'admin_user': '${TEST_USER}',

           'system_user': '${TEST_USER}',

           'instance': '${NAME}',

           'testauth': 'yes',

           'pam': 'no',

           'gssapi': 'no',

          'SAML2_HTTPDIR': '${TESTDIR}/${NAME}/saml2'}

          'saml_auth': '/sp',

          'httpd_user': '${TEST_USER}'}

      user = pwd.getpwuid(os.getuid())[0]

      sess = HttpSessions()

      print "attrs: Authenticate to IDP ...",

      try:

      print "attrs: Access SP Protected Area Variables...",

      try:

          page = sess.fetch_page(idpname,

          page.expected_value('text()', 'Test User %s' % user)

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

  import cherrypy

  import os

  import pwd

  from openid.consumer import consumer

  from openid.extensions import sreg, ax

  from openid_teams import teams

  sys.stdout = sys.stderr

  class OpenIDApp(object):

      def index(self, extensions):

          self.extensions = extensions == 'YES'

          oidconsumer = consumer.Consumer(dict(), None)

          try:

          except Exception as ex:

              return 'ERROR: %s' % ex

              return 'ERROR: Cancelled'

          elif info.status == consumer.SUCCESS:

              username = pwd.getpwuid(os.getuid())[0]

              if expected_identifier != display_identifier:

                  return 'ERROR: Wrong id returned: %s != %s' % (

                      expected_identifier,

           'admin_user': '${TEST_USER}',

           'system_user': '${TEST_USER}',

           'instance': '${NAME}',

           'testauth': 'yes',

           'pam': 'no',

           'gssapi': 'no',

      user = pwd.getpwuid(os.getuid())[0]

      sess = HttpSessions()

                      'ipsilon')

      print "dbupgrades: From v%s: Authenticate to IDP ..." % from_version,

           'admin_user': '${TEST_USER}',

           'system_user': '${TEST_USER}',

           'instance': '${NAME}',

           'testauth': 'yes',

           'pam': 'no',

           'gssapi': 'no',

  saml2 idp certificate file = ${TESTDIR}/lib/${NAME}/saml2/idp.pem

  saml2 idp nameid salt = ${IDPSALT}

  [saml2_data]

  811d0231-9362-46c9-a105-a01a64818904 type = SP

  811d0231-9362-46c9-a105-a01a64818904 name = ${SPNAME}

  811d0231-9362-46c9-a105-a01a64818904 metadata = ${SPMETA}

          'SAML2_HTTPDIR': '${TESTDIR}/${NAME}/saml2'}

          'saml_idp_metadata': '${TESTDIR}/lib/idp1/saml2/metadata.xml',

          'saml_auth': '/sp',

          'httpd_user': '${TEST_USER}'}

  def fixup_idp_conf(testdir):

      with open(os.path.join(testdir, spname, 'saml2',

          spmeta = f.read()

      spmeta = spmeta.replace("\n", "")

      idpsalt = uuid.uuid4().hex

      t = Template(idp_file_conf)

      user = pwd.getpwuid(os.getuid())[0]

      sess = HttpSessions()

      print "fconf: Access IdP Homepage ... ",

      try:

          page.expected_value('//title/text()', 'Ipsilon')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "fconf: Access SP Protected Area ...",

      try:

          page.expected_value('text()', 'WORKS!')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

          os.mkdir(os.path.join(self.testdir, 'lib', test.name))

          os.mkdir(os.path.join(self.testdir, 'log'))

          os.mkdir(os.path.join(self.testdir, 'cache'))

      def generate_profile(self, global_opts, args_opts, name, addr, port,

                           nameid='unspecified'):

          newconf = ConfigParser.ConfigParser()

          newconf.add_section('globals')

          for k in global_opts:

              t = Template(f.read())

              text = t.substitute({'HTTPROOT': httpdir,

                                   'HTTPADDR': addr,

          filename = os.path.join(httpdir, 'httpd.conf')

          with open(filename, 'w+') as f:

              f.write(text)

          return filename

      def setup_idp_server(self, profile, name, addr, port, env):

          http_conf_file = self.setup_http(name, addr, port)

          cmd = [os.path.join(self.rootdir,

      def start_http_server(self, conf, env):

          env['MALLOC_CHECK_'] = '3'

          env['MALLOC_PERTURB_'] = str(random.randint(0, 32767) % 255 + 1)

          p = subprocess.Popen(['/usr/sbin/httpd', '-DFOREGROUND', '-f', conf],

                               env=env, preexec_fn=os.setsid)

          self.processes.append(p)

                  'visible': True,

                  'description': desc,

                  'image': 'Zm9v',

              }

              headers['content-type'] = 'application/x-www-form-urlencoded'

              url = '%s/%s/rest/providers/saml2/SPS/%s' % (idpuri, idp, desc)

  ServerRoot "${HTTPROOT}"

  LoadModule access_compat_module modules/mod_access_compat.so

  LoadModule actions_module modules/mod_actions.so

  LoadModule socache_memcache_module modules/mod_socache_memcache.so

  LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

  LoadModule status_module modules/mod_status.so

  LoadModule substitute_module modules/mod_substitute.so

  LoadModule suexec_module modules/mod_suexec.so

  LoadModule unique_id_module modules/mod_unique_id.so

  LoadModule auth_gssapi_module modules/mod_auth_gssapi.so

  LoadModule auth_mellon_module modules/mod_auth_mellon.so

  <Directory />

      AllowOverride none

           'admin_user': 'tuser',

           'system_user': '${TEST_USER}',

           'instance': '${NAME}',

           'pam': 'no',

           'gssapi': 'no',

           'ipa': 'no',

          'SAML2_HTTPDIR': '${TESTDIR}/${NAME}/saml2'}

          'saml_auth': '/sp',

          'httpd_user': '${TEST_USER}'}

      user = 'tuser'

      sess = HttpSessions()

      print "test1: Authenticate to IDP ...",

      try:

      print "test1: Access SP Protected Area ...",

      try:

          page = sess.fetch_page(idpname,

          page.expected_value('text()', 'Test Group;Test Group 2')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

           'admin_user': 'tuser',

           'system_user': '${TEST_USER}',

           'instance': '${NAME}',

           'pam': 'no',

           'gssapi': 'no',

           'ipa': 'no',

          'SAML2_HTTPDIR': '${TESTDIR}/${NAME}/saml2'}

          'saml_auth': '/sp',

          'httpd_user': '${TEST_USER}'}

      user = 'tuser'

      sess = HttpSessions()

      print "ldapdown: Authenticate to IDP with no LDAP backend...",

      try:

           'admin_user': '${TEST_USER}',

           'system_user': '${TEST_USER}',

           'instance': '${NAME}',

           'testauth': 'yes',

           'openid': 'yes',

           'openid_extensions': 'Attribute Exchange,Simple Registration,Teams',

      user = pwd.getpwuid(os.getuid())[0]

      sess = HttpSessions()

      print "openid: Authenticate to IDP ...",

      try:

      print "openid: Run OpenID Protocol ...",

      try:

          page = sess.fetch_page(idpname,

          page.expected_value('text()', 'SUCCESS, WITHOUT EXTENSIONS')

      except ValueError as e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "openid: Run OpenID Protocol with extensions ...",

      try:

          page = sess.fetch_page(idpname,

          page.expected_value('text()', 'SUCCESS, WITH EXTENSIONS')

      except ValueError as e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

           'system_user': '${TEST_USER}',

           'instance': '${NAME}',

           'openid': 'False',

           'testauth': 'yes',

           'pam': 'no',

           'gssapi': 'no',

          'SAML2_HTTPDIR': '${TESTDIR}/${NAME}/saml2'}

          'saml_auth': '/sp',

          'httpd_user': '${TEST_USER}'}

      user = pwd.getpwuid(os.getuid())[0]

      sess = HttpSessions()

      print "pgdb: Authenticate to IDP ...",

      sys.stdout.flush()

      print "pgdb: Access SP Protected Area ...",

      try:

          page.expected_value('text()', 'WORKS!')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "pgdb: Logout from SP ...",

      try:

          page = sess.fetch_page(idpname, '%s/%s?%s' % (

          page.expected_value('text()', 'Logged out')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

           'admin_user': '${TEST_USER}',

           'system_user': '${TEST_USER}',

           'instance': '${NAME}',

           'testauth': 'yes',

           'pam': 'no',

           'gssapi': 'no',

          'SAML2_HTTPDIR': '${TESTDIR}/${NAME}/saml2'}

          'saml_auth': '/sp',

          'httpd_user': '${TEST_USER}'}

           'SAML2_CONFFILE': '${TESTDIR}/${NAME}/conf.d/ipsilon-saml.conf',

           'SAML2_HTTPDIR': '${TESTDIR}/${NAME}/saml2'}

           'admin_user': '${TEST_USER}',

           'admin_password': '${TESTDIR}/pw.txt',

           'saml_sp_name': 'sp2-test.example.com',

           'saml_auth': '/sp',

           'httpd_user': '${TEST_USER}'}

      user = pwd.getpwuid(os.getuid())[0]

      sess = HttpSessions()

      print "test1: Authenticate to IDP ...",

      try:

      print "test1: Access first SP Protected Area ...",

      try:

          page.expected_value('text()', 'WORKS!')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "test1: Access second SP Protected Area ...",

      try:

          page.expected_value('text()', 'WORKS!')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "test1: Try authentication failure ...",

      newsess = HttpSessions()

      try:

          newsess.auth_to_idp(idpname)

          print >> sys.stderr, " ERROR: Authentication should have failed"

      print "test1: Add keyless SP Metadata to IDP ...",

      try:

          sess.add_metadata(idpname, 'keyless', keyless_metadata)

                                          'providers/saml2/admin')

          page.expected_value('//div[@id="row_provider_http://keyless-sp"]/'

                              '@title',

           'admin_user': '${TEST_USER}',

           'system_user': '${TEST_USER}',

           'instance': '${NAME}',

           'testauth': 'yes',

           'pam': 'no',

           'gssapi': 'yes',

          'SAML2_HTTPDIR': '${TESTDIR}/${NAME}/saml2'}

          'saml_idp_metadata':

          'saml_auth': '/sp',

          'httpd_user': '${TEST_USER}'}

           'SAML2_CONFFILE': '${TESTDIR}/${NAME}/conf.d/ipsilon-saml.conf',

           'SAML2_HTTPDIR': '${TESTDIR}/${NAME}/saml2'}

           'admin_user': '${TEST_USER}',

           'admin_password': '${TESTDIR}/pw.txt',

           'saml_sp_name': 'sp2',

           'saml_auth': '/sp',

           'httpd_user': '${TEST_USER}'}

          os.environ[key] = kenv[key]

      sess = HttpSessions()

                      'ipsilon')

      print "testgssapi: Authenticate to IDP ...",

      try:

      print "testgssapi: Access first SP Protected Area ...",

      try:

          page.expected_value('text()', 'WORKS!')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "testgssapi: Access second SP Protected Area ...",

      try:

          page.expected_value('text()', 'WORKS!')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

           'admin_user': '${TEST_USER}',

           'system_user': '${TEST_USER}',

           'instance': '${NAME}',

           'testauth': 'yes',

           'pam': 'no',

           'gssapi': 'no',

          'SAML2_HTTPDIR': '${TESTDIR}/${NAME}/saml2'}

          'saml_auth': '/sp',

          'httpd_user': '${TEST_USER}'}

          'no_saml_soap_logout': 'True',

          'saml_auth': '/sp',

          'httpd_user': '${TEST_USER}'}

      user = pwd.getpwuid(os.getuid())[0]

      sess = HttpSessions()

      for sp in splist:

          spname = sp['nameid']

          sess.add_server(spname, spurl)

      print "testlogout: Authenticate to IDP ...",

      print "testlogout: Logout without logging into SP ...",

      try:

          page = sess.fetch_page(idpname, '%s/%s?%s' % (

          page.expected_value('text()', 'Logged out')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "testlogout: Access SP Protected Area ...",

      try:

          page.expected_value('text()', 'WORKS!')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "testlogout: Logout from SP ...",

      try:

          page = sess.fetch_page(idpname, '%s/%s?%s' % (

          page.expected_value('text()', 'Logged out')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "testlogout: Try logout again ...",

      try:

          page = sess.fetch_page(idpname, '%s/%s?%s' % (

          page.expected_value('text()', 'Logged out')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "testlogout: Ensure logout ...",

      try:

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

          sys.exit(1)

          print "testlogout: Access SP Protected Area of each SP ...",

          for sp in splist:

              spname = sp['nameid']

              try:

                  page = sess.fetch_page(idpname, spurl)

                  page.expected_value('text()', 'WORKS!')

          print "testlogout: Initiate logout from %s ..." % sporder['nameid'],

          try:

              page = sess.fetch_page(idpname, '%s/%s?%s' % (

                  logouturl, 'saml2/logout',

              page.expected_value('text()', 'Logged out')

          except ValueError, e:

              print >> sys.stderr, " ERROR: %s" % repr(e)

          print "testlogout: Ensure logout of each SP ...",

          for sp in splist:

              spname = sp['nameid']

              try:

                  ensure_logout(sess, idpname, spurl)

              except ValueError, e:

      # Test IdP-initiated logout

      print "testlogout: Access SP Protected Area of SP1...",

      try:

          page.expected_value('text()', 'WORKS!')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "testlogout: Access SP Protected Area of SP2...",

      try:

          page.expected_value('text()', 'WORKS!')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "testlogout: Access the IdP...",

      try:

          page.expected_value('//div[@id="welcome"]/p/text()',

                              'Welcome %s!' % user)

      except ValueError, e:

      print "testlogout: IdP-initiated logout ...",

      try:

          page = sess.fetch_page(idpname,

          page.expected_value('//div[@id="content"]/p/a/text()', 'Log In')

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

      print "testlogout: Ensure logout of SP1 ...",

      try:

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

          sys.exit(1)

      print "testlogout: Ensure logout of SP2 ...",

      try:

      except ValueError, e:

          print >> sys.stderr, " ERROR: %s" % repr(e)

          sys.exit(1)

      print "testlogout: Access the IdP...",

      try:

          page = sess.fetch_page(idpname,

          page.expected_value('//div[@id="welcome"]/p/text()',

                              'Welcome %s!' % user)

      except ValueError, e:

      print "testlogout: IdP-initiated logout with no SP sessions...",

      try:

          page = sess.fetch_page(idpname,

          page.expected_value('//div[@id="logout"]/p//text()',

                              'Successfully logged out.')

      except ValueError, e:

           'admin_user': '${TEST_USER}',

           'system_user': '${TEST_USER}',

           'instance': '${NAME}',

           'testauth': 'yes',

           'pam': 'no',

           'gssapi': 'no',

          'SAML2_HTTPDIR': '${TESTDIR}/${NAME}/saml2'}

          'saml_auth': '/sp',

          'saml_nameid': '${NAMEID}',

          'httpd_user': '${TEST_USER}'}

      idpname = 'idp1'

      user = pwd.getpwuid(os.getuid())[0]

      sp = sp_list[0]

      # Set global mapping and allowed attributes, then test fetch from

      # SP.

      sess = HttpSessions()

      sess.add_server(sp['name'], spurl)

      print "testmapping: Authenticate to IDP ...",