+ 	PYTHONPATH=./ ./tests/tests.py --test=openidc

+ '/protected', a test file is returned at that location.

+   of your web application.  It defaults to ``/protected``, but it can be

+ OPENIDC_TEMPLATE = '/usr/share/ipsilon/templates/install/openidc/rp.conf'

+ CONFFILE = '/etc/httpd/conf.d/ipsilon-%s.conf'

+ HTTPDIR = '/etc/httpd/%s'

+ PROTECTED = '/protected'

+         path = os.path.join(HTTPDIR % 'saml2', args['hostname'])

+         sp_link = 'https://%s%s' % (args['hostname'], args['auth_location'])

+         if args['saml_base'] != args['auth_location']:

+                         '</Location>\n' % args['auth_location']

+         if args['auth_location'] == PROTECTED:

+         files.write_from_template(CONFFILE % 'saml', SAML2_TEMPLATE, samlopts)

+         files.fix_user_dirs(HTTPDIR % 'saml2', args['httpd_user'])

+                     ' then access it at %s%s' % (url, args['auth_location']))

+     path = os.path.join(HTTPDIR % 'saml2', args['hostname'])

+     if os.path.exists(CONFFILE % 'saml'):

+             os.remove(CONFFILE % 'saml')

+ def saml2_add_arguments(parser):

+     parser.add_argument('--saml', action='store_true',

+                         help="Whether to install a saml2 SP")

+     parser.add_argument('--saml-idp-url', default=None,

+                         help="A URL of the IDP to register the SP with")

+     parser.add_argument('--saml-idp-metadata', default=None,

+                         help="A URL pointing at the IDP Metadata (FILE or HTTP)")

+     parser.add_argument('--saml-no-httpd', action='store_true', default=False,

+                         help="Do not configure httpd")

+     parser.add_argument('--saml-base', default='/',

+                         help="Where saml2 authdata is available")

+     parser.add_argument('--saml-sp', default='/saml2',

+                         help="Where saml communication happens")

+     parser.add_argument('--saml-sp-logout', default=None,

+                         help="Single Logout URL")

+     parser.add_argument('--saml-sp-post', default=None,

+                         help="Post response URL")

+     parser.add_argument('--saml-sp-paos', default=None,

+                         help="PAOS response URL, used for ECP")

+     parser.add_argument('--no-saml-soap-logout', action='store_true',

+                         default=False,

+                         help="Disable Single Logout over SOAP")

+     parser.add_argument('--saml-secure-setup', action='store_true',

+                         default=True, help="Turn on all security checks")

+     parser.add_argument('--saml-nameid', default='unspecified',

+                         choices=SAML2_NAMEID_MAP.keys(),

+                         help="SAML NameID format to use")

+     parser.add_argument('--saml-sp-name', default=None,

+                         help="The SP name to register with the IdP")

+     parser.add_argument('--saml-sp-description', default=None,

+                         help="The description of the SP to display on the " +

+                         "portal")

+     parser.add_argument('--saml-sp-visible', action='store_false',

+                         default=True,

+                         help="The SP is visible in the portal")

+     parser.add_argument('--saml-sp-image', default=None,

+                         help="Image to display for this SP on the portal")

+     parser.add_argument('--debug', action='store_true', default=False,

+                         help="Turn on script debugging")

+     parser.add_argument('--config-profile', default=None,

+                         help=argparse.SUPPRESS)

+     parser.add_argument('--saml-auth', default=None,

+                         help="Backwards compatibility. Use --auth-location.")

+ 

+ 

+ def saml2_verify_arguments(args):

+     if args['saml_auth']:

+         logger.warn('--saml-auth is deprecated. Please use --auth-location')

+         args['auth_location'] = args['saml_auth']

+ 

+     # Validate that all path options begin with '/'

+     path_args = ['saml_base', 'auth_location', 'saml_sp', 'saml_sp_logout',

+                  'saml_sp_post', 'saml_sp_paos']

+     for path_arg in path_args:

+         if args[path_arg] is not None and not args[path_arg].startswith('/'):

+             raise ValueError('--%s must begin with a / character.' %

+                              path_arg.replace('_', '-'))

+ 

+     # The saml_sp setting must be a subpath of saml_base since it is

+     # used as the MellonEndpointPath.

+     if not args['saml_sp'].startswith(args['saml_base']):

+         raise ValueError('--saml-sp must be a subpath of --saml-base.')

+ 

+     # The samle_auth setting must be a subpath of saml_base otherwise

+     # the IdP cannot be identified by mod_auth_mellon.

+     if not args['auth_location'].startswith(args['saml_base']):

+         raise ValueError('--auth-location must be a subpath of --saml-base.')

+ 

+     # The saml_sp_logout, saml_sp_post and saml_sp_paos settings must

+     # be subpaths of saml_sp (the mellon endpoint).

+     path_args = {'saml_sp_logout': 'logout',

+                  'saml_sp_post': 'postResponse',

+                  'saml_sp_paos': 'paosResponse'}

+     for path_arg, default_path in path_args.items():

+         if args[path_arg] is None:

+             args[path_arg] = '%s/%s' % (args['saml_sp'].rstrip('/'),

+                                         default_path)

+ 

+         elif not args[path_arg].startswith(args['saml_sp']):

+             raise ValueError('--%s must be a subpath of --saml-sp' %

+                              path_arg.replace('_', '-'))

+ 

+     # If saml_idp_url if being used, we require saml_sp_name to

+     # use when registering the SP.

+     if args['saml_idp_url'] and not args['saml_sp_name']:

+         raise ValueError('--saml-sp-name must be specified when using' +

+                          '--saml-idp-url')

+ 

+ 

+ # OpenID Connect

+ def openidc():

+     logger.info('Installing OpenID Connect Relying Party')

+ 

+     discovery_url = '%s/openidc/wellknown_openid_configuration' % \

+                     args['openidc_idp_url']

+     try:

+         r = requests.get(discovery_url)

+         r.raise_for_status()

+         discovered_info = r.json()

+     except Exception, e:  # pylint: disable=broad-except

+         logger.error("Failed to retrieve IdP configuration!\n" +

+                      "Error: [%s]" % repr(e))

+         raise

+ 

+     if not 'registration_endpoint' in discovered_info:

+         raise ValueError('This IdP does not provide automatic registration')

+ 

+     proto = 'https'

+     port_str = ''

+     if args['port']:

+         port_str = ':%s' % args['port']

+     url = '%s://%s%s%s' % (proto, args['hostname'], port_str,

+                            args['auth_location'])

+     redirect_uri = '%s/redirect_uri' % url

+ 

+     # Generate client metadata

+     client_info = {}

+     client_info['redirect_uris'] = [redirect_uri]

+     client_info['response_types'] = ['code']

+     client_info['grant_types'] = ['authorization_code']

+     client_info['application_type'] = 'web'

+     client_info['client_name'] = 'Ipsilon Client %s' % url

+     client_info['client_uri'] = url

+     client_info['subject_type'] = args['openidc_subject_type']

+ 

+     # Submit client info

+     logger.info('Registering RP with the IdP')

+     try:

+         r = requests.post(discovered_info['registration_endpoint'],

+                           json=client_info)

+         r.raise_for_status()

+         registration_response = r.json()

+     except Exception, e:  # pylint: disable=broad-except

+         logger.error("Failed to register with the IdP!\n" +

+                      "Error: [%s]" % repr(e))

+         raise

+     validate_server = 'On'

+     if args['openidc_skip_ssl_validation']:

+         validate_server = 'Off'

+ 

+     # Generate config

+     openidcopts = {'redirect_uri': redirect_uri,

+                    'crypto_passphrase': base64.b64encode(os.urandom(32))[:32],

+                    'idp_metadata_url': discovery_url,

+                    'client_id': registration_response['client_id'],

+                    'client_secret': registration_response['client_secret'],

+                    'validate_server': validate_server,

+                    'response_type': args['openidc_response_type'],

+                    'auth_location': args['auth_location']}

+     files.write_from_template(CONFFILE % 'openidc', OPENIDC_TEMPLATE,

+                               openidcopts)

+ 

+     logger.info('OpenID Connect Relying Party configured')

+     logger.info('You should be able to restart the HTTPD server and' +

+                 ' then access it at %s%s' % (url, args['auth_location']))

+ 

+ 

+ def openidc_verify_arguments(args):

+     if not args['openidc_idp_url']:

+         raise ValueError('OpenIDC IdP URL needs to be provided')

+ 

+ 

+ def openidc_add_arguments(parser):

+     parser.add_argument('--openidc', action='store_true', default=False,

+                         help='Whether to install an OpenID Connect RP')

+     parser.add_argument('--openidc-idp-url', default=None,

+                         help='A URL of the IdP to register the RP with')

+     parser.add_argument('--openidc-response-type', default='code',

+                         help='Which response type to use, determines the flow')

+     parser.add_argument('--openidc-subject-type', default='pairwise',

+                         help='Which subject type to request: pairwise or ' +

+                              'public')

+     parser.add_argument('--openidc-skip-ssl-validation', action='store_true',

+                         help='Whether to skip validating the IdP SSL cert')

+ 

+ 

+ # Global

+     parser.add_argument('--auth-location', default=PROTECTED,

+                         help="Where authentication is enforced")

+     parser.add_argument('--uninstall', action='store_true', default=False,

+     openidc_add_arguments(parser)

+     saml2_add_arguments(parser)

+ 

+     # Exactly one on this list needs to be specified or we do nothing

+     sp_list = ['saml', 'openidc']

+     service_type = None

+     for sp in sp_list:

+         if args[sp]:

+             if service_type:

+                 raise ValueError('Multiple service types selected')

+             service_type = sp

+     if not service_type:

+         # Since this was our default previously, let's be backwards compatible

+         # and default to SAML2

+         args['saml'] = True

+         service_type = 'saml'

+     if service_type == 'saml':

+         saml2_verify_arguments(args)

+     elif service_type == 'openidc':

+         openidc_verify_arguments(args)

+     return service_type

+         service_type = parse_args()

+             logger.info('Uninstalling Service Provider')

+             #FXIME: ask confirmation

+ 

+             if service_type == 'saml':

+                 saml2_uninstall()

+             elif service_type == 'openidc':

+                 openidc_uninstall()

+ 

+             logger.info('Uninstalled Service Provider')

+             if service_type == 'saml':

+                 saml2()

+             elif service_type == 'openidc':

+                 openidc()

+ import time

+             userdata.update({'_auth_type': auth_type})

+ 

+         userdata.update({'_auth_time': int(time.time())})

+ # Copyright (C) 2016 Ipsilon project Contributors, for license see COPYING

+ 

+ from __future__ import absolute_import

+ 

+ from ipsilon.util.plugin import PluginLoader

+ from ipsilon.util.log import Log

+ 

+ 

+ class OpenidCExtensionBase(Log):

+ 

+     def __init__(self, provider, name, display_name, scopes):

+         self.name = name

+         self.display_name = display_name

+         # A mapping of scope to display string for supported scopes

+         self.scopes = scopes

+         self.enabled = False

+         self.provider = None

+ 

+     def get_scopes(self):

+         if not self.enabled:

+             return []

+ 

+         return self.scopes.keys()

+ 

+     def get_display_name(self):

+         return self.display_name

+ 

+     def get_display_data(self, scopes):

+         if not self.enabled:

+             return {}

+ 

+         display_data = {}

+         for scope in scopes:

+             if scope in self.scopes:

+                 display_data[scope] = self.scopes[scope]

+         return display_data

+ 

+     def enable(self, provider):

+         self.enabled = True

+         self.provider = provider

+ 

+     def disable(self):

+         self.enabled = False

+         self.provider = None

+ 

+ 

+ FACILITY = 'openidc_extensions'

+ 

+ 

+ class LoadExtensions(Log):

+ 

+     def __init__(self):

+         self.plugins = PluginLoader(LoadExtensions,

+                                     FACILITY, 'OpenidCExtension', False)

+         self.plugins.get_plugin_data()

+ 

+         available = self.plugins.available.keys()

+         self.debug('Available Extensions: %s' % str(available))

+ 

+     def enable(self, enabled, provider):

+         for item in enabled:

+             if item not in self.plugins.available:

+                 self.debug('<%s> not available' % item)

+                 continue

+             self.debug('Enable OpenId Connect extension: %s' % item)

+             self.plugins.available[item].enable(provider)

+ 

+     def available(self):

+         return self.plugins.available

+ # Copyright (C) 2016 Ipsilon project Contributors, for license see COPYING

+ 

+ from __future__ import absolute_import

+ 

+ from ipsilon.providers.openidc.plugins.common import OpenidCExtensionBase

+ 

+ 

+ class OpenidCExtension(OpenidCExtensionBase):

+ 

+     def __init__(self, provider, *pargs):

+         name = 'ipsilon'

+         display_name = 'Ipsilon Token API'

+         scopes = {

+             'ipsilon_token': 'Ipsilon token verification'

+         }

+ 

+         super(OpenidCExtension, self).__init__(provider,

+                                                name,

+                                                display_name,

+                                                scopes)

+ # Copyright (C) 2016 Ipsilon project Contributors, for license see COPYING

+ 

+ from ipsilon.util.security import (generate_random_secure_string,

+                                    constant_time_string_comparison)

+ from ipsilon.util.data import Store, UNIQUE_DATA_TABLE

+ 

+ import json

+ import time

+ 

+ 

+ class OpenIDCStore(Store):

+     def __init__(self, database_url):

+         Store.__init__(self, database_url=database_url)

+ 

+     def registerDynamicClient(self, client):

+         data = {}

+ 

+         for key in client:

+             data[key] = json.dumps(client[key])

+ 

+         client_id = self.new_unique_data('client', data)

+ 

+         # Prepend client ID with D- to indicate that this is a dynamic client

+         return 'D-%s' % client_id

+ 

+     def registerStaticClient(self, client):

+         # TODO: Implement static client

+ 

+         client_id = None

+ 

+         # Prepend client ID with S- to indicate that this is a static client

+         return 'S-%s' % client_id

+ 

+     def getClient(self, client_id):

+         if client_id.startswith('D-'):

+             # This is a dynamically registered client

+             client_id = client_id[2:]

+             data = self.get_unique_data('client', client_id)

+         elif client_id.startswith('S-'):

+             # This is a statically configured client

+             client_id = client_id[2:]

+             # TODO: Get the configured client data

+             return None

+         else:

+             # No idea what this is

+             self.debug('Invalid client ID request: %s' % client_id)

+             return None

+ 

+         if len(data) < 1:

+             return None

+ 

+         datum = data[client_id]

+ 

+         for key in datum:

+             datum[key] = json.loads(datum[key])

+ 

+         return datum

+ 

+     def lookupToken(self, token, expected_type, return_expired=False):

+         if '_' not in token:

+             return None

+ 

+         checkfield = 'security_check'

+         if expected_type == 'Refresh' and token.startswith('R_'):

+             checkfield = 'refresh_security_check'

+             token = token[len('R_'):]

+ 

+         token_id, security_check = token.split('_', 1)

+ 

+         data = self.get_unique_data('token', token_id)

+ 

+         if len(data) < 1:

+             return None

+ 

+         datum = data[token_id]

+ 

+         if not constant_time_string_comparison(security_check,

+                                                datum[checkfield]):

+             return None

+ 

+         if not return_expired and \

+                 datum['expires_at'] <= int(time.time()):

+             return None

+ 

+         if expected_type and expected_type != 'Refresh' and \

+                 datum['type'] != expected_type:

+             return None

+ 

+         datum['scope'] = json.loads(datum['scope'])

+         datum['token_id'] = token_id

+ 

+         return datum

+ 

+     def storeAuthorizationIDToken(self, authz_code, signed_id_token):

+         token = self.lookupToken(authz_code, 'Authorization')

+         if not token:

+             return None

+         token['id_token'] = signed_id_token

+         self.update_token(token)

+ 

+     def update_token(self, token):

+         token_id = token['token_id']

+         del token['token_id']

+         token['scope'] = json.dumps(token['scope'])

+ 

+         self.save_unique_data('token', {token_id: token})

+ 

+     def refreshToken(self, refresh_token, client_id):

+         token = self.lookupToken(refresh_token, 'Refresh', True)

+ 

+         if not token:

+             return None

+ 

+         if not constant_time_string_comparison(token['client_id'],

+                                                client_id):

+             return None

+ 

+         if token['type'] != 'Bearer':

+             # Only Bearer tokens are supported

+             return None

+ 

+         if not token['refreshable']:

+             return None

+ 

+         if token['refreshable_until'] and \

+                 token['refreshable_until'] >= int(time.time()):

+             return None

+ 

+         token_security_check = generate_random_secure_string()

+         refresh_security_check = generate_random_secure_string(128)

+         expires_in = 3600

+         # TODO: Figure out values for this

+         refreshable_until = None

+ 

+         token['security_check'] = token_security_check

+         token['refresh_security_check'] = refresh_security_check

+         token['expires_at'] = int(time.time()) + expires_in

+         token['refreshable_until'] = refreshable_until

+ 

+         self.update_token(token)

+ 

+         token = '%s_%s' % (token['token_id'], token_security_check)

+         refresh_token = 'R_%s_%s' % (token['token_id'], refresh_security_check)

+ 

+         return {

+             'access_token': token,

+             'refresh_token': refresh_token,

+             'expires_in': expires_in

+         }

+ 

+     def issueToken(self, client_id, username, scope, issue_refresh,

+                    userinfocode):

+         token_security_check = generate_random_secure_string()

+ 

+         expires_in = 3600

+ 

+         token = {

+             'type': 'Bearer',

+             'security_check': token_security_check,

+             'client_id': client_id,

+             'username': username,

+             'scope': json.dumps(scope),

+             'expires_at': int(time.time()) + expires_in,

+             'issued_at': int(time.time()),

+             'refreshable': False,

+             'userinfocode': userinfocode

+         }

+ 

+         if issue_refresh:

+             token['refreshable'] = True

+             # TODO: Figure out time for this

+             token['refreshable_until'] = None

+             token['refresh_security_check'] = \

+                 generate_random_secure_string(128)

+ 

+         token_id = self.new_unique_data('token', token)

+ 

+         # The refresh token also has a prefix of R_ to make it distinguishable

+         if issue_refresh:

+             refresh_token = 'R_%s_%s' % (token_id,

+                                          token['refresh_security_check'])

+         else:

+             refresh_token = None

+ 

+         # The returned token is the token ID with appended to it the security

+         # check value.

+         # The token ID is used to lookup the token in the database, and the

+         # security check value is used to make the string slightly more

+         # random

+         token = '%s_%s' % (token_id, token_security_check)

+ 

+         return {

+             "token_id": token_id,

+             'access_token': token,

+             'refresh_token': refresh_token,

+             'expires_in': expires_in,

+         }

+ 

+     def invalidateToken(self, token):

+         self.del_unique_data('token', token)

+ 

+     def storeUserInfo(self, userinfo):

+         to_store = {}

+         for key in userinfo:

+             to_store[key] = json.dumps(userinfo[key])

+ 

+         return self.new_unique_data('userinfo', to_store)

+ 

+     def getUserInfo(self, userinfocode):

+         data = self.get_unique_data('userinfo', userinfocode)

+         if len(data) < 1:

+             return None

+ 

+         data = data[userinfocode]

+ 

+         userinfo = {}

+         for key in data:

+             userinfo[key] = json.loads(data[key])

+         return userinfo

+ 

+     def exchangeAuthorizationCode(self, authz_code):

+         token = self.lookupToken(authz_code, 'Authorization')

+         if not token:

+             return None

+ 

+         if 'issued_token' in token:

+             # This authorization code was already used before... We don't know

+             # whether this is a malfunctional client or if the authorization

+             # code got stolen, so let's just revoke the old key and refuse this

+             # request.

+             self.invalidateToken(token['issued_token'])

+             return None

+ 

+         new_token = self.issueToken(token['client_id'], token['username'],

+                                     token['scope'], True,

+                                     token['userinfocode'])

+         if not new_token:

+             return None

+ 

+         if 'id_token' in token:

+             new_token['id_token'] = token['id_token']

+ 

+         token['issued_token'] = new_token['token_id']

+         del new_token['token_id']

+ 

+         self.update_token(token)

+ 

+         return new_token

+ 

+     def issueAuthorizationCode(self, client_id, username, scope, userinfo,

+                                redirect_uri, userinfocode):

+         token_security_check = generate_random_secure_string()

+ 

+         expires_in = 600

+ 

+         token = {

+             'type': 'Authorization',

+             'security_check': token_security_check,

+             'client_id': client_id,

+             'username': username,

+             'scope': json.dumps(scope),

+             'expires_at': int(time.time()) + expires_in,

+             'userinfocode': userinfocode,

+             'redirect_uri': redirect_uri

+         }

+ 

+         token_id = self.new_unique_data('token', token)

+ 

+         # The returned token is the token ID with appended to it the security