From a8795a1507ccfa9daf081c35df083c915dd1242a Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jun 27 2016 12:08:56 +0000 Subject: [PATCH 1/3] Add ssh and gpg key id mappings to authfas Signed-off-by: Patrick Uiterwijk Reviewed-by: Pierre-Yves Chibon --- diff --git a/ipsilon/login/authfas.py b/ipsilon/login/authfas.py index eee0438..2177eba 100644 --- a/ipsilon/login/authfas.py +++ b/ipsilon/login/authfas.py @@ -1,4 +1,4 @@ -# Copyright (C) 2014 Ipsilon project Contributors, for license see COPYING +# Copyright (C) 2014,2016 Ipsilon project Contributors, for license see COPYING from ipsilon.login.common import LoginFormBase, LoginManagerBase, \ LoginManagerInstaller @@ -35,6 +35,8 @@ fas_mapping = [ ['human_name', 'fullname'], ['email', 'email'], ['timezone', 'timezone'], + ['ssh_key', 'ssh_key'], + ['gpg_keyid', 'gpg_keyid'], ] @@ -84,6 +86,9 @@ class FAS(LoginFormBase): def make_userdata(self, fas_data): userdata, fas_extra = self.mapper.map_attributes(fas_data) + # We need to split ssh keys by newline, since we can't send newlines + userdata['ssh_key'] = userdata['ssh_key'].split('\n') + # compute and store groups and cla groups userdata['_groups'] = [] userdata['_extras'] = {'fas': fas_extra, 'cla': []} From 7bb91fe218ba6afd6c446b34ad426799eaf4e98d Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jun 27 2016 12:09:00 +0000 Subject: [PATCH 2/3] Support sending multiple OpenID AX values This allows us to send list a list of attribute values in a standard compliant method. We now process the number of requested values of any requested attribute, and only send up to the maximum requested number. Signed-off-by: Patrick Uiterwijk Reviewed-by: Pierre-Yves Chibon --- diff --git a/ipsilon/providers/openid/extensions/ax.py b/ipsilon/providers/openid/extensions/ax.py index f1996ce..37fb9f6 100644 --- a/ipsilon/providers/openid/extensions/ax.py +++ b/ipsilon/providers/openid/extensions/ax.py @@ -38,12 +38,24 @@ class OpenidExtension(OpenidExtensionBase): return None resp = ax.FetchResponse(req) for name in req.requested_attributes: + attr = req.requested_attributes[name] try: self.debug(name) + value = None if name in AP_MAP: - resp.addValue(name, userdata[AP_MAP[name]]) + value = userdata[AP_MAP[name]] else: - resp.addValue(name, userdata[name]) + value = userdata[name] + + added_vals = 0 + if not isinstance(value, list): + value = [value] + for val in value: + val = val.strip() + if attr.wantsUnlimitedValues() or added_vals < attr.count: + if val != '': + added_vals += 1 + resp.addValue(name, val) except Exception: # pylint: disable=broad-except pass return resp From d39f7638e65d91d4ceb00ce23143a241b8d8d071 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jun 27 2016 12:09:02 +0000 Subject: [PATCH 3/3] Error out if requested to send newline via OpenID AX The kv serialization format of OpenID used for verification in stateless protocol runs, attributes values containing newlines are impossible. Previously, we would throw a 500 because the python-openid library throws an uncaught exception, but now we error out at the moment the user is still at us, to allow for them to inform admins. Signed-off-by: Patrick Uiterwijk Reviewed-by: Pierre-Yves Chibon --- diff --git a/ipsilon/providers/openid/extensions/ax.py b/ipsilon/providers/openid/extensions/ax.py index 37fb9f6..a4fdb5e 100644 --- a/ipsilon/providers/openid/extensions/ax.py +++ b/ipsilon/providers/openid/extensions/ax.py @@ -2,6 +2,7 @@ from __future__ import absolute_import +from ipsilon.providers.common import AuthenticationError from ipsilon.providers.openid.extensions.common import OpenidExtensionBase from openid.extensions import ax @@ -47,6 +48,9 @@ class OpenidExtension(OpenidExtensionBase): else: value = userdata[name] + if '\n' in value: + raise AuthenticationError('Newline in attribute %s' % name) + added_vals = 0 if not isinstance(value, list): value = [value]