From a8795a1507ccfa9daf081c35df083c915dd1242a Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jun 27 2016 12:08:56 +0000
Subject: [PATCH 1/3] Add ssh and gpg key id mappings to authfas


Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/ipsilon/login/authfas.py b/ipsilon/login/authfas.py
index eee0438..2177eba 100644
--- a/ipsilon/login/authfas.py
+++ b/ipsilon/login/authfas.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2014 Ipsilon project Contributors, for license see COPYING
+# Copyright (C) 2014,2016 Ipsilon project Contributors, for license see COPYING
 
 from ipsilon.login.common import LoginFormBase, LoginManagerBase, \
     LoginManagerInstaller
@@ -35,6 +35,8 @@ fas_mapping = [
     ['human_name', 'fullname'],
     ['email', 'email'],
     ['timezone', 'timezone'],
+    ['ssh_key', 'ssh_key'],
+    ['gpg_keyid', 'gpg_keyid'],
 ]
 
 
@@ -84,6 +86,9 @@ class FAS(LoginFormBase):
     def make_userdata(self, fas_data):
         userdata, fas_extra = self.mapper.map_attributes(fas_data)
 
+        # We need to split ssh keys by newline, since we can't send newlines
+        userdata['ssh_key'] = userdata['ssh_key'].split('\n')
+
         # compute and store groups and cla groups
         userdata['_groups'] = []
         userdata['_extras'] = {'fas': fas_extra, 'cla': []}

From 7bb91fe218ba6afd6c446b34ad426799eaf4e98d Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jun 27 2016 12:09:00 +0000
Subject: [PATCH 2/3] Support sending multiple OpenID AX values


This allows us to send list a list of attribute values in a standard compliant
method.
We now process the number of requested values of any requested attribute,
and only send up to the maximum requested number.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/ipsilon/providers/openid/extensions/ax.py b/ipsilon/providers/openid/extensions/ax.py
index f1996ce..37fb9f6 100644
--- a/ipsilon/providers/openid/extensions/ax.py
+++ b/ipsilon/providers/openid/extensions/ax.py
@@ -38,12 +38,24 @@ class OpenidExtension(OpenidExtensionBase):
             return None
         resp = ax.FetchResponse(req)
         for name in req.requested_attributes:
+            attr = req.requested_attributes[name]
             try:
                 self.debug(name)
+                value = None
                 if name in AP_MAP:
-                    resp.addValue(name, userdata[AP_MAP[name]])
+                    value = userdata[AP_MAP[name]]
                 else:
-                    resp.addValue(name, userdata[name])
+                    value = userdata[name]
+
+                added_vals = 0
+                if not isinstance(value, list):
+                    value = [value]
+                for val in value:
+                    val = val.strip()
+                    if attr.wantsUnlimitedValues() or added_vals < attr.count:
+                        if val != '':
+                            added_vals += 1
+                            resp.addValue(name, val)
             except Exception:  # pylint: disable=broad-except
                 pass
         return resp

From d39f7638e65d91d4ceb00ce23143a241b8d8d071 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jun 27 2016 12:09:02 +0000
Subject: [PATCH 3/3] Error out if requested to send newline via OpenID AX


The kv serialization format of OpenID used for verification in stateless
protocol runs, attributes values containing newlines are impossible.
Previously, we would throw a 500 because the python-openid library throws
an uncaught exception, but now we error out at the moment the user is
still at us, to allow for them to inform admins.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/ipsilon/providers/openid/extensions/ax.py b/ipsilon/providers/openid/extensions/ax.py
index 37fb9f6..a4fdb5e 100644
--- a/ipsilon/providers/openid/extensions/ax.py
+++ b/ipsilon/providers/openid/extensions/ax.py
@@ -2,6 +2,7 @@
 
 from __future__ import absolute_import
 
+from ipsilon.providers.common import AuthenticationError
 from ipsilon.providers.openid.extensions.common import OpenidExtensionBase
 from openid.extensions import ax
 
@@ -47,6 +48,9 @@ class OpenidExtension(OpenidExtensionBase):
                 else:
                     value = userdata[name]
 
+                if '\n' in value:
+                    raise AuthenticationError('Newline in attribute %s' % name)
+
                 added_vals = 0
                 if not isinstance(value, list):
                     value = [value]

