UnivNautes

import auth

# -*- encoding: utf-8 -*-

import subprocess

import settings

from django.contrib import messages

from authentic2.authsaml2 import signals

import xml.etree.ElementTree

import syslog

def user_login_cb(sender, request, attributes={}, **kwargs):

    if request and request.user.is_anonymous():

        return

    request.session['prefered_idp'] = attributes['__issuer']

    if 'displayName' in attributes:

        request.session['display_name'] = attributes['displayName'][0]

    nameid = 'nameID:%s' % attributes['__nameid']

    # use eduPersonTargetedID (OID 1.3.6.1.4.1.5923.1.1.1.10), fallback to __nameid/__issuer

    try:

        if 'eduPersonTargetedID' in attributes:

            attrkey = 'eduPersonTargetedID'

        else:

            attrkey = ('urn:oid:1.3.6.1.4.1.5923.1.1.1.10', 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri')

        eduPersonTargetedID_xml = xml.etree.ElementTree.fromstring(attributes[attrkey][0])

        eduPersonTargetedID = 'eduPersonTargetedID:%s' % eduPersonTargetedID_xml.text

        eduPersonTargetedID_NameQualifier = eduPersonTargetedID_xml.attrib['NameQualifier']

    except:

        eduPersonTargetedID = nameid

        eduPersonTargetedID_NameQualifier = attributes['__issuer']

    # log needs eduPersonTargetedID + transientID + idp

    username = eduPersonTargetedID + '|' + eduPersonTargetedID_NameQualifier

    # TODO : blacklist

    ip = request.META['REMOTE_ADDR']

    # univnautes idp returns univnautesPrivileges attribute (a list)

    multiple = 0

    privileges = attributes.get((u'univnautesPrivileges', u'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'), [])

    if 'univnautes-idp-multiple' in privileges:

       multiple = 1

    cmd = [ c % {

            'ip': ip,

            'username': username,

            'nameid': nameid,

            'multiple': multiple,

            } for c in settings.UNIVNAUTES_CP_ALLOW_CMD ]

    if settings.DEBUG:

        syslog.openlog("sp/auth", syslog.LOG_PID)

        syslog.syslog(syslog.LOG_LOCAL4 | syslog.LOG_INFO , "cmd: %r" % ' '.join(cmd))

    # open the firewall for this client

    try:

        p = subprocess.Popen(cmd, close_fds=True,

                        stdin=subprocess.PIPE,

                        stdout=subprocess.PIPE,

                        stderr=subprocess.PIPE)

    except OSError, e:

        request.session['pfsenseid'] = 'ERROR'

        messages.error(request, u"Erreur : OSError %s" % e)

        syslog.openlog("sp/auth", syslog.LOG_PID)

        syslog.syslog(syslog.LOG_LOCAL4 | syslog.LOG_INFO , "ERROR: OSError %s" % e)

        return False

    stdout, stderr = p.communicate()

    if p.returncode != 0:

        request.session['pfsenseid'] = 'ERROR'

        messages.error(request, u"Erreur : returncode=%d" % p.returncode)

        syslog.openlog("sp/auth", syslog.LOG_PID)

        syslog.syslog(syslog.LOG_LOCAL4 | syslog.LOG_INFO , "ERROR: returncode=%d" % p.returncode)

        return False

    # cp_allow returns the pfsense CP sessionid on stdout : store it in django session

    request.session['pfsenseid'] = stdout

    return True

signals.auth_login.connect(user_login_cb, dispatch_uid='authentic2.idp')

    context_extras['pfsenseid'] = request.session.get('pfsenseid')

    context_extras['display_name'] = request.session.get('display_name')

SECRET_KEY_FILENAME = os.path.join(PROJECT_PATH, 'secret.key')

# List of callables to import templates from various sources.

#TEMPLATE_DIRS = (

#    os.path.join(PROJECT_PATH, 'sp', 'templates'),

#)

# it can't be 'django.contrib.sessions.serializers.JSONSerializer' with authentic2 (attributes)

# pfSense captive portal commands :

UNIVNAUTES_CP_ALLOW_CMD = [

        os.path.join(PROJECT_PATH, 'sp', 'cp_allow'),

        'ip=%(ip)s',

        'username=%(username)s',

        'nameid=%(nameid)s',

        'multiple=%(multiple)s']

# now get some values from config.xml

# FIXME: get this from SP_UI config (i.e. config.xml)

{% if pfsenseid == 'ERROR' %}

<h2>

{% if display_name %}{{ display_name }}, il{% else %}Il{% endif %} y a eu une

erreur lors de l'ouverture de l'accès.

</h2>

<p>

Vous pouvez essayer de <button><a href="/accounts/logout/">vous reconnecter</a></button>.

</p>

{% elif pfsenseid == 'BLACKLIST' %}

<h2>L'accès a été refusé.</h2>

{% else %}

{% if display_name %}{{ display_name }}, vous{% else %}Vous{% endif %}

avez maintenant accès au réseau.

Après avoir utilisé cet accès, n'oubliez pas de fermer votre navigateur, afin

que la session de connexion à votre établissement soit bien fermée.

En cas de problème d'accès, essayez de <button><a href="/accounts/logout/">vous

reconnecter</a></button>.

{% endif %}

{% block page-end %}{% endblock %}