hzdr / shibboleth-authenticator Goto Github PK

View Code? Open in Web Editor NEW

2.0 4.0 3.0 6.55 MB

Python module to add SAML support for your Invenio instance.

Home Page: https://hzdr.github.io/shibboleth-authenticator/

License: GNU General Public License v3.0

Shell 1.90% Python 98.10%

flask invenio saml2 saml serviceprovider python python3 python2

shibboleth-authenticator's Introduction

Shibboleth Authenticator

Module for Invenio that provides authentication via shibboleth.

Installation

Requirements

The python3-saml module uses xmlsec, which offers Python bindings for the XML Security Library. xmlsec depends on libxml2-dev and libxmlsec1-dev. These libraries can be installed via the package manager of your distribution. For Ubuntu use:

$ sudo apt install libxml2-dev libxmlsec1-dev

Shibboleth-Authenticator

Shibboleth-Authenticator module can be installed via PyPI:

$ pip install shibboleth-authenticator

Or the latest development branch directly from GitHub:

$ pip install git+git://github.com/hzdr/shibboleth-authenticator@master

Developer documentation

See https://hzdr.github.io/shibboleth-authenticator.

shibboleth-authenticator's People

Stargazers

Watchers

Forkers

gabicavalcante egabancho run-tud

shibboleth-authenticator's Issues

Decouple existing implementation in stand-alone module

Move repository to GitHub organisation HZDR

Move the repository to the GitHub organization HZDR (https://github.com/hzdr).

Move documentation
Make sure Travis is set up properly
Update links in the repository that still target the old address
Configure deployment to PyPy and ensure it is working
Make sure there is some kind of redirect/information in the old place here to the new location

Tests fail with InternalError

CI tests fail with AttributeError: 'str' object has no attribute 'relto'.

Probable solution: use pytest>=2.8.3 in setup.py

Unpin Sphinx

Once sphinx-contrib-versioning is compatible with Sphinx>=2.0 remove the pinning.

Segmentation fault during test only on travis

Only on Travis CI build the test fail with a segmentation fault:

============================= test session starts ==============================
platform linux2 -- Python 2.7.9, pytest-3.0.7, py-1.4.33, pluggy-0.4.0 -- /home/travis/virtualenv/python2.7.9/bin/python
cachedir: .cache
rootdir: /home/travis/build/tobiasfrust/shibboleth-authenticator, inifile: pytest.ini
plugins: pep8-1.0.6, cov-2.5.0
collected 13 items 
tests/conftest.py PASSED
tests/helpers.py PASSED
tests/test_app.py PASSED
tests/test_app.py::test_version PASSED
tests/test_app.py::test_init PASSED
tests/test_utils.py PASSED
tests/test_utils.py::test_accountinfo PASSEDPath: /tmp/tmpvfTZ9s
tests/test_views.py PASSED
tests/test_views.py::test_login PASSEDPath: /tmp/tmpYbsxg0
tests/test_views.py::test_redirect_uri PASSEDPath: /tmp/tmpBT44Ko
tests/test_views.py::test_authorized PASSEDPath: /tmp/tmp7z5NDQ
tests/test_views.py::test_valid_authorized Segmentation fault (core dumped)
The command "sh run-tests.sh" exited with 139.

Locally, using drone.io as well as in a manual run all tests pass.

Fix get_safe_redirect_target

The get_safe_redirect_target function in invenio-oauthclient function changed. Apparently, this results in an internal server error. The used APP_ALLOWED_HOSTS configuration variable might be not a list.

Flask-WTF >= 0.14.2: Form validation fails, User is not registered

When the authorized_signup_handler-function is called, the registration of the user fails due to a ValidationError of the created form. The relevant lines are here.
form.to_dict() results in the following output:

{
    "email": "[email protected]",
    "profile": {
        "csrf_token": "",
        "username": "test1234",
        "full_name": "Full Name"
    }
}

csrf_token should not be present. It should already be deactived by invenio_oauthclient.utils:disable_csrf.
It is to be investigated what happens.

It seems to be introduced in version v0.14.2 of Flask-WTF in this commit.

Implement Logout

Implement a logout like in this example

Switch back to sudo:false image as soon as travis issue is resolved

In the trusty beta with sudo: false a connection error with the mysql daemon occurs as described in this issue: travis-ci/travis-ci#6842

The current solution is to use sudo: required in the .travis.yml.

Switch back to sudo: false as soon as the issue is resolved.

serializer = LocalProxy(
    lambda: TimedJSONWebSignatureSerializer(
        current_app.config['SECRET_KEY'],
        expires_in=current_app.config['OAUTHCLIENT_STATE_EXPIRES'],
    )
)

...

state_token = serializer.dumps({
        'app': remote_app,
        'next': next_param,
        'sid': _create_identifier(),
})

...

$ sh run-tests.sh
shibboleth_authenticator/config.py:19 at module level:
        D413: Missing blank line after last section ('Example')
shibboleth_authenticator/config.py:19 at module level:
        D412: No blank lines allowed between a section header and its content ('Example')
shibboleth_authenticator/views.py:51 in public function `init_saml_auth`:
        D414: Section has no content ('Returns')
shibboleth_authenticator/views.py:51 in public function `init_saml_auth`:
        D414: Section has no content ('Returns')
The command "sh run-tests.sh" exited with 1.

Release Notes

Implement tests

Exception on account's security page

Probably, the session needs to be established correctly in authorized_signup_handler.

[2017-04-27 11:26:03,050] ERROR in app: Exception on /account/settings/security/ [GET]
 Traceback (most recent call last):
   File "/usr/local/lib/python3.5/site-packages/flask/app.py", line 1982, in wsgi_app
     response = self.full_dispatch_request()
   File "/usr/local/lib/python3.5/site-packages/flask/app.py", line 1614, in full_dispatch_request
     rv = self.handle_user_exception(e)
   File "/usr/local/lib/python3.5/site-packages/flask/app.py", line 1517, in handle_user_exception
     reraise(exc_type, exc_value, tb)
   File "/usr/local/lib/python3.5/site-packages/flask/_compat.py", line 33, in reraise
     raise value
   File "/usr/local/lib/python3.5/site-packages/flask/app.py", line 1612, in full_dispatch_request
     rv = self.dispatch_request()
   File "/usr/local/lib/python3.5/site-packages/flask_debugtoolbar/__init__.py", line 125, in dispatch_request
     return view_func(**req.view_args)
   File "/usr/local/lib/python3.5/site-packages/flask_login/utils.py", line 228, in decorated_view
     return func(*args, **kwargs)
   File "/usr/local/lib/python3.5/site-packages/invenio_accounts/views.py", line 140, in security
     is_current=SessionActivity.is_current
   File "/usr/local/lib/python3.5/site-packages/flask/templating.py", line 134, in render_template
     context, ctx.app)
   File "/usr/local/lib/python3.5/site-packages/flask/templating.py", line 116, in _render
     rv = template.render(context)
   File "/usr/local/lib/python3.5/site-packages/jinja2/environment.py", line 1008, in render
     return self.environment.handle_exception(exc_info, True)
   File "/usr/local/lib/python3.5/site-packages/jinja2/environment.py", line 780, in handle_exception
     reraise(exc_type, exc_value, tb)
   File "/usr/local/lib/python3.5/site-packages/jinja2/_compat.py", line 37, in reraise
     raise value.with_traceback(tb)
   File "/usr/local/lib/python3.5/site-packages/invenio_accounts/templates/invenio_accounts/settings/security.html", line 32, in top-level template code
     {% set revoke_action = _("Revoke") %}
   File "/usr/local/lib/python3.5/site-packages/invenio_theme/templates/invenio_theme/page_settings.html", line 25, in top-level template code
     {%- extends config.THEME_BASE_TEMPLATE %}
   File "/code/zenodo/zenodo/modules/theme/templates/zenodo_theme/page.html", line 25, in top-level template code
     {%- extends "invenio_theme/page.html" %}
   File "/usr/local/lib/python3.5/site-packages/invenio_theme/templates/invenio_theme/page.html", line 73, in top-level template code
     {%- block body %}
   File "/usr/local/lib/python3.5/site-packages/invenio_theme/templates/invenio_theme/page.html", line 79, in block "body"
     {%- block body_inner %}
   File "/usr/local/lib/python3.5/site-packages/invenio_theme/templates/invenio_theme/page.html", line 83, in block "body_inner"
     {%- block page_body %}
   File "/usr/local/lib/python3.5/site-packages/invenio_theme/templates/invenio_theme/page_settings.html", line 49, in block "page_body"
     {%- block settings_content scoped %}
   File "/usr/local/lib/python3.5/site-packages/invenio_theme/templates/invenio_theme/page_settings.html", line 62, in block "settings_content"
     {%- block settings_body scoped %}
   File "/usr/local/lib/python3.5/site-packages/invenio_theme/templates/invenio_theme/page_settings.html", line 64, in block "settings_body"
     {%- block settings_form scoped %}
   File "/usr/local/lib/python3.5/site-packages/invenio_accounts/templates/invenio_accounts/settings/security.html", line 53, in block "settings_form"
     {{session.created | tousertimezone | dateformat}}
   File "/usr/local/lib/python3.5/site-packages/invenio_i18n/jinja2.py", line 42, in filter_to_user_timezone
     return to_user_timezone(dt)
   File "/usr/local/lib/python3.5/site-packages/flask_babelex/__init__.py", line 310, in to_user_timezone
    if datetime.tzinfo is None:
jinja2.exceptions.UndefinedError: 'None' has no attribute 'created'