Shibboleth Support (WIP)

[bradenmacdonald]

WIP

Status: Working. Only supports "TestShib" out of the box. No UX changes yet so it works best with a limited number of providers.

Test Instructions:

1. For devstack: As the vagrant user, do sudo apt-get install libxmlsec1-dev swig

2. Check out this branch and do paver install_prereqs

3. Add something like this in ~/lms.env.json, changing the "Entity ID" to a URL related to you (doesn't need to be a real URL - e.g. "saml.yourname.com" is good)

   "SOCIAL_AUTH_TPA_SAML_SP_ENTITY_ID": "http://saml-edx-tpa.example.com/",
   "SOCIAL_AUTH_TPA_SAML_ORG_INFO": {
       "en-US": {"name": "example", "displayname": "Example Inc.", "url": "http://www.example.com"}
   }

   Also in the FEATURES section, make sure that you add "ENABLE_THIRD_PARTY_AUTH": true,

4. Generate a keypair with openssl req -new -x509 -days 3652 -nodes -out saml.crt -keyout saml.key
   And something like this in ~/lms.auth.json, chaning the "MII" part for the new keys you just made:

   "THIRD_PARTY_AUTH": {
       "TestShib A": {}
   },
   "SOCIAL_AUTH_TPA_SAML_SP_PUBLIC_CERT": "MII.....",
   "SOCIAL_AUTH_TPA_SAML_SP_PRIVATE_KEY": "MII.....",

5. Do paver update_db

6. Run the LMS

7. Test that the metadata is working: go to http://localhost:8000/auth/saml/metadata.xml

8. Save that XML file to your desktop and rename it to yourname-metadata.xml

9. Upload your metadata to https://www.testshib.org/register.html

10. Open http://localhost:8000/login in an incognito window and test out the "Log in with TestShib A" button.

[openedx-webhooks]

Thanks for the pull request, @bradenmacdonald! It looks like you're a member of a company that does contract work for edX. If you're doing this work as part of a paid contract with edX, you should talk to edX about who will review this pull request. If this work is not part of a paid contract with edX, then you should ensure that there is an OSPR issue to track this work in JIRA, so that we don't lose track of your pull request.

To automatically create an OSPR issue for this pull request, just visit this link: http://openedx-webhooks.herokuapp.com/github/process_pr?repo=edx%2Fedx-platform&number=7893

[smarnach]

@bradenmacdonald When following the above instructions, I get to the page stating

You've successfully logged into your TestShib A account, but this account isn't linked with an Your Platform Name Here account yet…

After clicking "Register Now", I get a page that correclty lists the name received from TestShib A, and does not ask for a password. I created the account and clicked the activation link. However, the new account doesn't seem to be linked to the TestShib account: after clicking "Sign out" and "Sing in with TestShib A" again, I again get the same page claiming there is no Your Platform Name Here account linked yet.
The console logs a 403 at this time:

WARNING 8309 [audit] views.py:972 - Login failed - user with username myself9c80 has no social auth with backend_name tpa-saml
[04/May/2015 17:39:02] "POST /login_ajax HTTP/1.1" 403 453

If I try to go to the accounts settings of an edX account and click the "Link" for the TestShib A account, I get a stacktrace.

[openedx-webhooks]

Thanks for the pull request, @bradenmacdonald! It looks like you're a member of a company that does contract work for edX. If you're doing this work as part of a paid contract with edX, you should talk to edX about who will review this pull request. If this work is not part of a paid contract with edX, then you should ensure that there is an OSPR issue to track this work in JIRA, so that we don't lose track of your pull request.

To automatically create an OSPR issue for this pull request, just visit this link: http://openedx-webhooks.herokuapp.com/github/process_pr?number=7893&repo=edx%2Fedx-platform

[bradenmacdonald]

@smarnach FYI, just to follow up to your review comments in case you/others are wondering:

• "the new account doesn't seem to be linked to the TestShib account" - surprisingly, this is existing behavior. A bug report about it was rejected: CRI-9. Since I extensively investigated that issue today, I have added my comments to the issue. I believe it definitely needs to be fixed, and I may just fix it myself as part of this work.
• 403 in the console: That's expected behavior - it's not user visible and it just means that the third party account is not linked to any system account yet
• stacktrace: Fixed in 4978fdc :)

[smarnach]

@bradenmacdonald Thanks for the update. I agree that this is clearly a bug in edx-platform and needs to be addressed. Let me know when you have a new version that needs testing.

[smarnach]

The parameter list of this function pollutes the namespace of the kwargs parameter: everything occurring as a parameter name can't be in kwargs. This is the reason why Django's reverse() uses the slightly awkward kwargs=dict(...) syntax instead of accepting keyword arguments directly, and I suggest that you do the same here.

[bradenmacdonald]

Good catch. Thanks :)

[smarnach]

Running paver update_db again results in an error now ("Table 'social_auth_usersocialauth' already exists").

Clicking the "Sign in with TestShib A" button now results in this error, even after re-uploading the metadata:

[bradenmacdonald]

@smarnach Hmm, that DB error is weird. I'll look into it.

For the TestShib error you're getting: can you check the clock on your devstack? Sometimes the time can be off on virtualbox clients, and that will cause that security error.

[bradenmacdonald]

@smarnach I can't reproduce that "Table 'social_auth_usersocialauth' already exists" error. Is it a migration error or a syncdb error? Is it possible that the south migrations table in your MySQL DB is wrong?

[smarnach]

The clock on my devstack was indeed 14 seconds off, and setting it correctly fixed the issue. Now the login workflow works again, but a newly registered account still doesn't get linked automatically (which is expected, as I understand).

Regarding the DB error, it is perfectly possible that this is a migration issue local to my machine. I switched back and forth between branches, which might well have messed up the migration state. Unless the issue comes up again for someone else, I suggest to ignore it for now.

[bradenmacdonald]

Replaced with new pull request to feature branch (link is just above)