SAML2 third_party_auth provider(s) - PR 8018

Author: bradenmacdonald

common/djangoapps/student/views.py

@@ -424,7 +424,7 @@ def register_user(request, extra_context=None):
     # selected provider.
     if third_party_auth.is_enabled() and pipeline.running(request):
         running_pipeline = pipeline.get(request)
-        current_provider = provider.Registry.get_by_backend_name(running_pipeline.get('backend'))
+        current_provider = provider.Registry.get_from_pipeline(running_pipeline)
         overrides = current_provider.get_register_form_data(running_pipeline.get('kwargs'))
         overrides['running_pipeline'] = running_pipeline
         overrides['selected_provider'] = current_provider.NAME
@@ -952,10 +952,11 @@ def login_user(request, error=""):  # pylint: disable-msg=too-many-statements,un
         running_pipeline = pipeline.get(request)
         username = running_pipeline['kwargs'].get('username')
         backend_name = running_pipeline['backend']
-        requested_provider = provider.Registry.get_by_backend_name(backend_name)
+        third_party_uid = running_pipeline['kwargs']['uid']
+        requested_provider = provider.Registry.get_from_pipeline(running_pipeline)
 
         try:
-            user = pipeline.get_authenticated_user(username, backend_name)
+            user = pipeline.get_authenticated_user(requested_provider, username, third_party_uid)
             third_party_auth_successful = True
         except User.DoesNotExist:
             AUDIT_LOG.warning(
@@ -1509,7 +1510,7 @@ def create_account_with_params(request, params):
         provider_name = None
         if third_party_auth.is_enabled() and pipeline.running(request):
             running_pipeline = pipeline.get(request)
-            current_provider = provider.Registry.get_by_backend_name(running_pipeline.get('backend'))
+            current_provider = provider.Registry.get_from_pipeline(running_pipeline)
             provider_name = current_provider.NAME
 
         analytics.track(

common/djangoapps/third_party_auth/pipeline.py

@@ -196,9 +196,11 @@ class ProviderUserState(object):
     lms/templates/dashboard.html.
     """
 
-    def __init__(self, enabled_provider, user, state):
+    def __init__(self, enabled_provider, user, association_id=None):
+        # UserSocialAuth row ID
+        self.association_id = association_id
         # Boolean. Whether the user has an account associated with the provider
-        self.has_account = state
+        self.has_account = association_id is not None
         # provider.BaseProvider child. Callers must verify that the provider is
         # enabled.
         self.provider = enabled_provider
@@ -215,7 +217,7 @@ def get(request):
     return request.session.get('partial_pipeline')
 
 
-def get_authenticated_user(username, backend_name):
+def get_authenticated_user(auth_provider, username, uid):
     """Gets a saved user authenticated by a particular backend.
 
     Between pipeline steps User objects are not saved. We need to reconstitute
@@ -224,26 +226,26 @@ def get_authenticated_user(username, backend_name):
     authenticate().
 
     Args:
+        auth_provider: the third_party_auth provider in use for the current pipeline.
         username: string. Username of user to get.
-        backend_name: string. The name of the third-party auth backend from
-            the running pipeline.
+        uid: string. The user ID according to the third party.
 
     Returns:
         User if user is found and has a social auth from the passed
-        backend_name.
+        provider.
 
     Raises:
         User.DoesNotExist: if no user matching user is found, or the matching
         user has no social auth associated with the given backend.
         AssertionError: if the user is not authenticated.
     """
-    user = models.DjangoStorage.user.user_model().objects.get(username=username)
-    match = models.DjangoStorage.user.get_social_auth_for_user(user, provider=backend_name)
+    match = models.DjangoStorage.user.get_social_auth(provider=auth_provider.BACKEND_CLASS.name, uid=uid)
 
-    if not match:
+    if not match or match.user.username != username:
         raise User.DoesNotExist
 
-    user.backend = provider.Registry.get_by_backend_name(backend_name).get_authentication_backend()
+    user = match.user
+    user.backend = auth_provider.get_authentication_backend()
     return user
 
 
@@ -257,10 +259,12 @@ def _get_enabled_provider_by_name(provider_name):
     return enabled_provider
 
 
-def _get_url(view_name, backend_name, auth_entry=None, redirect_url=None):
+def _get_url(view_name, backend_name, auth_entry=None, redirect_url=None,
+             extra_params=None, url_params=None):
     """Creates a URL to hook into social auth endpoints."""
-    kwargs = {'backend': backend_name}
-    url = reverse(view_name, kwargs=kwargs)
+    url_params = url_params or {}
+    url_params['backend'] = backend_name
+    url = reverse(view_name, kwargs=url_params)
 
     query_params = OrderedDict()
     if auth_entry:
@@ -269,6 +273,9 @@ def _get_url(view_name, backend_name, auth_entry=None, redirect_url=None):
     if redirect_url:
         query_params[AUTH_REDIRECT_KEY] = redirect_url
 
+    if extra_params:
+        query_params.update(extra_params)
+
     return u"{url}?{params}".format(
         url=url,
         params=urllib.urlencode(query_params)
@@ -288,29 +295,32 @@ def get_complete_url(backend_name):
     Raises:
         ValueError: if no provider is enabled with the given backend_name.
     """
-    enabled_provider = provider.Registry.get_by_backend_name(backend_name)
-
-    if not enabled_provider:
+    if not any(provider.Registry.get_enabled_by_backend_name(backend_name)):
         raise ValueError('Provider with backend %s not enabled' % backend_name)
 
     return _get_url('social:complete', backend_name)
 
 
-def get_disconnect_url(provider_name):
+def get_disconnect_url(provider_name, association_id):
     """Gets URL for the endpoint that starts the disconnect pipeline.
 
     Args:
         provider_name: string. Name of the provider.BaseProvider child you want
             to disconnect from.
+        association_id: int. Optional ID of a specific row in the UserSocialAuth
+            table to disconnect (useful if multiple providers use a common backend)
 
     Returns:
         String. URL that starts the disconnection pipeline.
 
     Raises:
-        ValueError: if no provider is enabled with the given backend_name.
+        ValueError: if no provider is enabled with the given name.
     """
-    enabled_provider = _get_enabled_provider_by_name(provider_name)
-    return _get_url('social:disconnect', enabled_provider.BACKEND_CLASS.name)
+    backend_name = _get_enabled_provider_by_name(provider_name).BACKEND_CLASS.name
+    if association_id:
+        return _get_url('social:disconnect_individual', backend_name, url_params={'association_id': association_id})
+    else:
+        return _get_url('social:disconnect', backend_name)
 
 
 def get_login_url(provider_name, auth_entry, redirect_url=None):
@@ -340,6 +350,7 @@ def get_login_url(provider_name, auth_entry, redirect_url=None):
         enabled_provider.BACKEND_CLASS.name,
         auth_entry=auth_entry,
         redirect_url=redirect_url,
+        extra_params=enabled_provider.get_url_params(),
     )
 
 
@@ -355,7 +366,7 @@ def get_duplicate_provider(messages):
     unfortunately not in a reusable constant.
 
     Returns:
-        provider.BaseProvider child instance. The provider of the duplicate
+        string name of the python-social-auth backend that has the duplicate
         account, or None if there is no duplicate (and hence no error).
     """
     social_auth_messages = [m for m in messages if m.message.endswith('is already in use.')]
@@ -364,7 +375,8 @@ def get_duplicate_provider(messages):
         return
 
     assert len(social_auth_messages) == 1
-    return provider.Registry.get_by_backend_name(social_auth_messages[0].extra_tags.split()[1])
+    backend_name = social_auth_messages[0].extra_tags.split()[1]
+    return backend_name
 
 
 def get_provider_user_states(user):
@@ -378,13 +390,16 @@ def get_provider_user_states(user):
             each enabled provider.
     """
     states = []
-    found_user_backends = [
-        social_auth.provider for social_auth in models.DjangoStorage.user.get_social_auth_for_user(user)
-    ]
+    found_user_auths = list(models.DjangoStorage.user.get_social_auth_for_user(user))
 
     for enabled_provider in provider.Registry.enabled():
+        association_id = None
+        for auth in found_user_auths:
+            if enabled_provider.match_social_auth(auth):
+                association_id = auth.id
+                break
         states.append(
-            ProviderUserState(enabled_provider, user, enabled_provider.BACKEND_CLASS.name in found_user_backends)
+            ProviderUserState(enabled_provider, user, association_id)
         )
 
     return states

common/djangoapps/third_party_auth/provider.py

@@ -5,6 +5,8 @@
 """
 
 from social.backends import google, linkedin, facebook
+from social.backends.saml import OID_EDU_PERSON_PRINCIPAL_NAME
+from .saml import SAMLAuthBackend
 
 _DEFAULT_ICON_CLASS = 'fa-signin'
 
@@ -109,6 +111,21 @@ def merge_onto(cls, settings):
         for key, value in cls.SETTINGS.iteritems():
             setattr(settings, key, value)
 
+    @classmethod
+    def get_url_params(cls):
+        """ Get a dict of GET parameters to append to login links for this provider """
+        return {}
+
+    @classmethod
+    def is_active_for_pipeline(cls, pipeline):
+        """ Is this provider being used for the specified pipeline? """
+        return cls.BACKEND_CLASS.name == pipeline['backend']
+
+    @classmethod
+    def match_social_auth(cls, social_auth):
+        """ Is this provider being used for this UserSocialAuth entry? """
+        return cls.BACKEND_CLASS.name == social_auth.provider
+
 
 class GoogleOauth2(BaseProvider):
     """Provider for Google's Oauth2 auth system."""
@@ -146,6 +163,78 @@ class FacebookOauth2(BaseProvider):
     }
 
 
+class SAMLProviderMixin(object):
+    """ Base class for SAML/Shibboleth providers """
+    BACKEND_CLASS = SAMLAuthBackend
+    ICON_CLASS = 'fa-university'
+
+    @classmethod
+    def get_url_params(cls):
+        """ Get a dict of GET parameters to append to login links for this provider """
+        return {'idp': cls.IDP["id"]}
+
+    @classmethod
+    def is_active_for_pipeline(cls, pipeline):
+        """ Is this provider being used for the specified pipeline? """
+        if cls.BACKEND_CLASS.name == pipeline['backend']:
+            idp_name = pipeline['kwargs']['response']['idp_name']
+            return cls.IDP["id"] == idp_name
+        return False
+
+    @classmethod
+    def match_social_auth(cls, social_auth):
+        """ Is this provider being used for this UserSocialAuth entry? """
+        prefix = cls.IDP["id"] + ":"
+        return cls.BACKEND_CLASS.name == social_auth.provider and social_auth.uid.startswith(prefix)
+
+
+class TestShibAProvider(SAMLProviderMixin, BaseProvider):
+    """ Provider for testshib.org public Shibboleth test server. """
+    NAME = 'TestShib A'
+    IDP = {
+        "id": "testshiba",  # Required slug
+        "entity_id": "https://idp.testshib.org/idp/shibboleth",
+        "url": "https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO",
+        "attr_email": OID_EDU_PERSON_PRINCIPAL_NAME,
+        "x509cert": """
+            MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV
+            MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD
+            VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4
+            MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI
+            EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl
+            c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B
+            AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C
+            yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe
+            3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT
+            NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614
+            kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH
+            gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G
+            A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86
+            9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl
+            bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo
+            aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN
+            BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL
+            I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo
+            93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4
+            /SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj
+            Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr
+            8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==
+        """
+    }
+
+
+class TestShibBProvider(SAMLProviderMixin, BaseProvider):
+    """ Provider for testshib.org public Shibboleth test server. """
+    NAME = 'TestShib B'
+    IDP = {
+        "id": "testshibB",  # Required slug
+        "entity_id": "https://idp.testshib.org/idp/shibboleth",
+        "url": "https://IDP.TESTSHIB.ORG/idp/profile/SAML2/Redirect/SSO",
+        "attr_email": OID_EDU_PERSON_PRINCIPAL_NAME,
+        "x509cert": TestShibAProvider.IDP["x509cert"],
+    }
+
+
 class Registry(object):
     """Singleton registry of third-party auth providers.
 
@@ -211,22 +300,48 @@ def get(cls, provider_name):
         return cls._ENABLED.get(provider_name)
 
     @classmethod
-    def get_by_backend_name(cls, backend_name):
-        """Gets provider (or None) by backend name.
+    def get_from_pipeline(cls, running_pipeline):
+        """Gets the provider that is being used for the specified pipeline (or None).
 
         Args:
-            backend_name: string. The python-social-auth
-                backends.base.BaseAuth.name (for example, 'google-oauth2') to
-                try and get a provider for.
+            running_pipeline: The python-social-auth pipeline being used to
+                authenticate a user.
+
+        Returns:
+            A provider class (a subclass of BaseProvider) or None.
 
         Raises:
             RuntimeError: if the registry has not been configured.
         """
         cls._check_configured()
         for enabled in cls._ENABLED.values():
-            if enabled.BACKEND_CLASS.name == backend_name:
+            if enabled.is_active_for_pipeline(running_pipeline):
                 return enabled
 
+    @classmethod
+    def get_enabled_by_backend_name(cls, backend_name):
+        """Generator returning all enabled providers that use the specified
+        backend.
+
+        Example:
+            >>> list(get_enabled_by_backend_name("tpa-saml"))
+                [TestShibAProvider, TestShibBProvider]
+
+        Args:
+            backend_name: The name of a python-social-auth backend used by
+                one or more providers.
+
+        Yields:
+            Provider classes (subclasses of BaseProvider).
+
+        Raises:
+            RuntimeError: if the registry has not been configured.
+        """
+        cls._check_configured()
+        for enabled in cls._ENABLED.values():
+            if enabled.BACKEND_CLASS.name == backend_name:
+                yield enabled
+
     @classmethod
     def _reset(cls):
         """Returns the registry to an unconfigured state; for tests only."""

common/djangoapps/third_party_auth/saml.py

@@ -0,0 +1,21 @@
+"""
+Slightly customized python-social-auth backend for SAML 2.0 support
+"""
+
+from social.backends.saml import SAMLIdentityProvider, SAMLAuth
+
+
+class SAMLAuthBackend(SAMLAuth):  # pylint: disable=abstract-method
+    """
+    Customized version of SAMLAuth that gets the list of IdPs from third_party_auth's list of
+    enabled providers.
+    """
+    name = "tpa-saml"
+
+    def get_idp(self, idp_name):
+        """ Given the name of an IdP, get a SAMLIdentityProvider instance """
+        from .provider import Registry  # Import here to avoid circular import
+        for provider in Registry.enabled():
+            if issubclass(provider.BACKEND_CLASS, SAMLAuth) and provider.IDP["id"] == idp_name:
+                return SAMLIdentityProvider(idp_name, **provider.IDP)
+        raise KeyError("SAML IdP {} not found.".format(idp_name))