From d57a37e9c127bd8b83902ee2ad628e63049d4b71 Mon Sep 17 00:00:00 2001 From: vmarkop Date: Thu, 9 Dec 2021 17:36:19 +0200 Subject: [PATCH] Refactored and recategorized SAML Settings --- powerdnsadmin/models/setting.py | 10 +- powerdnsadmin/routes/admin.py | 19 +- powerdnsadmin/services/saml.py | 26 +- .../admin_setting_authentication.html | 225 +++++++++--------- 4 files changed, 145 insertions(+), 135 deletions(-) diff --git a/powerdnsadmin/models/setting.py b/powerdnsadmin/models/setting.py index 3264570..f8378a5 100644 --- a/powerdnsadmin/models/setting.py +++ b/powerdnsadmin/models/setting.py @@ -114,7 +114,8 @@ class Setting(db.Model): 'saml_debug': True, 'saml_metadata_url': 'https://md.aai.grnet.gr/aggregates/grnet-metadata.xml', 'saml_metadata_cache_lifetime': '1', - 'saml_idp_sso_binding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect', + 'saml_idp_sso_binding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST', + 'saml_idp_slo_binding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect', 'saml_idp_entity_id': 'https://idp.uoa.gr/idp/shibboleth', 'saml_nameid_format': 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified', 'saml_sp_requested_attributes': '[ \ @@ -137,15 +138,18 @@ class Setting(db.Model): 'saml_sp_contact_mail': 'pda@uoa.gr', 'saml_cert_file': '/etc/pki/powerdns-admin/cert.crt', 'saml_cert_key': '/etc/pki/powerdns-admin/key.pem', - 'saml_sign_request': False, + 'saml_sign_authn_request': False, + 'saml_sign_logout_request_response': False, 'saml_logout': True, 'saml_logout_url': 'https://google.com', - 'saml_assertion_encrypted': False, + 'saml_want_assertions_encrypted': False, 'saml_digest_algorithm': 'http://www.w3.org/2000/09/xmldsig#rsa-sha1', 'saml_signature_algorithm': 'http://www.w3.org/2000/09/xmldsig#rsa-sha1', 'saml_want_assertions_signed': True, 'saml_sign_metadata': False, 'saml_want_message_signed': False, + 'saml_nameid_encrypted': 'False', + 'saml_want_nameid_encrypted': 'False', 'saml_metadata_cache_duration': 'PT5M', 'saml_metadata_valid_until': '999999999999999999', 'saml_autoprovisioning': True, diff --git a/powerdnsadmin/routes/admin.py b/powerdnsadmin/routes/admin.py index 88d260d..86f068c 100644 --- a/powerdnsadmin/routes/admin.py +++ b/powerdnsadmin/routes/admin.py @@ -1646,6 +1646,8 @@ def setting_authentication(): else Setting().defaults['saml_metadata_cache_lifetime'])) Setting().set('saml_idp_sso_binding', request.form.get('saml_idp_sso_binding')) + Setting().set('saml_idp_slo_binding', + request.form.get('saml_idp_slo_binding')) Setting().set('saml_idp_entity_id', request.form.get('saml_idp_entity_id')) Setting().set('saml_nameid_format', @@ -1689,8 +1691,11 @@ def setting_authentication(): Setting().set('saml_cert_key', request.form.get('saml_cert_key')) Setting().set( - 'saml_sign_request', - True if request.form.get('saml_sign_request') else False) + 'saml_sign_authn_request', + True if request.form.get('saml_sign_authn_request') else False) + Setting().set( + 'saml_sign_logout_request_response', + True if request.form.get('saml_sign_logout_request_response') else False) Setting().set( 'saml_logout', True if request.form.get('saml_logout') else False) @@ -1698,11 +1703,17 @@ def setting_authentication(): Setting().set('saml_logout_url', request.form.get('saml_logout_url')) Setting().set( - 'saml_assertion_encrypted', - True if request.form.get('saml_assertion_encrypted') else False) + 'saml_want_assertions_encrypted', + True if request.form.get('saml_want_assertions_encrypted') else False) Setting().set( 'saml_want_assertions_signed', True if request.form.get('saml_want_assertions_signed') else False) + Setting().set( + 'saml_want_nameid_encrypted', + True if request.form.get('saml_want_nameid_encrypted') else False) + Setting().set( + 'saml_nameid_encrypted', + True if request.form.get('saml_nameid_encrypted') else False) Setting().set('saml_digest_algorithm', request.form.get('saml_digest_algorithm')) Setting().set('saml_signature_algorithm', diff --git a/powerdnsadmin/services/saml.py b/powerdnsadmin/services/saml.py index d64f2ea..3c8e658 100644 --- a/powerdnsadmin/services/saml.py +++ b/powerdnsadmin/services/saml.py @@ -44,17 +44,17 @@ class SAML(object): def get_idp_data(self): - # lifetime = timedelta( - # minutes=int(Setting().get('saml_metadata_cache_lifetime'))) # should be seconds instead of minutes? + lifetime = timedelta( + minutes=int(Setting().get('saml_metadata_cache_lifetime'))) # should be seconds instead of minutes? # Since SAML is now user-configurable, idp_data may change before the lifetime has ended, # so metadata should not be cached at all, or outdated settings may be used. try: self.retrieve_idp_data() except: return None - # if self.idp_timestamp + lifetime < datetime.now(): - background_thread = Thread(target=self.retrieve_idp_data()) - background_thread.start() + if self.idp_timestamp + lifetime < datetime.now(): + background_thread = Thread(target=self.retrieve_idp_data()) + background_thread.start() return self.idp_data @@ -158,12 +158,12 @@ class SAML(object): settings['sp']['assertionConsumerService'] = {} settings['sp']['assertionConsumerService'][ - 'binding'] = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' + 'binding'] = Setting().get('saml_idp_sso_binding') settings['sp']['assertionConsumerService'][ 'url'] = own_url + '/saml/authorized' settings['sp']['singleLogoutService'] = {} settings['sp']['singleLogoutService'][ - 'binding'] = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' + 'binding'] = Setting().get('saml_idp_slo_binding') settings['sp']['singleLogoutService']['url'] = own_url + '/saml/sls' settings['idp'] = metadata['idp'] settings['strict'] = True @@ -176,17 +176,17 @@ class SAML(object): settings['security']['requestedAuthnContext'] = True settings['security'][ 'signatureAlgorithm'] = Setting().get('saml_signature_algorithm') - settings['security']['wantAssertionsEncrypted'] = Setting().get('saml_assertion_encrypted') + settings['security']['wantAssertionsEncrypted'] = Setting().get('saml_want_assertions_encrypted') settings['security']['wantAttributeStatement'] = True settings['security']['wantNameId'] = True - settings['security']['authnRequestsSigned'] = Setting().get('saml_sign_request') - settings['security']['logoutRequestSigned'] = Setting().get('saml_sign_request') - settings['security']['logoutResponseSigned'] = Setting().get('saml_sign_request') - settings['security']['nameIdEncrypted'] = False + settings['security']['authnRequestsSigned'] = Setting().get('saml_sign_authn_request') + settings['security']['logoutRequestSigned'] = Setting().get('saml_sign_logout_request_response') + settings['security']['logoutResponseSigned'] = Setting().get('saml_sign_logout_request_response') + settings['security']['nameIdEncrypted'] = Setting().get('saml_nameid_encrypted') settings['security']['signMetadata'] = Setting().get('saml_sign_metadata') settings['security']['wantAssertionsSigned'] = Setting().get('saml_want_assertions_signed') settings['security']['wantMessagesSigned'] = Setting().get('saml_want_message_signed') - settings['security']['wantNameIdEncrypted'] = False + settings['security']['wantNameIdEncrypted'] = Setting().get('saml_want_nameid_encrypted') settings['contactPerson'] = {} settings['contactPerson']['support'] = {} settings['contactPerson']['support']['emailAddress'] = Setting().get('saml_sp_contact_mail') diff --git a/powerdnsadmin/templates/admin_setting_authentication.html b/powerdnsadmin/templates/admin_setting_authentication.html index 8a650c9..044c588 100644 --- a/powerdnsadmin/templates/admin_setting_authentication.html +++ b/powerdnsadmin/templates/admin_setting_authentication.html @@ -691,39 +691,63 @@ -
- METADATA -
- - - -
-
- - - -
-
IDP -
- - - -
- - + + + +
+
+ + + +
+
+ + + +
+
+ +
- ATTRIBUTES + SP +
+ + + +
+
+ + + +
+
+ + + +
+
+ + + +
+
+ + +
+
+
+ SP ATTRIBUTES
@@ -749,21 +773,6 @@
-
- - - -
-
- - - -
-
- - - -
@@ -776,7 +785,7 @@
- CERTIFICATE + SIGNING & ENCRYPTION
@@ -788,8 +797,42 @@
- - + + +
+
+ + +
+
+ + +
+
+ + +
+
+ + +
+
+ + +
+
+ + +
+
+ + + +
+
+ + +
@@ -804,50 +847,18 @@
-
- ENCRYPTION -
- - -
-
- - -
-
- - - -
-
- - - -
-
- - -
-
- - -
-
-
- DURATION -
- - - -
-
- - - -
-
AUTOPROVISION +
+ + + +
+
+ + + +