Go to file
Benjamin Dauvergne 7a5223d050 release 1.2.24 2016-03-04 10:09:11 +01:00
debian debian: declare it breaks hobo before release 0.34.5 2016-03-02 18:47:03 +01:00
mellon Fix removal of admin right when users have admin attributes but is already admin (fixes #10195) 2016-03-04 10:07:54 +01:00
tests Fix removal of admin right when users have admin attributes but is already admin (fixes #10195) 2016-03-04 10:07:54 +01:00
.coveragerc add tox.ini to test on django 1.7, 1.8, 1.9 and with sqlite and pg 2016-02-26 18:09:11 +01:00
.gitignore Add .gitignore 2015-04-29 16:38:13 +02:00
COPYING first commit 2014-04-30 14:34:39 +02:00
Changelog release 1.2.24 2016-03-04 10:09:11 +01:00
MANIFEST.in MANIFEST.in: include Changelog, COPYING, testsettings.py and tests/*.py 2015-05-29 11:53:41 +02:00
README implement session_not_on_or_after using new session engines (fixes #9640) 2016-01-15 12:29:31 +01:00
getlasso.sh add tox.ini to test on django 1.7, 1.8, 1.9 and with sqlite and pg 2016-02-26 18:09:11 +01:00
setup.py pep8ness 2016-02-12 19:44:19 +01:00
testsettings.py silence Django 1.10 deprecration warnings 2016-03-02 18:14:46 +01:00
tox.ini tests: add tests on mellon.utils 2016-02-26 18:09:27 +01:00



SAML 2.0 authentication for Django


You need to have the Python binding for the Lasso library installed, you can
find source and package for Debian on http://lasso.entrouvert.org/download/.

Add mellon to your installed apps::


Add the SAMLBacked to your authentication backends::


Add mellon urls to your urls::

    urlpatterns = patterns('',
        url(r'^/accounts/mellon/', include('mellon.urls')),

If SAML 2.0 should be your only authentication method you can define `mellon_login` as you main `LOGIN_URL`::

    LOGIN_URL = 'mellon_login'
    LOGOUT_URL = 'mellon_logout'

Yout metadata will be downloadable through HTTP on 


If your identity provider ask for your assertion consumer URL it's on


If your identity provider ask for your logout URL it's on



After an authentication attributes are stored in the session using a
dictionary, the key is `mellon_session`. The dictionary contains:

 - issuer: the EntityID of the identity provider
 - name_id_content: the value of the NameID
 - name_id_format: the format of the NameID
 - authn_instant: the ISO8601 date of the authentication on the identity provider, optional.
 - session_not_on_or_after: the ISO8691 date after which the local
   session should be closed. Note that we automatically set the
   expiration of the Django session to this value if it's available.
 - authn_context_class_ref: the authentication method of the current
   authentication on the identity provider. You can restrict
   authorized authentication methods using the setting
 - all attributes extracted from the assertion.


All generic setting apart from `MELLON_IDENTITY_PROVIDERS` can be
overridden in the identity provider settings by removing the
`MELLON_` prefix.


A list of dictionaries, only one key is mandatory in those
dictionaries `METADATA` it should contain the UTF-8 content of the
metadata file of the identity provider or if it starts with a slash
the absolute path toward a metadata file. All other keys are override
of generic settings.


List of public keys of this service provider, add multiple keys for
doing key roll-over


The PKCS#8 PEM encoded private key. If neither MELLON_PRIVATE_KEYS and
MELLON_PRIVATE_KEY are set, request will not be signed.


Password for the private key if needed, default is None


A list of private keys contained in strings (same format ass
MELLON_PRIVATE_KEY) or of tuple paris (private_key, private_key_password). If
MELLON_PRIVATE_KEY is None, the first key in MELLON_PRIVATE_KEYS will be used
to sign messages. Other keys are only for decrypting encrypted assertions.  If
the same key appear in MELLON_PRIVATE_KEY and MELLON_PRIVATE_KEYS it will be
ignored the second time. If neither MELLON_PRIVATE_KEYS and MELLON_PRIVATE_KEY
are set, request will not be signed.


NameID formats to advertise in the metadata file, default is ().


The NameID format to request, default is None.


Whether to force authentication on each authencation request,
default is False.


A list of class providings methods handling SAML authorization, user
lookup and provisioning. Optional methods on theses classes are

 - authorize(idp, saml_attributes) -> boolean

   If any adapter returns False, the authentication is refused. It's
   possible to raise PermissionDenied to show a specific message on
   the login interface.

 - lookup_user(idp, saml_attributes) -> User / None

   Each adapter is called in the order of the settings, the first
   return value which is not None is kept as the authenticated user.

 - provision(user, idp, saml_attributes -> None

   This method is there to fill an existing user fields with data
   from the SAML attributes or to provision any kind of object in the

Settings of the default adapter

The following settings are used by the default adapter
`mellon.adapters.DefaulAdapter` if you use your own adapter you can
ignore them. If your adapter inherit from the default adapter those
settings can still be applicable.


The default realm to associate to user created with the default
adapter, default is 'saml'.


Whether to create user if their username does not already exists,
default is True.


The template to build and/or retrieve a user from its username based
on received attributes, the syntax is the one from the str.format()
method of Python. Available variables are:

 - realm
 - idp (current setting for the idp issuing the assertion)
 - attributes

The default value is `{attributes{name_id_content]}@realm`.

Another example could be `{atttributes[uid][0]}` to set the passed
username as the username of the newly created user.


Maps templates based on SAML attributes to field of the user model.
Default is {}. To copy standard LDAP attributes into your Django user
model could for example do that::

        'email': '{attributes[mail][0]',
        'first_name': '{attributes[gn][0]}',
        'last_name': '{attributes[sn][0]}',


Attributes superuser flags to user if a SAML attribute contains a given value,
default is {}. Ex.::

        'roles': 'Admin',


Authorized authentication class references, default is (). Empty
value means everything is authorized. Authentication class reference
must be obtained from your identity provider but SHOULD come from the
SAML 2.0 specification.


Name of the SAML attribute to map to Django group names, default is None. Ex.:



Whether to create group or only assign existing groups, default is True.


URL for the continue link when authentication fails, default is
None. If not ERROR_URL is None, the RelayState is used. If there is
no RelayState, the LOGIN_REDIRECT_URL, which defaults to /, is used.


Timeout in seconds before automatically redirecting the user to the
continue URL when authentication has failed. Default is 120 seconds.


Verify SSL certificate when doing HTTP requests, used when resolving artifacts.
Default is True.


Unit tests are written using pytest, and can be run with:

   DJANGO_SETTINGS_MODULE=testsettings py.test


To honor the SessionNotOnOrAfter attribute sent by an IdP you must use a specific SessionEngine,
only db and cached_db are supported currently, the equivalent session engines are: