summaryrefslogtreecommitdiffstats
path: root/idp/extra/modules/saml2.py
blob: 2b6936365d3c20cf0bf64451e0a8193b93e4a556 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
from quixote import get_session

from qommon import get_cfg
from qommon import errors
from qommon import template

import liberty.saml2

import misc

import directory

def check_access_authorizations(provider_key):
    session = get_session()
    if not session or session.user is None:
        return False

    user = get_session().get_user_object()
    if user.is_admin():
        return True

    collectivity = user.get_collectivity()
    service_instances = directory.get_service_instances(collectivity)

    providers = get_cfg('providers', {})
    accesses = user.get_as_agent().cdg59serviceAccesses or []

    for service in service_instances:
        if not service.cdg59siid in accesses:
            continue
        if not service.cdg59metadataURL:
            continue

        try:
            klp = [x for x, y in providers.items() if \
                  service.cdg59metadataURL == y.get('metadata_url')] [0]
        except IndexError:
            continue

        if provider_key == klp:
            return True

    return False
    


class AccessControlSpUI(liberty.saml2.SpUI):
    def _q_access(self):
        authorized = check_access_authorizations(self.provider_key)
        if not authorized:
            if get_session():
                raise errors.AccessForbiddenError()
            else:
                raise errors.AccessUnauthorizedError()

    def login(self, encryption_mode = None, method = None, nid_format = None, relay_state = None):
        return liberty.saml2.SpUI.login(self, encryption_mode, method, nid_format, 'backoffice')


class AccessControlSpDir(liberty.saml2.SpDir):
    def _q_lookup(self, component):
        return AccessControlSpUI(component)


class AlternateSaml2Directory(liberty.saml2.RootDirectory):
    sp = AccessControlSpDir()

    def check_access_authorizations(self, login):
        provider_id = login.remoteProviderId
        provider_key = misc.get_provider_key(provider_id)
        return check_access_authorizations(provider_key)

    def sso_after_authentication(self, login, user_authenticated, proxied = False):
        if user_authenticated:
            if not self.check_access_authorizations(login):
                provider_id = login.remoteProviderId
                provider_key = misc.get_provider_key(provider_id)
                try:
                    label = misc.get_provider_and_label(provider_key)[1]
                except KeyError:
                    return template.error_page(_('''\
You do not have required authorizations to access the service,
you should contact the administration of your collectivity.'''))

                return template.error_page(_('''\
You do not have required authorizations to access the "%s" service,
you should contact the administration of your collectivity.''') % label)
        return liberty.saml2.RootDirectory.sso_after_authentication(
                self, login, user_authenticated, proxied=proxied)