME_IDENTIFIER_NOT_FOUND:

                get_session_manager().expire_session() 

                return redirect('/')

            raise

        logout.buildRequestMsg()

        get_session_manager().expire_session() 

        return redirect(logout.msgUrl)

    def soapEndpoint(self):

        request = get_request()

        ctype = request.environ.get("CONTENT_TYPE")

        if not ctype:

            return

        ctype, ctype_params = parse_header(ctype)

        if ctype != 'text/xml':

            return

        response = get_response()

        response.set_content_type('text/xml')

        length = int(request.environ.get('CONTENT_LENGTH'))

        soap_message = request.stdin.read(length)

        request_type = lasso.getRequestTypeFromSoapMsg(soap_message) 

        if request_type == lasso.REQUEST_TYPE_LOGOUT:

            logout = lasso.Logout(misc.get_lasso_server())

            logout.processRequestMsg(soap_message)

            name_identifier = logout.nameIdentifier.content

            for session in get_session_manager().values():

                if name_identifier == session.name_identifier:

                    break

            else:

                raise "session not found"

            return self.slo_idp(logout, session)

        if request_type == lasso.REQUEST_TYPE_DEFEDERATION:

            defederation = lasso.Defederation(misc.get_lasso_server())

            defederation.processNotificationMsg(soap_message)

            name_identifier = defederation.nameIdentifier.content

            for session in get_session_manager().values():

                if name_identifier == session.name_identifier:

                    break

            else:

                # XXX: lookup user, not session!

                raise "session not found"

            return self.fedterm(defederation, session)

    def federationTermination(self):

        request = get_request()

        if not lasso.isLibertyQuery(request.get_query()):

            return redirect('.')

        defederation = lasso.Defederation(misc.get_lasso_server())

        defederation.processNotificationMsg(request.get_query())

        session = get_session()

        return self.fedterm(defederation, session)

    def fedterm(self, defederation, session):

        defederation.setSessionFromDump(session.lasso_session_dump)

        user = get_request().user

        if user and user.lasso_dump:

            defederation.setIdentityFromDump(user.lasso_dump)

        try:

            defederation.validateNotification()

        except lasso.Error, error:

            pass # ignore failure (?)

        else:

            if not defederation.identity:

                # if it was the last federation the whole identity dump collapsed

                user.lasso_dump = None

            else:

                user.lasso_dump = defederation.identity.dump()

            user.store()

        if defederation.isSessionDirty:

            if defederation.session:

                session.lasso_session_dump = defederation.session.dump()

            else:

                session.lasso_session_dump = None

        if defederation.msgUrl:

            return redirect(defederation.msgUrl)

        else:

            get_session_manager().commit_changes(session)

            response = get_response()

            response.set_status(204)

            return ''

    def federationTerminationReturn(self):

        return redirect('/')

    def metadata(self):

        response = get_response()

        response.set_content_type('text/xml', 'utf-8')

        metadata = unicode(open(misc.get_abs_path(

                        misc.cfg['sp']['metadata'])).read(), 'utf-8')

        return metadata

    def public_key(self):

        response = get_response()

        response.set_content_type('application/octet-stream')

        publickey = file(misc.get_abs_path(misc.cfg['sp']['publickey'])).read()

        return publickey

class SOAPException(Exception):

    pass

def soap_call(url, msg):

    if url.startswith('http://'):

        host, query = urllib.splithost(url[5:])

        conn = httplib.HTTPConnection(host)

    else:

        host, query = urllib.splithost(url[6:])

        conn = httplib.HTTPSConnection(host)

    conn.request("POST", query, msg, {'Content-Type': 'text/xml'})

    response = conn.getresponse()

    data = response.read()

    conn.close()

    if response.status not in (200, 204): # 204 ok for federation termination

        logger.warn('SOAP error (%s) (on %s)' % (response.status, url))

        raise SOAPException()

    return data