Skip to content

Commit 98c5798

Browse files
inducerinducer
committed
SAML2 bringup
1 parent 8c78514 commit 98c5798

File tree

11 files changed

+656
-111
lines changed

11 files changed

+656
-111
lines changed

‎course/exam.py

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -550,13 +550,14 @@ def process_request(self, request):
550550
resolver_match = resolve(request.path)
551551

552552
from course.exam import check_in_for_exam, issue_exam_ticket
553-
from course.auth import (user_profile, sign_in_by_email,
553+
from course.auth import (user_profile, sign_in_choice, sign_in_by_email,
554554
sign_in_stage2_with_token, sign_in_by_user_pw)
555555
from course.flow import view_start_flow, view_flow_page
556556
from django.contrib.auth.views import logout
557557

558558
ok = False
559559
if resolver_match.func in [
560+
sign_in_choice,
560561
sign_in_by_email,
561562
sign_in_stage2_with_token,
562563
sign_in_by_user_pw,
@@ -567,6 +568,9 @@ def process_request(self, request):
567568
logout]:
568569
ok = True
569570

571+
elif path.startswith("/saml2"):
572+
ok = True
573+
570574
elif (
571575
(request.user.is_staff
572576
or

‎local_settings.py.example

Lines changed: 116 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -132,14 +132,14 @@ RELATE_MAINTENANCE_MODE = False
132132
# May be set to a string to set a sitewide announcement visible on every page.
133133
RELATE_SITE_ANNOUNCEMENT = None
134134

135+
# }}}
136+
135137
# Uncomment this to enable i18n, change 'en-us' to locale name your language.
136138
# Make sure you have generated, translate and compile the message file of your
137139
# language. If commented, RELATE will use default language 'en-us'.
138140

139141
#LANGUAGE_CODE='en-us'
140142

141-
# }}}
142-
143143
# {{{ exams and testing
144144

145145
RELATE_FACILITIES = {
@@ -157,4 +157,118 @@ RELATE_TICKET_MINUTES_VALID_AFTER_USE = 12*60
157157

158158
# }}}
159159

160+
# {{{ saml2 (optional)
161+
162+
if RELATE_SIGN_IN_BY_SAML2_ENABLED:
163+
from os import path
164+
import saml2.saml
165+
_BASEDIR = path.dirname(path.abspath(__file__))
166+
167+
_BASE_URL = 'https://relate.cs.illinois.edu'
168+
169+
SAML_CONFIG = {
170+
# full path to the xmlsec1 binary programm
171+
'xmlsec_binary': '/usr/bin/xmlsec1',
172+
173+
# your entity id, usually your subdomain plus the url to the metadata view
174+
# (usually no need to change)
175+
'entityid': _BASE_URL + '/saml2/metadata/',
176+
177+
# directory with attribute mapping
178+
# (already populated with samples from djangosaml2, usually no need to
179+
# change)
180+
'attribute_map_dir': path.join(_BASEDIR, 'saml-config', 'attribute-maps'),
181+
182+
# this block states what services we provide
183+
'service': {
184+
'sp': {
185+
'name': 'RELATE SAML2 SP',
186+
'name_id_format': saml2.saml.NAMEID_FORMAT_PERSISTENT,
187+
'endpoints': {
188+
# url and binding to the assertion consumer service view
189+
# do not change the binding or service name
190+
'assertion_consumer_service': [
191+
(_BASE_URL + '/saml2/acs/',
192+
saml2.BINDING_HTTP_POST),
193+
],
194+
# url and binding to the single logout service view
195+
# do not change the binding or service name
196+
'single_logout_service': [
197+
(_BASE_URL + '/saml2/ls/',
198+
saml2.BINDING_HTTP_REDIRECT),
199+
(_BASE_URL + '/saml2/ls/post',
200+
saml2.BINDING_HTTP_POST),
201+
],
202+
},
203+
204+
# attributes that this project needs to identify a user
205+
'required_attributes': ['uid'],
206+
207+
# attributes that may be useful to have but not required
208+
'optional_attributes': ['eduPersonAffiliation'],
209+
210+
# in this section the list of IdPs we talk to are defined
211+
'idp': {
212+
# Find the entity ID of your IdP and make this the key here:
213+
'urn:mace:incommon:uiuc.edu': {
214+
'single_sign_on_service': {
215+
# Add the POST and REDIRECT bindings for the sign on service here:
216+
saml2.BINDING_HTTP_POST:
217+
'https://shibboleth.illinois.edu/idp/profile/SAML2/POST/SSO',
218+
saml2.BINDING_HTTP_REDIRECT:
219+
'https://shibboleth.illinois.edu/idp/profile/SAML2/Redirect/SSO',
220+
},
221+
'single_logout_service': {
222+
# And the REDIRECT binding for the logout service here:
223+
saml2.BINDING_HTTP_REDIRECT:
224+
'https://shibboleth.illinois.edu/idp/logout.jsp', # noqa
225+
},
226+
},
227+
},
228+
},
229+
},
230+
231+
# You will get this XML file from your institution. It has finite validity
232+
# and will need to be re-downloaded periodically.
233+
#
234+
# "itrust" is an example name that's valid for the University of Illinois.
235+
# This particular file is public and lives at
236+
# https://discovery.itrust.illinois.edu/itrust-metadata/itrust-metadata.xml
237+
238+
'metadata': {
239+
'local': [path.join(_BASEDIR, 'saml-config', 'itrust-metadata.xml')],
240+
},
241+
242+
# set to 1 to output debugging information
243+
'debug': 1,
244+
245+
# certificate
246+
# see saml2-keygen.sh in this directory
247+
'key_file': path.join(_BASEDIR, 'saml-config', 'sp-key.pem'), # private part
248+
'cert_file': path.join(_BASEDIR, 'saml-config', 'sp-cert.pem'), # public part
249+
250+
# own metadata settings
251+
'contact_person': [
252+
{'given_name': 'Andreas',
253+
'sur_name': 'Kloeckner',
254+
'company': 'CS - University of Illinois',
255+
'email_address': '[email protected]',
256+
'contact_type': 'technical'},
257+
{'given_name': 'Andreas',
258+
'sur_name': 'Kloeckner',
259+
'company': 'CS - University of Illinois',
260+
'email_address': '[email protected]',
261+
'contact_type': 'administrative'},
262+
],
263+
# you can set multilanguage information here
264+
'organization': {
265+
'name': [('RELATE', 'en')],
266+
'display_name': [('RELATE', 'en')],
267+
'url': [(_BASE_URL, 'en')],
268+
},
269+
'valid_for': 24, # how long is our metadata valid
270+
}
271+
272+
# }}}
273+
160274
# vim: filetype=python:foldmethod=marker

‎relate/settings.py

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -275,8 +275,6 @@
275275
'sn': ('last_name', ),
276276
}
277277

278-
SAML_CONFIG = join(BASE_DIR, "saml_config.py")
279-
280278
# }}}
281279

282280
# vim: foldmethod=marker

‎relate/templates/djangosaml2/wayf.html

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{% extends "base.html" %}
2+
3+
{% load i18n %}
4+
{% block content %}
5+
<h1>{% trans "Institutional Login (SAML2)" %}</h1>
6+
<p>{% trans "Please select your Identity Provider from the following list:" %}</p>
7+
<ul>
8+
{% for url, name in available_idps %}
9+
<li><a href="{% url 'djangosaml2.views.login' %}?idp={{ url }}{% if came_from %}&next={{ came_from }}{% endif %}">{{ name }}</a></li>
10+
{% endfor %}
11+
</ul>
12+
{% endblock %}

‎relate/templates/sign-in-choice.html

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,10 @@ <h1>{% trans "Sign in to RELATE" %}</h1>
99
<li>
1010
<a
1111
class="btn btn-primary"
12-
href="#"
12+
href="{% url "djangosaml2.views.login" %}"
1313
role="button"><i class="fa fa-institution"></i>
1414
{% trans "Sign in using your institution's login" %} &raquo;</a>
15+
(not yet working, but getting there)
1516
</li>
1617
{% endif %}
1718
{% if relate_sign_in_by_email_enabled %}

‎relate/urls.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -447,12 +447,12 @@
447447

448448
if settings.RELATE_SIGN_IN_BY_SAML2_ENABLED:
449449
urlpatterns.extend([
450-
(r'^saml2/', include('djangosaml2.urls')),
450+
url(r'^saml2/', include('djangosaml2.urls')),
451451
])
452452
if settings.DEBUG:
453453
urlpatterns.extend([
454454
# Keep commented unless debugging SAML2.
455-
(r'^saml2-test/', 'djangosaml2.views.echo_attributes'),
455+
url(r'^saml2-test/', 'djangosaml2.views.echo_attributes'),
456456
])
457457

458458
# vim: fdm=marker

‎saml-config/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
*.pem
2+
*meta*.xml

0 commit comments

Comments
 (0)