Эх сурвалжийг харах

HUE-1677 [core] Make SAML username source configurable

Abraham Elmahrek 12 жил өмнө
parent
commit
030d2a7

+ 4 - 0
desktop/conf.dist/hue.ini

@@ -286,6 +286,10 @@
   # Have Hue initiated logout requests be signed and provide a certificate.
   ## logout_requests_signed=false
 
+  ## Username can be sourced from 'attributes' or 'nameid'.
+  ## username_source=attributes
+
+
 ###########################################################################
 # Settings to configure your Hadoop cluster.
 ###########################################################################

+ 4 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -291,6 +291,10 @@
   # Have Hue initiated logout requests be signed and provide a certificate.
   ## logout_requests_signed=false
 
+  # Username can be sourced from 'attributes' or 'nameid'.
+  ## username_source=attributes
+
+
 ###########################################################################
 # Settings to configure your Hadoop cluster.
 ###########################################################################

+ 17 - 2
desktop/libs/libsaml/src/libsaml/conf.py

@@ -18,13 +18,15 @@
 import json
 import os
 
-from django.utils.translation import ugettext_lazy as _t
+from django.utils.translation import ugettext_lazy as _t, ugettext as _
 
 from desktop.lib.conf import Config, coerce_bool, coerce_csv
 
 
 BASEDIR = os.path.dirname(os.path.abspath(__file__))
 
+USERNAME_SOURCES = ('attributes', 'nameid')
+
 
 def dict_list_map(value):
   if isinstance(value, str):
@@ -115,4 +117,17 @@ LOGOUT_REQUESTS_SIGNED = Config(
   key="logout_requests_signed",
   default=False,
   type=coerce_bool,
-  help=_t("Have Hue initiated logout requests be signed and provide a certificate."))
+  help=_t("Have Hue initiated logout requests be signed and provide a certificate."))
+
+USERNAME_SOURCE = Config(
+  key="username_source",
+  default="attributes",
+  type=str,
+  help=_t("Username can be sourced from 'attributes' or 'nameid'"))
+
+
+def config_validator(user):
+  res = []
+  if USERNAME_SOURCE.get() not in USERNAME_SOURCES:
+    res.append(("libsaml.username_source", _("username_source not configured properly. SAML integration may not work.")))
+  return res

+ 1 - 1
desktop/libs/libsaml/src/libsaml/urls.py

@@ -24,7 +24,7 @@ urlpatterns = patterns(
 )
 
 urlpatterns += patterns('libsaml.views',
-                        url(r'^acs/$', 'assertion_consumer_service', name='saml2_acs'),
+                        url(r'^acs/$', 'acs', name='saml2_acs'),
                         url(r'^login/$', 'login', name='saml2_login'),
                         url(r'^metadata/$', 'metadata', name='saml2_metadata'),
                         url(r'^test/$', 'echo_attributes'))

+ 8 - 1
desktop/libs/libsaml/src/libsaml/views.py

@@ -17,11 +17,18 @@
 
 from djangosaml2.views import login, echo_attributes, metadata, assertion_consumer_service
 
+import libsaml.conf
+
 
 __all__ = ['login', 'echo_attributes', 'assertion_consumer_service', 'metadata']
 
 
+def acs(request, config_loader_path=None, attribute_mapping=None, create_unknown_user=None):
+  username_source = libsaml.conf.USERNAME_SOURCE.get().lower()
+  return assertion_consumer_service(request, config_loader_path, attribute_mapping, create_unknown_user, username_source)
+
+
 setattr(login, 'login_notrequired', True)
 setattr(echo_attributes, 'login_notrequired', True)
-setattr(assertion_consumer_service, 'login_notrequired', True)
+setattr(acs, 'login_notrequired', True)
 setattr(metadata, 'login_notrequired', True)