Browse Source

HUE-1541 [core] SAML logout

Abraham Elmahrek 12 năm trước cách đây
mục cha
commit
d60b3e4

+ 6 - 0
desktop/conf.dist/hue.ini

@@ -265,6 +265,12 @@
     # A mapping from attributes in the response from the IdP to django user attributes.
     ## user_attribute_mapping={'uid':'username'}
 
+    # Have Hue initiated authn requests be signed and provide a certificate.
+    ## authn_requests_signed=false
+    
+    # Have Hue initiated logout requests be signed and provide a certificate.
+    ## logout_requests_signed=false
+
 ###########################################################################
 # Settings to configure your Hadoop cluster.
 ###########################################################################

+ 6 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -270,6 +270,12 @@
   # A mapping from attributes in the response from the IdP to django user attributes.
   ## user_attribute_mapping={'uid':'username'}
 
+  # Have Hue initiated authn requests be signed and provide a certificate.
+  ## authn_requests_signed=false
+  
+  # Have Hue initiated logout requests be signed and provide a certificate.
+  ## logout_requests_signed=false
+
 ###########################################################################
 # Settings to configure your Hadoop cluster.
 ###########################################################################

+ 6 - 0
desktop/core/src/desktop/auth/views.py

@@ -134,6 +134,12 @@ def dt_login(request):
 
 def dt_logout(request, next_page=None):
   """Log out the user"""
+  backends = get_backends()
+  if backends:
+    for backend in backends:
+      if hasattr(backend, 'logout'):
+        return backend.logout(request, next_page)
+
   return django.contrib.auth.views.logout(request, next_page)
 
 

+ 3 - 2
desktop/core/src/desktop/settings.py

@@ -91,8 +91,8 @@ ADMIN_MEDIA_PREFIX = '/media/'
 
 # List of callables that know how to import templates from various sources.
 TEMPLATE_LOADERS = (
-    'django.template.loaders.filesystem.load_template_source',
-    'desktop.lib.template_loader.load_template_source',
+  'django.template.loaders.filesystem.Loader',
+  'django.template.loaders.app_directories.Loader'
 )
 
 MIDDLEWARE_CLASSES = [
@@ -169,6 +169,7 @@ TEMPLATE_CONTEXT_PROCESSORS = (
 AUTH_PROFILE_MODULE=None
 
 LOGIN_REDIRECT_URL = "/"
+LOGOUT_REDIRECT_URL = "/" # For djangosaml2 bug.
 
 PYLINTRC = get_desktop_root('.pylintrc')
 

+ 4 - 0
desktop/libs/libsaml/src/libsaml/backend.py

@@ -20,6 +20,7 @@ See desktop/auth/backend.py
 import logging
 from django.contrib.auth.models import User
 from djangosaml2.backends import Saml2Backend as _Saml2Backend
+from djangosaml2.views import logout
 from desktop.auth.backend import rewrite_user
 from useradmin.models import get_profile, get_default_user_group, UserProfile
 
@@ -73,3 +74,6 @@ class SAML2Backend(_Saml2Backend):
   @classmethod
   def manages_passwords_externally(cls):
     return True
+
+  def logout(self, request, next_page=None):
+    return logout(request)

+ 12 - 0
desktop/libs/libsaml/src/libsaml/conf.py

@@ -105,3 +105,15 @@ USER_ATTRIBUTE_MAPPING = Config(
   default={'uid': ('username', )},
   type=dict_list_map,
   help=_t("A mapping from attributes in the response from the IdP to django user attributes."))
+
+AUTHN_REQUESTS_SIGNED = Config(
+  key="authn_requests_signed",
+  default=False,
+  type=coerce_bool,
+  help=_t("Have Hue initiated authn requests be signed and provide a certificate."))
+
+LOGOUT_REQUESTS_SIGNED = Config(
+  key="logout_requests_signed",
+  default=False,
+  type=coerce_bool,
+  help=_t("Have Hue initiated logout requests be signed and provide a certificate."))

+ 6 - 3
desktop/libs/libsaml/src/libsaml/saml_settings.py

@@ -54,7 +54,7 @@ SAML_CONFIG = {
         # do not change the binding or service name
         'single_logout_service': [
           ("%s/saml2/ls/" % BASE_URL, saml2.BINDING_HTTP_REDIRECT),
-        ],
+        ]
       },
 
       'allow_unsolicited': libsaml.conf.ALLOW_UNSOLICITED.get(),
@@ -63,7 +63,7 @@ SAML_CONFIG = {
       'required_attributes': libsaml.conf.REQUIRED_ATTRIBUTES.get(),
 
       # attributes that may be useful to have but not required
-      'optional_attributes': libsaml.conf.OPTIONAL_ATTRIBUTES.get(),
+      'optional_attributes': libsaml.conf.OPTIONAL_ATTRIBUTES.get()
     },
   },
 
@@ -77,7 +77,10 @@ SAML_CONFIG = {
 
   # certificate
   'key_file': libsaml.conf.KEY_FILE.get(),
-  'cert_file': libsaml.conf.CERT_FILE.get()
+  'cert_file': libsaml.conf.CERT_FILE.get(),
+
+  'logout_requests_signed': str(libsaml.conf.LOGOUT_REQUESTS_SIGNED.get()).lower(),
+  'authn_requests_signed': str(libsaml.conf.AUTHN_REQUESTS_SIGNED.get()).lower()
 }
 
 SAML_ATTRIBUTE_MAPPING = libsaml.conf.USER_ATTRIBUTE_MAPPING.get()

+ 1 - 1
desktop/libs/libsaml/src/libsaml/views.py

@@ -18,7 +18,7 @@
 from djangosaml2.views import login, echo_attributes, metadata, assertion_consumer_service
 
 
-__all__ = ['login', 'echo_attributes']
+__all__ = ['login', 'echo_attributes', 'assertion_consumer_service', 'metadata']
 
 
 setattr(login, 'login_notrequired', True)