Feature: Shibboleth/SAML SSO

.gitignore

@@ -91,6 +91,9 @@ logs
 chromedriver.log
 ghostdriver.log
 
+### Celery artifacts ###
+celerybeat-schedule
+
 ### Unknown artifacts
 database.sqlite
 courseware/static/js/mathjax/*

common/djangoapps/student/helpers.py

@@ -196,8 +196,9 @@ def auth_pipeline_urls(auth_entry, redirect_url=None):
         return {}
 
     return {
-        provider.NAME: third_party_auth.pipeline.get_login_url(provider.NAME, auth_entry, redirect_url=redirect_url)
-        for provider in third_party_auth.provider.Registry.enabled()
+        provider.provider_id: third_party_auth.pipeline.get_login_url(
+            provider.provider_id, auth_entry, redirect_url=redirect_url
+        ) for provider in third_party_auth.provider.Registry.enabled()
     }
 
 

common/djangoapps/student/tests/test_login_registration_forms.py

@@ -11,12 +11,12 @@
 from util.testing import UrlResetMixin
 from xmodule.modulestore.tests.factories import CourseFactory
 from student.tests.factories import CourseModeFactory
+from third_party_auth.tests.testutil import ThirdPartyAuthTestMixin
 from xmodule.modulestore.tests.django_utils import ModuleStoreTestCase
 
 
-# This relies on third party auth being enabled and configured
-# in the test settings.  See the setting `THIRD_PARTY_AUTH`
-# and the feature flag `ENABLE_THIRD_PARTY_AUTH`
+# This relies on third party auth being enabled in the test
+# settings with the feature flag `ENABLE_THIRD_PARTY_AUTH`
 THIRD_PARTY_AUTH_BACKENDS = ["google-oauth2", "facebook"]
 THIRD_PARTY_AUTH_PROVIDERS = ["Google", "Facebook"]
 
@@ -40,7 +40,7 @@ def _finish_auth_url(params):
 
 @ddt.ddt
 @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
-class LoginFormTest(UrlResetMixin, ModuleStoreTestCase):
+class LoginFormTest(ThirdPartyAuthTestMixin, UrlResetMixin, ModuleStoreTestCase):
     """Test rendering of the login form. """
     @patch.dict(settings.FEATURES, {"ENABLE_COMBINED_LOGIN_REGISTRATION": False})
     def setUp(self):
@@ -50,6 +50,8 @@ def setUp(self):
         self.course = CourseFactory.create()
         self.course_id = unicode(self.course.id)
         self.courseware_url = reverse("courseware", args=[self.course_id])
+        self.configure_google_provider(enabled=True)
+        self.configure_facebook_provider(enabled=True)
 
     @patch.dict(settings.FEATURES, {"ENABLE_THIRD_PARTY_AUTH": False})
     @ddt.data(THIRD_PARTY_AUTH_PROVIDERS)
@@ -148,7 +150,7 @@ def test_params(self, opt_in_value):
 
 @ddt.ddt
 @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
-class RegisterFormTest(UrlResetMixin, ModuleStoreTestCase):
+class RegisterFormTest(ThirdPartyAuthTestMixin, UrlResetMixin, ModuleStoreTestCase):
     """Test rendering of the registration form. """
     @patch.dict(settings.FEATURES, {"ENABLE_COMBINED_LOGIN_REGISTRATION": False})
     def setUp(self):
@@ -157,6 +159,8 @@ def setUp(self):
         self.url = reverse("register_user")
         self.course = CourseFactory.create()
         self.course_id = unicode(self.course.id)
+        self.configure_google_provider(enabled=True)
+        self.configure_facebook_provider(enabled=True)
 
     @patch.dict(settings.FEATURES, {"ENABLE_THIRD_PARTY_AUTH": False})
     @ddt.data(*THIRD_PARTY_AUTH_PROVIDERS)

common/djangoapps/student/views.py

@@ -368,7 +368,7 @@ def signin_user(request):
     for msg in messages.get_messages(request):
         if msg.extra_tags.split()[0] == "social-auth":
             # msg may or may not be translated. Try translating [again] in case we are able to:
-            third_party_auth_error = _(msg)  # pylint: disable=translation-of-non-string
+            third_party_auth_error = _(unicode(msg))  # pylint: disable=translation-of-non-string
             break
 
     context = {
@@ -424,10 +424,10 @@ def register_user(request, extra_context=None):
     # selected provider.
     if third_party_auth.is_enabled() and pipeline.running(request):
         running_pipeline = pipeline.get(request)
-        current_provider = provider.Registry.get_by_backend_name(running_pipeline.get('backend'))
+        current_provider = provider.Registry.get_from_pipeline(running_pipeline)
         overrides = current_provider.get_register_form_data(running_pipeline.get('kwargs'))
         overrides['running_pipeline'] = running_pipeline
-        overrides['selected_provider'] = current_provider.NAME
+        overrides['selected_provider'] = current_provider.name
         context.update(overrides)
 
     return render_to_response('register.html', context)
@@ -952,23 +952,24 @@ def login_user(request, error=""):  # pylint: disable-msg=too-many-statements,un
         running_pipeline = pipeline.get(request)
         username = running_pipeline['kwargs'].get('username')
         backend_name = running_pipeline['backend']
-        requested_provider = provider.Registry.get_by_backend_name(backend_name)
+        third_party_uid = running_pipeline['kwargs']['uid']
+        requested_provider = provider.Registry.get_from_pipeline(running_pipeline)
 
         try:
-            user = pipeline.get_authenticated_user(username, backend_name)
+            user = pipeline.get_authenticated_user(requested_provider, username, third_party_uid)
             third_party_auth_successful = True
         except User.DoesNotExist:
             AUDIT_LOG.warning(
                 u'Login failed - user with username {username} has no social auth with backend_name {backend_name}'.format(
                     username=username, backend_name=backend_name))
             return HttpResponse(
                 _("You've successfully logged into your {provider_name} account, but this account isn't linked with an {platform_name} account yet.").format(
-                    platform_name=settings.PLATFORM_NAME, provider_name=requested_provider.NAME
+                    platform_name=settings.PLATFORM_NAME, provider_name=requested_provider.name
                 )
                 + "<br/><br/>" +
                 _("Use your {platform_name} username and password to log into {platform_name} below, "
                   "and then link your {platform_name} account with {provider_name} from your dashboard.").format(
-                      platform_name=settings.PLATFORM_NAME, provider_name=requested_provider.NAME
+                      platform_name=settings.PLATFORM_NAME, provider_name=requested_provider.name
                 )
                 + "<br/><br/>" +
                 _("If you don't have an {platform_name} account yet, click <strong>Register Now</strong> at the top of the page.").format(
@@ -1497,6 +1498,13 @@ def create_account_with_params(request, params):
 
     dog_stats_api.increment("common.student.account_created")
 
+    # If the user is registering via 3rd party auth, track which provider they use
+    third_party_provider = None
+    running_pipeline = None
+    if third_party_auth.is_enabled() and pipeline.running(request):
+        running_pipeline = pipeline.get(request)
+        third_party_provider = provider.Registry.get_from_pipeline(running_pipeline)
+
     # Track the user's registration
     if settings.FEATURES.get('SEGMENT_IO_LMS') and hasattr(settings, 'SEGMENT_IO_LMS_KEY'):
         tracking_context = tracker.get_tracker().resolve_context()
@@ -1505,20 +1513,13 @@ def create_account_with_params(request, params):
             'username': user.username,
         })
 
-        # If the user is registering via 3rd party auth, track which provider they use
-        provider_name = None
-        if third_party_auth.is_enabled() and pipeline.running(request):
-            running_pipeline = pipeline.get(request)
-            current_provider = provider.Registry.get_by_backend_name(running_pipeline.get('backend'))
-            provider_name = current_provider.NAME
-
         analytics.track(
             user.id,
             "edx.bi.user.account.registered",
             {
                 'category': 'conversion',
                 'label': params.get('course_id'),
-                'provider': provider_name
+                'provider': third_party_provider.name if third_party_provider else None
             },
             context={
                 'Google Analytics': {
@@ -1535,6 +1536,7 @@ def create_account_with_params(request, params):
     # 2. Random user generation for other forms of testing.
     # 3. External auth bypassing activation.
     # 4. Have the platform configured to not require e-mail activation.
+    # 5. Registering a new user using a trusted third party provider (with skip_email_verification=True)
     #
     # Note that this feature is only tested as a flag set one way or
     # the other for *new* systems. we need to be careful about
@@ -1543,7 +1545,11 @@ def create_account_with_params(request, params):
     send_email = (
         not settings.FEATURES.get('SKIP_EMAIL_VALIDATION', None) and
         not settings.FEATURES.get('AUTOMATIC_AUTH_FOR_TESTING') and
-        not (do_external_auth and settings.FEATURES.get('BYPASS_ACTIVATION_EMAIL_FOR_EXTAUTH'))
+        not (do_external_auth and settings.FEATURES.get('BYPASS_ACTIVATION_EMAIL_FOR_EXTAUTH')) and
+        not (
+            third_party_provider and third_party_provider.skip_email_verification and
+            user.email == running_pipeline['kwargs'].get('details', {}).get('email')
+        )
     )
     if send_email:
         context = {

common/djangoapps/third_party_auth/admin.py

@@ -0,0 +1,78 @@
+# -*- coding: utf-8 -*-
+"""
+Admin site configuration for third party authentication
+"""
+
+from django.contrib import admin
+
+from config_models.admin import ConfigurationModelAdmin, KeyedConfigurationModelAdmin
+from .models import OAuth2ProviderConfig, SAMLProviderConfig, SAMLConfiguration, SAMLProviderData
+from .tasks import fetch_saml_metadata
+
+admin.site.register(OAuth2ProviderConfig, KeyedConfigurationModelAdmin)
+
+
+class SAMLProviderConfigAdmin(KeyedConfigurationModelAdmin):
+    """ Django Admin class for SAMLProviderConfig """
+    def get_list_display(self, request):
+        """ Don't show every single field in the admin change list """
+        return (
+            'name', 'enabled', 'backend_name', 'entity_id', 'metadata_source',
+            'has_data', 'icon_class', 'change_date', 'changed_by', 'edit_link'
+        )
+
+    def has_data(self, inst):
+        """ Do we have cached metadata for this SAML provider? """
+        if not inst.is_active:
+            return None  # N/A
+        data = SAMLProviderData.current(inst.entity_id)
+        return bool(data and data.is_valid())
+    has_data.short_description = u'Metadata Ready'
+    has_data.boolean = True
+
+    def save_model(self, request, obj, form, change):
+        """
+        Post save: Queue an asynchronous metadata fetch to update SAMLProviderData.
+        We only want to do this for manual edits done using the admin interface.
+
+        Note: This only works if the celery worker and the app worker are using the
+        same 'configuration' cache.
+        """
+        super(SAMLProviderConfigAdmin, self).save_model(request, obj, form, change)
+        fetch_saml_metadata.apply_async((), countdown=2)
+
+admin.site.register(SAMLProviderConfig, SAMLProviderConfigAdmin)
+
+
+class SAMLConfigurationAdmin(ConfigurationModelAdmin):
+    """ Django Admin class for SAMLConfiguration """
+    def get_list_display(self, request):
+        """ Shorten the public/private keys in the change view """
+        return (
+            'change_date', 'changed_by', 'enabled', 'entity_id',
+            'org_info_str', 'key_summary',
+        )
+
+    def key_summary(self, inst):
+        """ Short summary of the key pairs configured """
+        if not inst.public_key or not inst.private_key:
+            return u'<em>Key pair incomplete/missing</em>'
+        pub1, pub2 = inst.public_key[0:10], inst.public_key[-10:]
+        priv1, priv2 = inst.private_key[0:10], inst.private_key[-10:]
+        return u'Public: {}…{}<br>Private: {}…{}'.format(pub1, pub2, priv1, priv2)
+    key_summary.allow_tags = True
+
+admin.site.register(SAMLConfiguration, SAMLConfigurationAdmin)
+
+
+class SAMLProviderDataAdmin(admin.ModelAdmin):
+    """ Django Admin class for SAMLProviderData (Read Only) """
+    list_display = ('entity_id', 'is_valid', 'fetched_at', 'expires_at', 'sso_url')
+    readonly_fields = ('is_valid', )
+
+    def get_readonly_fields(self, request, obj=None):
+        if obj:  # editing an existing object
+            return self.model._meta.get_all_field_names()  # pylint: disable=protected-access
+        return self.readonly_fields
+
+admin.site.register(SAMLProviderData, SAMLProviderDataAdmin)

common/djangoapps/third_party_auth/dummy.py

@@ -1,13 +1,11 @@
 """
-DummyProvider: A fake Third Party Auth provider for testing & development purposes.
+DummyBackend: A fake Third Party Auth provider for testing & development purposes.
 """
-from social.backends.base import BaseAuth
+from social.backends.oauth import BaseOAuth2
 from social.exceptions import AuthFailed
 
-from .provider import BaseProvider
 
-
-class DummyBackend(BaseAuth):  # pylint: disable=abstract-method
+class DummyBackend(BaseOAuth2):  # pylint: disable=abstract-method
     """
     python-social-auth backend that doesn't actually go to any third party site
     """
@@ -47,12 +45,3 @@ def auth_complete(self, *args, **kwargs):
         kwargs.update({'response': response, 'backend': self})
 
         return self.strategy.authenticate(*args, **kwargs)
-
-
-class DummyProvider(BaseProvider):
-    """ Dummy Provider for testing and development """
-
-    BACKEND_CLASS = DummyBackend
-    ICON_CLASS = 'fa-cube'
-    NAME = 'Dummy'
-    SETTINGS = {}

common/djangoapps/third_party_auth/management/commands/saml.py

@@ -0,0 +1,37 @@
+# -*- coding: utf-8 -*-
+"""
+Management commands for third_party_auth
+"""
+from django.core.management.base import BaseCommand, CommandError
+import logging
+from third_party_auth.models import SAMLConfiguration
+from third_party_auth.tasks import fetch_saml_metadata
+
+
+class Command(BaseCommand):
+    """ manage.py commands to manage SAML/Shibboleth SSO """
+    help = '''Configure/maintain/update SAML-based SSO'''
+
+    def handle(self, *args, **options):
+        if len(args) != 1:
+            raise CommandError("saml requires one argument: pull")
+
+        if not SAMLConfiguration.is_enabled():
+            raise CommandError("SAML support is disabled via SAMLConfiguration.")
+
+        subcommand = args[0]
+
+        if subcommand == "pull":
+            log_handler = logging.StreamHandler(self.stdout)
+            log_handler.setLevel(logging.DEBUG)
+            log = logging.getLogger('third_party_auth.tasks')
+            log.propagate = False
+            log.addHandler(log_handler)
+            num_changed, num_failed, num_total = fetch_saml_metadata()
+            self.stdout.write(
+                "\nDone. Fetched {num_total} total. {num_changed} were updated and {num_failed} failed.\n".format(
+                    num_changed=num_changed, num_failed=num_failed, num_total=num_total
+                )
+            )
+        else:
+            raise CommandError("Unknown argment: {}".format(subcommand))