Ver código fonte

[libsaml] Make sure saml replies go through the load balancer

This works by making sure the saml2 metadata is created with
the current request's hostname. This means it's now possible
to create the saml2 metadata both for the load balanced and
non-load balanced Hue URLs.
Erick Tryzelaar 10 anos atrás
pai
commit
a5b3453
1 arquivos alterados com 71 adições e 61 exclusões
  1. 71 61
      desktop/libs/libsaml/src/libsaml/saml_settings.py

+ 71 - 61
desktop/libs/libsaml/src/libsaml/saml_settings.py

@@ -19,74 +19,84 @@ import desktop.conf
 import libsaml.conf
 
 from desktop.lib import security_util
-
-
-__all__ = ['SAML_CONFIG', 'SAML_ATTRIBUTE_MAPPING', 'SAML_CREATE_UNKNOWN_USER']
-
-
-BASE_URL = "%(protocol)s%(host)s:%(port)d" % {
-  'protocol': desktop.conf.is_https_enabled() and 'https://' or 'http://',
-  'host':  desktop.conf.HTTP_HOST.get() == '0.0.0.0' and security_util.get_localhost_name() or desktop.conf.HTTP_HOST.get(),
-  'port':  desktop.conf.HTTP_PORT.get()
-}
-
-ENTITY_ID = libsaml.conf.ENTITY_ID.get().replace('<base_url>', BASE_URL)
-
-
-SAML_CONFIG = {
-  # full path to the xmlsec1 binary programm
-  'xmlsec_binary': libsaml.conf.XMLSEC_BINARY.get(),
-
-  # your entity id, usually your subdomain plus the url to the metadata view
-  'entityid': ENTITY_ID,
-
-  # directory with attribute mapping
-  'attribute_map_dir': libsaml.conf.ATTRIBUTE_MAP_DIR.get(),
-
-  # this block states what services we provide
-  'service': {
-    'sp' : {
-      'name': 'hue',
-      'name_id_format': libsaml.conf.NAME_ID_FORMAT.get(),
-      'endpoints': {
-        # url and binding to the assetion consumer service view
-        # do not change the binding or service name
-        'assertion_consumer_service': [
-          ("%s/saml2/acs/" % BASE_URL, saml2.BINDING_HTTP_POST),
-        ],
-        # url and binding to the logout service view
-        # do not change the binding or service name
-        'single_logout_service': [
-          ("%s/saml2/ls/" % BASE_URL, saml2.BINDING_HTTP_REDIRECT),
-          ("%s/saml2/ls/post/" % BASE_URL, saml2.BINDING_HTTP_POST),
-        ],
+from saml2.config import SPConfig
+
+
+__all__ = (
+    'SAML_ATTRIBUTE_MAPPING',
+    'SAML_CONFIG_LOADER',
+    'SAML_CREATE_UNKNOWN_USER',
+)
+
+
+def config_settings_loader(request):
+  base_url = "%(protocol)s%(host)s" % {
+    'protocol': 'https://' if request.is_secure() else 'http://',
+    'host':  request.get_host(),
+  }
+
+  entity_id = libsaml.conf.ENTITY_ID.get().replace('<base_url>', base_url)
+
+  conf = SPConfig()
+  conf.load({
+    # full path to the xmlsec1 binary programm
+    'xmlsec_binary': libsaml.conf.XMLSEC_BINARY.get(),
+
+    # your entity id, usually your subdomain plus the url to the metadata view
+    'entityid': entity_id,
+
+    # directory with attribute mapping
+    'attribute_map_dir': libsaml.conf.ATTRIBUTE_MAP_DIR.get(),
+
+    # this block states what services we provide
+    'service': {
+      'sp' : {
+        'name': 'hue',
+        'name_id_format': libsaml.conf.NAME_ID_FORMAT.get(),
+        'endpoints': {
+          # url and binding to the assetion consumer service view
+          # do not change the binding or service name
+          'assertion_consumer_service': [
+            ("%s/saml2/acs/" % base_url, saml2.BINDING_HTTP_POST),
+          ],
+          # url and binding to the logout service view
+          # do not change the binding or service name
+          'single_logout_service': [
+            ("%s/saml2/ls/" % base_url, saml2.BINDING_HTTP_REDIRECT),
+            ("%s/saml2/ls/post/" % base_url, saml2.BINDING_HTTP_POST),
+          ],
+        },
+
+        'allow_unsolicited': str(libsaml.conf.ALLOW_UNSOLICITED.get()).lower(),
+
+        # attributes that this project need to identify a user
+        'required_attributes': libsaml.conf.REQUIRED_ATTRIBUTES.get(),
+
+        # attributes that may be useful to have but not required
+        'optional_attributes': libsaml.conf.OPTIONAL_ATTRIBUTES.get(),
+
+        'logout_requests_signed': str(libsaml.conf.LOGOUT_REQUESTS_SIGNED.get()).lower(),
+        'authn_requests_signed': str(libsaml.conf.AUTHN_REQUESTS_SIGNED.get()).lower()
       },
+    },
 
-      'allow_unsolicited': str(libsaml.conf.ALLOW_UNSOLICITED.get()).lower(),
-
-      # attributes that this project need to identify a user
-      'required_attributes': libsaml.conf.REQUIRED_ATTRIBUTES.get(),
+    # where the remote metadata is stored
+    'metadata': {
+      'local': [ libsaml.conf.METADATA_FILE.get() ],
+    },
 
-      # attributes that may be useful to have but not required
-      'optional_attributes': libsaml.conf.OPTIONAL_ATTRIBUTES.get(),
+    # set to 1 to output debugging information
+    'debug': 1,
 
-      'logout_requests_signed': str(libsaml.conf.LOGOUT_REQUESTS_SIGNED.get()).lower(),
-      'authn_requests_signed': str(libsaml.conf.AUTHN_REQUESTS_SIGNED.get()).lower()
-    },
-  },
+    # certificate
+    'key_file': libsaml.conf.KEY_FILE.get(),
+    'cert_file': libsaml.conf.CERT_FILE.get()
+  })
 
-  # where the remote metadata is stored
-  'metadata': {
-    'local': [ libsaml.conf.METADATA_FILE.get() ],
-  },
+  return conf
 
-  # set to 1 to output debugging information
-  'debug': 1,
 
-  # certificate
-  'key_file': libsaml.conf.KEY_FILE.get(),
-  'cert_file': libsaml.conf.CERT_FILE.get()
-}
+SAML_CONFIG_LOADER = 'libsaml.saml_settings.config_settings_loader'
 
 SAML_ATTRIBUTE_MAPPING = libsaml.conf.USER_ATTRIBUTE_MAPPING.get()
 SAML_CREATE_UNKNOWN_USER = libsaml.conf.CREATE_USERS_ON_LOGIN.get()