testdeps:

  	# Determine if test deps are installed

  	# First, some binaries

  	which pep8

  	which httpd

  	which postgres

  	python -c 'import ldap'

  	python -c 'import pam'

  	python -c 'import fedora'

  	python -c 'import jinja2'

  	python -c 'import psycopg2'

  	# And now everything else

          # W0613 - unused argument

  	# Ignore cherrypy class members as they are dynamically added

  	# Ignore IPA API class members as they are dynamically added

  		   --notes= \

  		   --ignored-classes=cherrypy,API \

  		   --disable=star-args \

  pep8:

  	# Check style consistency

  security:

  	# Run a static analyzer aimed at security (OpenStack Bandit)

  	git ls-files | xargs pycscope

  lp-test:

  		   --notes= \

  		   --ignored-classes=cherrypy \

  		   --disable=star-args \

  	echo "Testdir: $(TESTDIR)"

  	./runtests --path=$(TESTDIR)

  unittests:

  sdist:

  	python setup.py sdist

  # Testing within containers

  container-centos6:

  	@echo "Building CentOS 6 container ..."

  container-centos7:

  	@echo "Building CentOS 7 container ..."

  	@echo "CentOS 7 container built"

  container-fedora28:

  	@echo "Building Fedora 28 container ..."

  	@echo "Fedora 28 container built"

  container-fedora29:

  	@echo "Building Fedora 29 container ..."

  	@echo "Fedora 29 container built"

  containers: container-centos6 container-centos7 container-fedora28 container-fedora29

  import cherrypy

  import logging

  from ipsilon.util.page import Page

  from ipsilon.util.page import admin_protect

  from ipsilon.util.endpoint import allow_iframe

          conf = self._po.get_config_obj()

              if name in kwargs:

                  value = kwargs[name]

                  if isinstance(option, pconfig.List):

  def get_complex_list_value(name, old_value, **kwargs):

      delete = list()

      change = dict()

          if not key.startswith(name):

              continue

          n = key[len(name):]

              del change[i]

      # perform requested changes

          if val.startswith(('http://', 'https://')):

              val_list = [val]

          else:

      # the previous loop may add 'None' entries

      # if any still exists mark them to be deleted

          if value[i] is None:

              delete.append(i)

  def get_mapping_list_value(name, old_value, **kwargs):

      delete = list()

      change = dict()

          if not key.startswith(name):

              continue

          n = key[len(name):]

              del change[i]

      # perform requested changes

          for k in 'from', 'to':

              if k in fields:

                  val = fields[k]

      # the previous loop may add 'None' entries

      # if any still exists mark them to be deleted

          if value[i] is None:

              delete.append(i)

  from ipsilon.util.policy import Policy

  from ipsilon.util import config as pconfig

  import ldap

  import subprocess

          elif len(result) > 1:

              raise Exception('No unique user object could be found!')

          data = dict()

              if isinstance(value, list) and len(value) == 1:

                  value = value[0]

              data[name] = value

      def _get_posix_groups(self, user, group):

          groups = set()

              # On python2, None is not callable. On python3, this is a function

              # pylint: disable=not-callable

              for i in ids:

                  try:

                      g = grp.getgrgid(i)

  from ipsilon.tools.saml2metadata import SAML2_SERVICE_MAP

  from ipsilon.tools.certs import Certificate

  from ipsilon.tools import files

  import argparse

  import getpass

  import json

  import logging

  import pwd

  import requests

  import shutil

  import socket

  import sys

  import base64

          path = os.path.join(HTTPDIR % 'saml2', args['hostname'])

          if os.path.exists(path):

              raise Exception('Service Provider is already configured')

      else:

          path = os.getcwd()

      if not args['saml_no_httpd']:

          idp_metafile = os.path.join(path, 'idp-metadata.xml')

              f.write(idpmeta)

          saml_protect = 'auth'

  def saml2_verify_arguments(args):

      if args['saml_auth']:

          args['auth_location'] = args['saml_auth']

      # Validate that all path options begin with '/'

  def parse_config_profile(args):

      files = config.read(args['config_profile'])

      if len(files) == 0:

          raise ConfigurationError('Config Profile file %s not found!' %

              elif service_type == 'openidc':

                  openidc()

      except Exception as e:  # pylint: disable=broad-except

          log_exception(e)

          if 'uninstall' in args and args['uninstall'] is True:

              logging.info('Uninstallation aborted.')

  import argparse

  import cherrypy

  import logging

  import os

  import sys

  import unicodedata

  from ipsilon.authz.common import AuthzProviderInstall

  from ipsilon.util.data import UserStore

  from ipsilon.tools import files, dbupgrade

  import argparse

  import cherrypy

  import json

  import pwd

  import shutil

  import socket

  import subprocess

  import sys

  import time

  WSGI_SOCKET_PREFIX = None

      def __init__(self, message):

  #Silence cherrypy logging to screen

      if os.path.exists(idp_conf):

          shutil.move(idp_conf, '%s.backup.%s' % (idp_conf, now))

      if not os.path.exists(instance_conf):

      confopts = {'instance': args['instance'],

                  'instanceurl': args['instanceurl'],

                  'needs_mount': args.get('needs_mount'),

      if not os.path.exists(args['httpd_conf']):

          os.symlink(idp_conf, args['httpd_conf'])

      if not os.path.exists(args['public_data_dir']):

      if not os.path.exists(args['wellknown_dir']):

      sessdir = os.path.join(args['data_dir'], 'sessions')

      if not os.path.exists(sessdir):

      data_conf = os.path.join(args['data_dir'], 'ipsilon.conf')

      if not os.path.exists(data_conf):

          os.symlink(ipsilon_conf, data_conf)

      data_dir = os.path.join(DATADIR, args['instance'])

      try:

          tconf.read(os.path.join(instance_conf, 'ipsilon.conf'))

          cache_dir = tconf.get('global', 'cache_dir')

          cache_dir = None

      else:

          cache_dir = cache_dir.replace('"', '')

  def parse_config_profile(args):

      files = config.read(args['config_profile'])

      if len(files) == 0:

          raise ConfigurationError('Config Profile file %s not found!' %

          opts = parse_args(fplugins)

          logger.debug('Installation arguments:')

              logger.debug('%s: %s', k, opts[k])

          if not opts['root_instance'] and opts['instance'] == 'root':

  import atexit

  import string

  import cherrypy

  from ipsilon import find_config

  from ipsilon.util.data import AdminStore

  from ipsilon.util import page

                             extensions=['jinja2.ext.autoescape'])

  transchars = string.punctuation.replace('-', '').replace('.', '')

  if __name__ == "__main__":

      conf = {'global': {'server.socket_host': '0.0.0.0'},

              '/': {'tools.staticdir.root': os.getcwd(),

              lh.search_s(test_dn, ldap.SCOPE_BASE,

                          attrlist=['objectclasses'])

          except ldap.INSUFFICIENT_ACCESS:

          except ldap.UNWILLING_TO_PERFORM:  # probably minSSF issue

          except ldap.SERVER_DOWN:

          except ldap.NO_SUCH_OBJECT:

              logging.error('Base DN not found')

              return False

          # We base64 encode the trust_root when looking up consent data to

          # ensure the client ID is safe for the cherrypy url routing

          if consentdata is not None:

              # Consent has already been granted

              self.debug('Consent already granted')

              # Store new consent

              consentdata = {

              }

              # all done we consent!

              return self._respond(self._response(request, us))

  from copy import deepcopy

  import logging

  import re

  INVALID_IN_CLIENT_ID = r'[^a-zA-Z0-9\-\.]'

          conf = self.client.get_config_obj()

              if name in kwargs:

                  value = kwargs[name]

                  if isinstance(option, pconfig.List):

      unknown_client.exposed = True

      def __getattr__(self, attr):

          client = self.main.cfg.datastore.getClient(attr)

          if client is None:

              return self.unknown_client()

          response = {'error': error}

          if description:

              response['error_description'] = description

          cherrypy.response.headers.update({

              'Content-Type': 'application/json'

          })

                             'client authentication error')

          self._set_apistore_key('api_client_authenticated', True)

          self._set_apistore_key('api_client_id', client_id)

          self._set_apistore_key('api_client', client)

                  hdr = hdr[len('Basic '):]

                  try:

                      client_id, client_secret = \

                  except Exception as e:  # pylint: disable=broad-except

                      self.error('Invalid request received: %s' % repr(e))

                  self.debug('Client ID: %s' % client_id)

                  self._handle_client_authentication('client_secret_basic',

                                                     client_id,

  import requests

  import time

  import json

  URLROOT = 'openidc'

              else:

                  url += '&'

          if response_mode in ['query', 'fragment', 'none']:

              raise cherrypy.HTTPRedirect(url)

                  # We are guaranteed that we either have a sector_identifier_uri

                  # or that the hostpart of all redirect_uris are equal

                  domain = get_url_hostpart(client['redirect_uris'][0])

              userinfo['sub'] = h.hexdigest()

          claims_userinfo = {}

  import json

  import time

  import requests

  def get_url_hostpart(url):

              clt.generate_secret()

          except InvalidMetadata as ex:

              raise APIError(400, 'invalid_client_metadata',

          except InvalidRedirectURI as ex:

              raise APIError(400, 'invalid_redirect_uri',

          except pconfig.FieldValueError as ex:

              raise APIError(400, 'invalid_request',

                             'invalid field value for %s' % ex.field)

      def generate_public(self):

          metadata = {}

              name = option.replace(' ', '_').lower()

              metadata[name] = value.get_value()

          return metadata

          data = {}

          for key in client:

              data[key] = json.dumps(client[key])

          client_id = self.new_unique_data('client', data)

          return clients

      def getClient(self, client_id):

          if client_id.startswith('D-'):

              # This is a dynamically registered client

              ctype = 'dynamic'

              return None

          if not return_expired and \

              return None

          if expected_type and expected_type != 'Refresh' and \

  import requests

  import logging

  import base64

  class NewSPAdminPage(AdminPage):

              if ctype != 'multipart/form-data':

                  self.debug("Invalid form type (%s), trying to cope" % (

                             cherrypy.request.content_type,))

                  if key == 'name':

                      name = value

                  elif key == 'description':

          conf = self.sp.get_config_obj()

              if name in kwargs:

                  value = kwargs[name]

                  if isinstance(option, pconfig.List):

          if len(new_db_values) != 0:

              try:

                  # Validate user can make these changes

                      if key == 'Name':

                          if (not self.user.is_admin and

                                  self.user.name != self.sp.owner):

                              )

                  # Make changes in current config

                      if name not in new_db_values:

                          continue

                      value = new_db_values.get(name, False)

                      "idp nameid salt is not set in configuration"

                  )

              value = hashlib.sha512()

              nameid = '_' + value.hexdigest()

          elif nameidfmt == lasso.SAML2_NAME_IDENTIFIER_FORMAT_TRANSIENT:

              nameid = '_' + uuid.uuid4().hex

                      self.log('Ignoring None value for attribute %s' % key)

                      continue

                  self.debug('value %s' % value)

                  node = lasso.MiscTextNode.newWithString(value)

                  node.textChild = True

                  attrvalue = lasso.Saml2AttributeValue()

      if len(newsps) != 1:

          raise InvalidProviderMetadata("Metadata must contain one Provider")

      return spid

          data = self.cfg.get_data(name='id', value=provider_id)

          if len(data) != 1:

              raise InvalidProviderId('multiple matches')

          data = self.cfg.get_data(idval=idval)

          self._properties = data[idval]

          self._staging = dict()

          self.load_config()

          self.logout_mechs = []

          logout = xmldoc.xpath('//md:EntityDescriptor'

                                '/md:SPSSODescriptor'

                                '/md:SingleLogoutService',

          data = self.cfg.get_data(name='id', value=self.provider_id)

          if len(data) != 1:

              raise InvalidProviderId('Could not find SP data')

          data = dict()

          data[idval] = self._staging

          self.cfg.save_data(data)

          data = self.cfg.get_data(name='id', value=self.provider_id)

          if len(data) != 1:

              raise InvalidProviderId('Could not find SP data')

          self.cfg.del_datum(idval)

      def normalize_username(self, username):

          data = self.cfg.get_data(name='id', value=spid)

          if len(data) != 1:

              raise InvalidProviderId("Internal Error")

          data = self.cfg.get_data(idval=idval)

          sp = data[idval]

          self.cfg.idp.add_provider(sp)

              data = idp.get_data(name='name', value=instance)

              if len(data) == 0:

                  return rest_error(404, 'Provider %s not found' % instance)

              data = idp.get_data(idval=idval)

          else:

              data = idp.get_data()

          session_ids = []

          for c in candidates:

              if c[key].get('provider_id') == provider_id:

                  samlsession = self._data_to_samlsession(key, c[key])

          return tuple(session_ids)

          for mech in logout_mechs:

              for c in candidates:

                  if ((int(c[key].get('logoutstate', 0)) == LOGGED_IN) and

                          (mech in c[key].get('supported_logout_mechs'))):

                      samlsession = self._data_to_samlsession(key, c[key])

          #        it's the "right" one if multiple logouts are started

          #        at the same time from different SPs?

          for c in candidates:

              if int(c[key].get('logoutstate', 0)) == INIT_LOGOUT:

                  samlsession = self._data_to_samlsession(key, c[key])

                  return samlsession

          count = 0

          for c in candidates:

              samlsession = self._data_to_samlsession(key, c[key])

              self.debug('session %d: %s' % (count, samlsession.convert()))

              count += 1

  from ipsilon.tools.certs import Certificate

  from ipsilon.tools import saml2metadata as metadata

  from ipsilon.tools import files

  from ipsilon.util.constants import SOAP_MEDIA_TYPE, XML_MEDIA_TYPE

  from ipsilon.util.user import UserSession

  from ipsilon.util.plugin import PluginObject

  from subprocess import Popen

  import os

  class Certificate(object):

          if cert[-1] == '-----END CERTIFICATE-----\n':

              cert = cert[:-1]

  from ipsilon.tools.certs import Certificate

  from lxml import etree

  import lasso