Use App ExportedVars if defined (#1183)
This commit is contained in:
Xavier Guimard
parent
8363614e01
commit
74f780733d
|
|
@ -312,7 +312,8 @@ t/30-Auth-and-issuer-SAML-Redirect-IdP-initiated.t
|
|||
t/30-Auth-and-issuer-SAML-Redirect.t
|
||||
t/30-SAML-ReAuth.t
|
||||
t/30-SAML-SP-rule.t
|
||||
t/31-Auth-and-issuer-CAS.t
|
||||
t/31-Auth-and-issuer-CAS-declared-app.t
|
||||
t/31-Auth-and-issuer-CAS-default.t
|
||||
t/32-Auth-and-issuer-OIDC-authorization_code-OP-logout.t
|
||||
t/32-Auth-and-issuer-OIDC-authorization_code.t
|
||||
t/32-Auth-and-issuer-OIDC-hybrid.t
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ extends 'Lemonldap::NG::Portal::Auth::Base', 'Lemonldap::NG::Portal::Lib::CAS';
|
|||
# PROPERTIES
|
||||
|
||||
has srvNumber => ( is => 'rw', default => 0 );
|
||||
has srvList => ( is => 'rw', default => sub { [] } );
|
||||
has srvList => ( is => 'rw', default => sub { [] } );
|
||||
|
||||
# INITIALIZATION
|
||||
|
||||
|
|
@ -198,8 +198,9 @@ sub extractFormInfo {
|
|||
}
|
||||
|
||||
# Request proxy tickets for proxied services
|
||||
my $proxied = $srvConf->{casSrvMetaDataOptionsProxiedServices}->{$_} || {};
|
||||
if ( %$proxied ) {
|
||||
my $proxied =
|
||||
$srvConf->{casSrvMetaDataOptionsProxiedServices}->{$srv} || {};
|
||||
if (%$proxied) {
|
||||
|
||||
# Check we received a PGT
|
||||
my $pgtId = $req->datas->{pgtId};
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ sub init {
|
|||
|
||||
# Launch parents initialization subroutines, then launch IdP en SP lists
|
||||
my $res = $self->Lemonldap::NG::Portal::Main::Issuer::init();
|
||||
return 0 unless($self->loadApp);
|
||||
return 0 unless ( $self->loadApp );
|
||||
$self->addUnauthRoute(
|
||||
( $self->path ) => {
|
||||
serviceValidate => 'serviceValidate',
|
||||
|
|
@ -101,6 +101,13 @@ sub run {
|
|||
return PE_OK;
|
||||
}
|
||||
|
||||
unless ( $service =~ m#^(https?://[^/]+)(/.*)?$# ) {
|
||||
$self->logger->error("Bad service $service");
|
||||
return PE_ERROR;
|
||||
}
|
||||
my ( $host, $uri ) = ( $1, $2 );
|
||||
my $app = $self->casAppList->{$host};
|
||||
|
||||
# Check access on the service
|
||||
my $casAccessControlPolicy = $self->conf->{casAccessControlPolicy};
|
||||
|
||||
|
|
@ -108,19 +115,12 @@ sub run {
|
|||
$self->logger->debug(
|
||||
"CAS access control requested on service $service");
|
||||
|
||||
## HERE
|
||||
unless ( $service =~ m#^(https?://[^/]+)(/.*)?$# ) {
|
||||
$self->logger->error("Bad service $service");
|
||||
return PE_ERROR;
|
||||
}
|
||||
my ( $host, $uri ) = ( $1, $2 );
|
||||
my $app;
|
||||
unless($app = $self->casAppList->{$host} ) {
|
||||
unless ($app) {
|
||||
$self->userLogger->error('CAS service not configured');
|
||||
return PE_CAS_SERVICE_NOT_ALLOWED;
|
||||
}
|
||||
if ( my $rule = $self->appRules->{$app} ) {
|
||||
if($rule->($req, $req->sessionInfo ) ) {
|
||||
if ( $rule->( $req, $req->sessionInfo ) ) {
|
||||
$self->logger->debug("CAS service $service access allowed");
|
||||
}
|
||||
|
||||
|
|
@ -130,7 +130,7 @@ sub run {
|
|||
|
||||
if ( $casAccessControlPolicy =~ /^(error)$/i ) {
|
||||
$self->logger->debug(
|
||||
"Return error instead of redirecting user on CAS service"
|
||||
"Return error instead of redirecting user on CAS service"
|
||||
);
|
||||
return PE_CAS_SERVICE_NOT_ALLOWED;
|
||||
}
|
||||
|
|
@ -170,6 +170,7 @@ sub run {
|
|||
$Sinfos->{renew} = $casRenewFlag;
|
||||
$Sinfos->{_cas_id} = $session_id;
|
||||
$Sinfos->{_utime} = $time;
|
||||
$Sinfos->{_casApp} = $app;
|
||||
|
||||
my $casServiceSession = $self->getCasSession( undef, $Sinfos );
|
||||
|
||||
|
|
@ -471,6 +472,7 @@ sub _validate2 {
|
|||
return $self->returnCasServiceValidateError( 'INVALID_TICKET',
|
||||
'Ticket not found' );
|
||||
}
|
||||
my $app = $casServiceSession->data->{_casApp};
|
||||
|
||||
$self->logger->debug("$urlType ticket session $ticket found");
|
||||
|
||||
|
|
@ -536,6 +538,7 @@ sub _validate2 {
|
|||
$PGinfos->{service} = $service;
|
||||
$PGinfos->{_cas_id} = $casServiceSession->data->{_cas_id};
|
||||
$PGinfos->{_utime} = $casServiceSession->data->{_utime};
|
||||
$PGinfos->{_casApp} = $app;
|
||||
|
||||
# Trace proxies
|
||||
$PGinfos->{proxies} = (
|
||||
|
|
@ -613,16 +616,18 @@ sub _validate2 {
|
|||
|
||||
# Get attributes [CAS 3.0]
|
||||
my $attributes = {};
|
||||
if ( defined $self->conf->{casAttributes}
|
||||
and %{ $self->conf->{casAttributes} } )
|
||||
{
|
||||
foreach my $casAttribute ( keys %{ $self->conf->{casAttributes} } ) {
|
||||
my $localSessionValue =
|
||||
$localSession->data->{ $self->conf->{casAttributes}
|
||||
->{$casAttribute} };
|
||||
$attributes->{$casAttribute} = $localSessionValue
|
||||
if defined $localSessionValue;
|
||||
}
|
||||
my $ev =
|
||||
( $app and $self->conf->{casAppMetaDataExportedVars}->{$app} )
|
||||
? $self->conf->{casAppMetaDataExportedVars}->{$app}
|
||||
: {};
|
||||
unless (%$ev) {
|
||||
$ev = $self->conf->{casAttributes} || {};
|
||||
}
|
||||
|
||||
foreach my $casAttribute ( keys %$ev ) {
|
||||
my $localSessionValue = $localSession->data->{ $ev->{$casAttribute} };
|
||||
$attributes->{$casAttribute} = $localSessionValue
|
||||
if defined $localSessionValue;
|
||||
}
|
||||
|
||||
# Return success message
|
||||
|
|
|
|||
|
|
@ -33,10 +33,7 @@ sub setSessionInfo {
|
|||
return PE_ERROR;
|
||||
}
|
||||
my %ev = (
|
||||
%{
|
||||
$self->conf->{casSrvMetaDataOptions}->{$srv}
|
||||
->{casSrvMetaDataOptionsExportedVars} || {}
|
||||
},
|
||||
%{ $self->conf->{casSrvMetaDataOptionsExportedVars}->{$srv} || {} },
|
||||
%{ $self->conf->{exportedVars} }
|
||||
);
|
||||
foreach ( keys %ev ) {
|
||||
|
|
|
|||
273
lemonldap-ng-portal/t/31-Auth-and-issuer-CAS-declared-app.t
Normal file
273
lemonldap-ng-portal/t/31-Auth-and-issuer-CAS-declared-app.t
Normal file
|
|
@ -0,0 +1,273 @@
|
|||
use Test::More; # skip_all => 'CAS is in rebuild';
|
||||
use strict;
|
||||
use IO::String;
|
||||
use MIME::Base64;
|
||||
|
||||
BEGIN {
|
||||
require 't/test-lib.pm';
|
||||
}
|
||||
|
||||
my $debug = 'error';
|
||||
my ( $issuer, $sp, $res );
|
||||
my %handlerOR = ( issuer => [], sp => [] );
|
||||
|
||||
no warnings 'redefine';
|
||||
|
||||
ok( $issuer = issuer(), 'Issuer portal' );
|
||||
$handlerOR{issuer} = \@Lemonldap::NG::Handler::Main::_onReload;
|
||||
count(1);
|
||||
switch ('sp');
|
||||
|
||||
ok( $sp = sp(), 'SP portal' );
|
||||
count(1);
|
||||
$handlerOR{sp} = \@Lemonldap::NG::Handler::Main::_onReload;
|
||||
|
||||
# Simple SP access
|
||||
ok(
|
||||
$res = $sp->_get(
|
||||
'/', accept => 'text/html',
|
||||
),
|
||||
'Unauth SP request'
|
||||
);
|
||||
count(1);
|
||||
expectRedirection( $res,
|
||||
'http://auth.idp.com/cas/login?service=http%3A%2F%2Fauth.sp.com%2F' );
|
||||
|
||||
# Query IdP
|
||||
switch ('issuer');
|
||||
ok(
|
||||
$res = $issuer->_get(
|
||||
'/cas/login',
|
||||
query => 'service=http://auth.sp.com/',
|
||||
accept => 'text/html'
|
||||
),
|
||||
'Query CAS server'
|
||||
);
|
||||
count(1);
|
||||
expectOK($res);
|
||||
|
||||
# Try to authenticate to IdP
|
||||
my $body = $res->[2]->[0];
|
||||
$body =~ s/^.*?<form.*?>//s;
|
||||
$body =~ s#</form>.*$##s;
|
||||
my %fields =
|
||||
( $body =~ /<input type="hidden".+?name="(.+?)".+?value="(.*?)"/sg );
|
||||
$fields{user} = $fields{password} = 'french';
|
||||
use URI::Escape;
|
||||
my $s = join( '&', map { "$_=" . uri_escape( $fields{$_} ) } keys %fields );
|
||||
ok(
|
||||
$res = $issuer->_post(
|
||||
'/cas/login',
|
||||
IO::String->new($s),
|
||||
accept => 'text/html',
|
||||
length => length($s),
|
||||
),
|
||||
'Post authentication'
|
||||
);
|
||||
count(1);
|
||||
my ($query) =
|
||||
expectRedirection( $res, qr#^http://auth.sp.com/\?(ticket=[^&]+)$# );
|
||||
my $idpId = expectCookie($res);
|
||||
|
||||
# Back to SP
|
||||
switch ('sp');
|
||||
ok( $res = $sp->_get( '/', query => $query, accept => 'text/html' ),
|
||||
'Query SP with ticket' );
|
||||
count(1);
|
||||
my $spId = expectCookie($res);
|
||||
|
||||
# Test authentication
|
||||
ok( $res = $sp->_get( '/', cookie => "lemonldap=$spId" ), 'Get / on SP' );
|
||||
count(1);
|
||||
expectOK($res);
|
||||
expectAuthenticatedAs( $res, 'french' );
|
||||
|
||||
# Test attributes
|
||||
ok( $res = $sp->_get("/sessions/global/$spId"), 'Get UTF-8' );
|
||||
expectOK($res);
|
||||
ok( $res = eval { JSON::from_json( $res->[2]->[0] ) }, ' GET JSON' )
|
||||
or print STDERR $@;
|
||||
ok( $res->{cn} eq 'Frédéric Accents', 'UTF-8 values' )
|
||||
or explain( $res, 'cn => Frédéric Accents' );
|
||||
count(3);
|
||||
|
||||
# Logout initiated by SP
|
||||
ok(
|
||||
$res = $sp->_get(
|
||||
'/',
|
||||
query => 'logout',
|
||||
cookie => "lemonldap=$spId",
|
||||
accept => 'text/html'
|
||||
),
|
||||
'Query SP for logout'
|
||||
);
|
||||
count(1);
|
||||
expectOK($res);
|
||||
ok(
|
||||
$res->[2]->[0] =~ m#iframe src="http://auth.idp.com(/cas/logout)\?(.+?)"#s,
|
||||
'Found iframe'
|
||||
);
|
||||
count(1);
|
||||
|
||||
# Query IdP with iframe src
|
||||
my $url = $1;
|
||||
$query = $2;
|
||||
ok( getHeader( $res, 'Content-Security-Policy' ) =~ /child-src auth.idp.com/,
|
||||
'Frame is authorizated' )
|
||||
or
|
||||
explain( $res->[1], 'Content-Security-Policy => ...child-src auth.idp.com' );
|
||||
count(1);
|
||||
|
||||
switch ('issuer');
|
||||
ok(
|
||||
$res = $issuer->_get(
|
||||
$url,
|
||||
query => $query,
|
||||
accept => 'text/html',
|
||||
cookie => "lemonldap=$idpId"
|
||||
),
|
||||
'Get iframe from IdP'
|
||||
);
|
||||
count(1);
|
||||
expectOK($res);
|
||||
ok( getHeader( $res, 'Content-Security-Policy' ) !~ /frame-ancestors/,
|
||||
' Frame can be embedded' )
|
||||
or explain( $res->[1],
|
||||
'Content-Security-Policy does not contain a frame-ancestors' );
|
||||
count(1);
|
||||
|
||||
# Verify that user has been disconnected
|
||||
ok( $res = $issuer->_get( '/', cookie => "lemonldap=$idpId" ), 'Query IdP' );
|
||||
count(1);
|
||||
expectReject($res);
|
||||
|
||||
switch ('sp');
|
||||
ok(
|
||||
$res =
|
||||
$sp->_get( '/', accept => 'text/html', cookie => "lemonldap=$idpId" ),
|
||||
'Query IdP'
|
||||
);
|
||||
count(1);
|
||||
expectRedirection( $res,
|
||||
'http://auth.idp.com/cas/login?service=http%3A%2F%2Fauth.sp.com%2F' );
|
||||
|
||||
clean_sessions();
|
||||
done_testing( count() );
|
||||
|
||||
# Redefine LWP methods for tests
|
||||
no warnings 'redefine';
|
||||
|
||||
sub LWP::UserAgent::request {
|
||||
my ( $self, $req ) = @_;
|
||||
ok( $req->uri =~ m#http://auth.((?:id|s)p).com([^\?]*)(?:\?(.*))?$#,
|
||||
'SOAP request' );
|
||||
my $host = $1;
|
||||
my $url = $2;
|
||||
my $query = $3;
|
||||
my $res;
|
||||
my $client = ( $host eq 'idp' ? $issuer : $sp );
|
||||
if ( $req->method eq 'POST' ) {
|
||||
my $s = $req->content;
|
||||
ok(
|
||||
$res = $client->_post(
|
||||
$url, IO::String->new($s),
|
||||
length => length($s),
|
||||
query => $query,
|
||||
type => 'application/xml',
|
||||
),
|
||||
"Execute POST request to $url"
|
||||
);
|
||||
}
|
||||
else {
|
||||
ok(
|
||||
$res = $client->_get(
|
||||
$url,
|
||||
type => 'application/xml',
|
||||
query => $query,
|
||||
),
|
||||
"Execute request to $url"
|
||||
);
|
||||
}
|
||||
expectOK($res);
|
||||
ok( getHeader( $res, 'Content-Type' ) =~ m#xml#, 'Content is XML' )
|
||||
or explain( $res->[1], 'Content-Type => application/xml' );
|
||||
my $httpResp = HTTP::Response->new( $res->[0], 'OK' );
|
||||
|
||||
while ( my $name = shift @{ $res->[1] } ) {
|
||||
$httpResp->header( $name, shift( @{ $res->[1] } ) );
|
||||
}
|
||||
$httpResp->content( join( '', @{ $res->[2] } ) );
|
||||
count(3);
|
||||
return $httpResp;
|
||||
}
|
||||
|
||||
sub switch {
|
||||
my $type = shift;
|
||||
@Lemonldap::NG::Handler::Main::_onReload = @{
|
||||
$handlerOR{$type};
|
||||
};
|
||||
}
|
||||
|
||||
sub issuer {
|
||||
return LLNG::Manager::Test->new(
|
||||
{
|
||||
ini => {
|
||||
logLevel => $debug,
|
||||
templatesDir => 'site/htdocs/static',
|
||||
domain => 'idp.com',
|
||||
portal => 'http://auth.idp.com',
|
||||
authentication => 'Demo',
|
||||
userDB => 'Same',
|
||||
issuerDBCASActivation => 1,
|
||||
casAttr => 'uid',
|
||||
casAccessControlPolicy => 'error',
|
||||
multiValuesSeparator => ';',
|
||||
casAppMetaDataExportedVars => {
|
||||
sp => {
|
||||
cn => 'cn',
|
||||
mail => 'mail',
|
||||
uid => 'uid',
|
||||
}
|
||||
},
|
||||
casAppMetaDataOptions => {
|
||||
sp => {
|
||||
casAppMetaDataOptionsService => 'http://auth.sp.com',
|
||||
}
|
||||
},
|
||||
}
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
sub sp {
|
||||
return LLNG::Manager::Test->new(
|
||||
{
|
||||
ini => {
|
||||
logLevel => $debug,
|
||||
domain => 'sp.com',
|
||||
portal => 'http://auth.sp.com',
|
||||
authentication => 'CAS',
|
||||
userDB => 'CAS',
|
||||
restSessionServer => 1,
|
||||
issuerDBCASActivation => 0,
|
||||
multiValuesSeparator => ';',
|
||||
exportedVars => {
|
||||
cn => 'cn',
|
||||
},
|
||||
casSrvMetaDataExportedVars => {
|
||||
idp => {
|
||||
cn => 'cn',
|
||||
mail => 'mail',
|
||||
uid => 'uid',
|
||||
}
|
||||
},
|
||||
casSrvMetaDataOptions => {
|
||||
idp => {
|
||||
casSrvMetaDataOptionsUrl => 'http://auth.idp.com/cas',
|
||||
casSrvMetaDataOptionsGateway => 0,
|
||||
}
|
||||
},
|
||||
},
|
||||
}
|
||||
);
|
||||
}
|
||||
|
|
@ -7,7 +7,7 @@ BEGIN {
|
|||
require 't/test-lib.pm';
|
||||
}
|
||||
|
||||
my $debug = 'debug';
|
||||
my $debug = 'error';
|
||||
my ( $issuer, $sp, $res );
|
||||
my %handlerOR = ( issuer => [], sp => [] );
|
||||
|
||||
|
|
@ -240,9 +240,6 @@ sub sp {
|
|||
restSessionServer => 1,
|
||||
issuerDBCASActivation => 0,
|
||||
multiValuesSeparator => ';',
|
||||
exportedVars => {
|
||||
cn => 'cn',
|
||||
},
|
||||
casSrvMetaDataExportedVars => {
|
||||
idp => {
|
||||
cn => 'cn',
|
||||
|
|
@ -171,7 +171,7 @@ sub expectReject {
|
|||
or explain( $res->{error}, $code );
|
||||
}
|
||||
else {
|
||||
pass("Error code is $code");
|
||||
pass("Error code is $res->{error}");
|
||||
}
|
||||
count(3);
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user