New configuration for third_party_auth & shibboleth/SAML SSO

common/djangoapps/student/tests/test_login_registration_forms.py

@@ -11,12 +11,12 @@
 from util.testing import UrlResetMixin
 from xmodule.modulestore.tests.factories import CourseFactory
 from student.tests.factories import CourseModeFactory
+from third_party_auth.tests.testutil import ThirdPartyAuthTestMixin
 from xmodule.modulestore.tests.django_utils import ModuleStoreTestCase
 
 
-# This relies on third party auth being enabled and configured
-# in the test settings.  See the setting `THIRD_PARTY_AUTH`
-# and the feature flag `ENABLE_THIRD_PARTY_AUTH`
+# This relies on third party auth being enabled in the test
+# settings with the feature flag `ENABLE_THIRD_PARTY_AUTH`
 THIRD_PARTY_AUTH_BACKENDS = ["google-oauth2", "facebook"]
 THIRD_PARTY_AUTH_PROVIDERS = ["Google", "Facebook"]
 
@@ -37,7 +37,7 @@ def _third_party_login_url(backend_name, auth_entry, course_id=None, redirect_ur
 
 @ddt.ddt
 @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
-class LoginFormTest(UrlResetMixin, ModuleStoreTestCase):
+class LoginFormTest(ThirdPartyAuthTestMixin, UrlResetMixin, ModuleStoreTestCase):
     """Test rendering of the login form. """
     @patch.dict(settings.FEATURES, {"ENABLE_COMBINED_LOGIN_REGISTRATION": False})
     def setUp(self):
@@ -48,6 +48,8 @@ def setUp(self):
         self.course_id = unicode(self.course.id)
         self.course_modes_url = reverse("course_modes_choose", kwargs={"course_id": self.course_id})
         self.courseware_url = reverse("courseware", args=[self.course_id])
+        self.configure_google_provider(enabled=True)
+        self.configure_facebook_provider(enabled=True)
 
     @patch.dict(settings.FEATURES, {"ENABLE_THIRD_PARTY_AUTH": False})
     @ddt.data(THIRD_PARTY_AUTH_PROVIDERS)
@@ -149,7 +151,7 @@ def test_email_opt_in(self, opt_in_value):
 
 @ddt.ddt
 @unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', 'Test only valid in lms')
-class RegisterFormTest(UrlResetMixin, ModuleStoreTestCase):
+class RegisterFormTest(ThirdPartyAuthTestMixin, UrlResetMixin, ModuleStoreTestCase):
     """Test rendering of the registration form. """
     @patch.dict(settings.FEATURES, {"ENABLE_COMBINED_LOGIN_REGISTRATION": False})
     def setUp(self):
@@ -159,6 +161,8 @@ def setUp(self):
         self.course = CourseFactory.create()
         self.course_id = unicode(self.course.id)
         self.course_modes_url = reverse("course_modes_choose", kwargs={"course_id": self.course_id})
+        self.configure_google_provider(enabled=True)
+        self.configure_facebook_provider(enabled=True)
 
     @patch.dict(settings.FEATURES, {"ENABLE_THIRD_PARTY_AUTH": False})
     @ddt.data(*THIRD_PARTY_AUTH_PROVIDERS)

common/djangoapps/student/views.py

@@ -360,6 +360,12 @@ def signin_user(request):
     if request.user.is_authenticated():
         return redirect(reverse('dashboard'))
 
+    third_party_auth_error = None
+    for msg in messages.get_messages(request):
+        if msg.extra_tags.split()[0] == "social-auth":
+            third_party_auth_error = unicode(msg)
+            break
+
     course_id = request.GET.get('course_id')
     email_opt_in = request.GET.get('email_opt_in')
     context = {
@@ -375,6 +381,7 @@ def signin_user(request):
             'platform_name',
             settings.PLATFORM_NAME
         ),
+        'third_party_auth_error': third_party_auth_error
     }
 
     return render_to_response('login.html', context)
@@ -422,7 +429,7 @@ def register_user(request, extra_context=None):
         current_provider = provider.Registry.get_from_pipeline(running_pipeline)
         overrides = current_provider.get_register_form_data(running_pipeline.get('kwargs'))
         overrides['running_pipeline'] = running_pipeline
-        overrides['selected_provider'] = current_provider.NAME
+        overrides['selected_provider'] = current_provider.name
         context.update(overrides)
 
     return render_to_response('register.html', context)
@@ -955,12 +962,12 @@ def login_user(request, error=""):  # pylint: disable-msg=too-many-statements,un
                     username=username, backend_name=backend_name))
             return HttpResponse(
                 _("You've successfully logged into your {provider_name} account, but this account isn't linked with an {platform_name} account yet.").format(
-                    platform_name=settings.PLATFORM_NAME, provider_name=requested_provider.NAME
+                    platform_name=settings.PLATFORM_NAME, provider_name=requested_provider.name
                 )
                 + "<br/><br/>" +
                 _("Use your {platform_name} username and password to log into {platform_name} below, "
                   "and then link your {platform_name} account with {provider_name} from your dashboard.").format(
-                      platform_name=settings.PLATFORM_NAME, provider_name=requested_provider.NAME
+                      platform_name=settings.PLATFORM_NAME, provider_name=requested_provider.name
                 )
                 + "<br/><br/>" +
                 _("If you don't have an {platform_name} account yet, click <strong>Register Now</strong> at the top of the page.").format(
@@ -1504,7 +1511,7 @@ def create_account_with_params(request, params):
         if third_party_auth.is_enabled() and pipeline.running(request):
             running_pipeline = pipeline.get(request)
             current_provider = provider.Registry.get_from_pipeline(running_pipeline)
-            provider_name = current_provider.NAME
+            provider_name = current_provider.name
 
         analytics.track(
             user.id,

common/djangoapps/third_party_auth/admin.py

@@ -0,0 +1,66 @@
+# -*- coding: utf-8 -*-
+"""
+Admin site configuration for third party authentication
+"""
+
+from django.contrib import admin
+
+from config_models.admin import ConfigurationModelAdmin, KeyedConfigurationModelAdmin
+from .models import OAuth2ProviderConfig, SAMLProviderConfig, SAMLConfiguration, SAMLProviderData
+
+admin.site.register(OAuth2ProviderConfig, KeyedConfigurationModelAdmin)
+
+
+class SAMLProviderConfigAdmin(KeyedConfigurationModelAdmin):
+    """ Django Admin class for SAMLProviderConfig """
+    def get_list_display(self, request):
+        """ Don't show every single field in the admin change list """
+        return (
+            'name', 'enabled', 'backend_name', 'entity_id', 'metadata_source',
+            'has_data', 'icon_class', 'change_date', 'changed_by', 'edit_link'
+        )
+
+    def has_data(self, inst):
+        """ Do we have cached metadata for this SAML provider? """
+        if not inst.is_active:
+            return None  # N/A
+        data = SAMLProviderData.current(inst.entity_id)
+        return bool(data and data.is_valid())
+    has_data.short_description = u'Metadata Ready'
+    has_data.boolean = True
+
+admin.site.register(SAMLProviderConfig, SAMLProviderConfigAdmin)
+
+
+class SAMLConfigurationAdmin(ConfigurationModelAdmin):
+    """ Django Admin class for SAMLConfiguration """
+    def get_list_display(self, request):
+        """ Shorten the public/private keys in the change view """
+        return (
+            'change_date', 'changed_by', 'enabled', 'entity_id',
+            'org_info_str', 'key_summary',
+        )
+
+    def key_summary(self, inst):
+        """ Short summary of the key pairs configured """
+        if not inst.public_key or not inst.private_key:
+            return u'<em>Key pair incomplete/missing</em>'
+        pub1, pub2 = inst.public_key[0:10], inst.public_key[-10:]
+        priv1, priv2 = inst.private_key[0:10], inst.private_key[-10:]
+        return u'Public: {}…{}<br>Private: {}…{}'.format(pub1, pub2, priv1, priv2)
+    key_summary.allow_tags = True
+
+admin.site.register(SAMLConfiguration, SAMLConfigurationAdmin)
+
+
+class SAMLProviderDataAdmin(admin.ModelAdmin):
+    """ Django Admin class for SAMLProviderData """
+    list_display = ('entity_id', 'is_valid', 'fetched_at', 'expires_at', 'sso_url')
+    readonly_fields = ('is_valid', )
+
+    def get_readonly_fields(self, request, obj=None):
+        if obj:  # editing an existing object
+            return self.model._meta.get_all_field_names()  # pylint: disable=protected-access
+        return self.readonly_fields
+
+admin.site.register(SAMLProviderData, SAMLProviderDataAdmin)

common/djangoapps/third_party_auth/management/commands/saml.py

@@ -0,0 +1,146 @@
+# -*- coding: utf-8 -*-
+"""
+Management commands for third_party_auth
+"""
+import datetime
+import dateutil.parser
+from django.core.management.base import BaseCommand, CommandError
+from lxml import etree
+import requests
+from onelogin.saml2.utils import OneLogin_Saml2_Utils
+from third_party_auth.models import SAMLConfiguration, SAMLProviderConfig, SAMLProviderData
+
+#pylint: disable=superfluous-parens,no-member
+
+
+class MetadataParseError(Exception):
+    """ An error occurred while parsing the SAML metadata from an IdP """
+    pass
+
+
+class Command(BaseCommand):
+    """ manage.py commands to manage SAML/Shibboleth SSO """
+    help = '''Configure/maintain/update SAML-based SSO'''
+
+    def handle(self, *args, **options):
+        if len(args) != 1:
+            raise CommandError("saml requires one argument: pull")
+
+        if not SAMLConfiguration.is_enabled():
+            self.stdout.write("Warning: SAML support is disabled via SAMLConfiguration.\n")
+
+        subcommand = args[0]
+
+        if subcommand == "pull":
+            self.cmd_pull()
+        else:
+            raise CommandError("Unknown argment: {}".format(subcommand))
+
+    @staticmethod
+    def tag_name(tag_name):
+        """ Get the namespaced-qualified name for an XML tag """
+        return '{urn:oasis:names:tc:SAML:2.0:metadata}' + tag_name
+
+    def cmd_pull(self):
+        """ Fetch the metadata for each provider and update the DB """
+        # First make a list of all the metadata XML URLs:
+        url_map = {}
+        for idp_slug in SAMLProviderConfig.key_values('idp_slug', flat=True):
+            config = SAMLProviderConfig.current(idp_slug)
+            if not config.enabled:
+                continue
+            url = config.metadata_source
+            if url not in url_map:
+                url_map[url] = []
+            if config.entity_id not in url_map[url]:
+                url_map[url].append(config.entity_id)
+        # Now fetch the metadata:
+        for url, entity_ids in url_map.items():
+            try:
+                self.stdout.write("\n→ Fetching {}\n".format(url))
+                if not url.lower().startswith('https'):
+                    self.stdout.write("→ WARNING: This URL is not secure! It should use HTTPS.\n")
+                response = requests.get(url, verify=True)  # May raise HTTPError or SSLError
+                response.raise_for_status()  # May raise an HTTPError
+
+                try:
+                    parser = etree.XMLParser(remove_comments=True)
+                    xml = etree.fromstring(response.text, parser)
+                except etree.XMLSyntaxError:
+                    raise
+                # TODO: Can use OneLogin_Saml2_Utils to validate signed XML if anyone is using that
+
+                for entity_id in entity_ids:
+                    self.stdout.write("→ Processing IdP with entityID {}\n".format(entity_id))
+                    public_key, sso_url, expires_at = self._parse_metadata_xml(xml, entity_id)
+                    self._update_data(entity_id, public_key, sso_url, expires_at)
+            except Exception as err:  # pylint: disable=broad-except
+                self.stderr.write("→ ERROR: {}\n\n".format(err.message))
+
+    @classmethod
+    def _parse_metadata_xml(cls, xml, entity_id):
+        """
+        Given an XML document containing SAML 2.0 metadata, parse it and return a tuple of
+        (public_key, sso_url, expires_at) for the specified entityID.
+
+        Raises MetadataParseError if anything is wrong.
+        """
+        if xml.tag == cls.tag_name('EntityDescriptor'):
+            entity_desc = xml
+        else:
+            if xml.tag != cls.tag_name('EntitiesDescriptor'):
+                raise MetadataParseError("Expected root element to be <EntitiesDescriptor>, not {}".format(xml.tag))
+            entity_desc = xml.find(".//{}[@entityID='{}']".format(cls.tag_name('EntityDescriptor'), entity_id))
+            if not entity_desc:
+                raise MetadataParseError("Can't find EntityDescriptor for entityID {}".format(entity_id))
+
+        expires_at = None
+        if "validUntil" in xml.attrib:
+            expires_at = dateutil.parser.parse(xml.attrib["validUntil"])
+        if "cacheDuration" in xml.attrib:
+            cache_expires = OneLogin_Saml2_Utils.parse_duration(xml.attrib["cacheDuration"])
+            if expires_at is None or cache_expires < expires_at:
+                expires_at = cache_expires
+
+        sso_desc = entity_desc.find(cls.tag_name("IDPSSODescriptor"))
+        if not sso_desc:
+            raise MetadataParseError("IDPSSODescriptor missing")
+        if 'urn:oasis:names:tc:SAML:2.0:protocol' not in sso_desc.get("protocolSupportEnumeration"):
+            raise MetadataParseError("This IdP does not support SAML 2.0")
+
+        # Now we just need to get the public_key and sso_url
+        public_key = sso_desc.findtext("./{}//{}".format(
+            cls.tag_name("KeyDescriptor"), "{http://www.w3.org/2000/09/xmldsig#}X509Certificate"
+        ))
+        if not public_key:
+            raise MetadataParseError("Public Key missing. Expected an <X509Certificate>")
+        public_key = public_key.replace(" ", "")
+        binding_elements = sso_desc.iterfind("./{}".format(cls.tag_name("SingleSignOnService")))
+        sso_bindings = {element.get('Binding'): element.get('Location') for element in binding_elements}
+        try:
+            # The only binding supported by python-saml and python-social-auth is HTTP-Redirect:
+            sso_url = sso_bindings['urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect']
+        except KeyError:
+            raise MetadataParseError("Unable to find SSO URL with HTTP-Redirect binding.")
+        return public_key, sso_url, expires_at
+
+    def _update_data(self, entity_id, public_key, sso_url, expires_at):
+        """
+        Update/Create the SAMLProviderData for the given entity ID.
+        """
+        data_obj = SAMLProviderData.current(entity_id)
+        fetched_at = datetime.datetime.now()
+        if data_obj and (data_obj.public_key == public_key and data_obj.sso_url == sso_url):
+            data_obj.expires_at = expires_at
+            data_obj.fetched_at = fetched_at
+            data_obj.save()
+            self.stdout.write("→ Updated existing SAMLProviderData. Nothing has changed.\n")
+        else:
+            SAMLProviderData.objects.create(
+                entity_id=entity_id,
+                fetched_at=fetched_at,
+                expires_at=expires_at,
+                sso_url=sso_url,
+                public_key=public_key,
+            )
+            self.stdout.write("→ Created new record for SAMLProviderData\n")