PR#128: Make sure that OpenID extensions don't return anything when not requested - ipsilon

ipsilon

#128 Make sure that OpenID extensions don't return anything when not requested

Merged 7 years ago by puiterwijk. Opened 7 years ago by puiterwijk.

puiterwijk/ipsilon openid-extensions-noresp into master

Make sure that OpenID extensions don't return anything when not requested

Patrick Uiterwijk • 7 years ago

029ff6e

ipsilon/providers/openid/extensions/cla.py

file modified

+2 -2

		`@@ -18,13 +18,13 @@`
		`req = cla.CLARequest.fromOpenIDRequest(request)`
		`self.debug(req)`
		`if req is None:`
		`- return {}`
		`+ return None`
		`data = userdata.get('_extras', {}).get('cla', [])`
		`return cla.CLAResponse.extractResponse(req, data)`

		`def _display(self, request, userdata):`
		`resp = self._resp(request, userdata)`
		`- if resp.clas:`
		`+ if resp and resp.clas:`
		`return {'CLA': 'yes'}`
		`return {}`
pingou commented 7 years ago {} or None?
alert("boo! (puiterwijk was here)"); Uiterwijk (puiterwijk)">puiterwijk commented 7 years ago For display, we return {}, for _resp we return None.

ipsilon/providers/openid/extensions/fas_teams.py

file modified

+1 -1

		`@@ -14,7 +14,7 @@`
		`def _resp(self, request, userdata):`
		`req = teams.TeamsRequest.fromOpenIDRequest(request)`
		`if req is None:`
		`- return {}`
		`+ return None`
		`if '_FAS_ALL_GROUPS_' in req.requested:`
		`# We will send all groups the user is a member of`
		`req.requested = userdata.get('_groups', [])`

ipsilon/providers/openid/extensions/sreg.py

file modified

+5 -1

		`@@ -17,6 +17,8 @@`

		`def _resp(self, request, userdata):`
		`req = sreg.SRegRequest.fromOpenIDRequest(request)`
		`+ if req is None:`
		`+ return None`
		`data = dict()`
		`for name in sreg.data_fields:`
		`if name in userdata:`
		`@@ -25,7 +27,9 @@`

		`def _display(self, request, userdata):`
		`resp = self._resp(request, userdata)`
		`- return resp.data`
		`+ if resp and resp.data:`
		`+ return resp.data`
		`+ return {}`
pingou commented 7 years ago {} or None?

		`def _response(self, request, userdata):`
		`return self._resp(request, userdata)`

ipsilon/providers/openid/extensions/teams.py

file modified

+2 -2

		`@@ -17,13 +17,13 @@`
		`def _resp(self, request, userdata):`
		`req = teams.TeamsRequest.fromOpenIDRequest(request)`
		`if req is None:`
		`- return {}`
		`+ return None`
		`data = userdata.get('_groups', [])`
		`return teams.TeamsResponse.extractResponse(req, data)`

		`def _display(self, request, userdata):`
		`resp = self._resp(request, userdata)`
		`- if resp.teams:`
		`+ if resp and resp.teams:`
		`return {'Groups': resp.teams}`
		`return {}`

puiterwijk commented 7 years ago

This makes sure that our OpenID extensions don't provide any responses if they were
not requested, instead of providing empty responses.
Some Relying Parties don't like to get responses for extensions they didn't ask for.

Signed-off-by: Patrick Uiterwijk puiterwijk@redhat.com

pingou commented on line 17 of ipsilon/providers/openid/extensions/sreg.py 7 years ago

{} or None?

pingou commented on line 15 of ipsilon/providers/openid/extensions/cla.py 7 years ago

{} or None?

puiterwijk commented on line 15 of ipsilon/providers/openid/extensions/cla.py 7 years ago

For display, we return {}, for _resp we return None.

pingou commented 7 years ago

:thumbsup: for me

rebased

7 years ago

Pull-Request has been merged by puiterwijk