Skip to content

Commit 192a3fd

Browse files
pitbulkpitbulk
committed
Merge branch 'charlescbeebe-demo_pyramid'
2 parents 6766c52 + 1bb7cba commit 192a3fd

23 files changed

+863
-1
lines changed

‎README.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,11 @@ openssl req -new -x509 -days 3652 -nodes -out sp.crt -keyout saml.key
153153

154154
This folder contains a Flask project that will be used as demo to show how to add SAML support to the Flask Framework. 'index.py' is the main flask file that has all the code, this file uses the templates stored at the 'templates' folder. In the 'saml' folder we found the 'certs' folder to store the x509 public and private key, and the saml toolkit settings (settings.json and advanced_settings.json).
155155

156+
#### demo_pyramid ####
157+
158+
This folder contains a Pyramid project that will be used as demo to show how to add SAML support to the [Pyramid Web Framework](http://docs.pylonsproject.org/projects/pyramid/en/latest/). '\_\_init__.py' is the main file that configures the app and its routes, 'views.py' is where all the logic and SAML handling takes place, and the templates are stored in the 'templates' folder. The 'saml' folder is the same as in the other two demos.
159+
160+
156161
#### setup.py ####
157162

158163
Setup script is the centre of all activity in building, distributing, and installing modules.
@@ -1134,3 +1139,80 @@ libxmlsec1-dev
11341139
```
11351140

11361141
Finally, add python3-saml to your requrements.txt and ```git push``` to trigger a build.
1142+
1143+
### Demo Pyramid ###
1144+
1145+
Unlike the other two projects, you don't need a pre-existing virtualenv to get
1146+
up and running here, since Pyramid comes from the
1147+
[buildout](http://www.buildout.org/en/latest/) school of thought.
1148+
1149+
To run the demo you need to install Pyramid, the requirements, etc.:
1150+
```
1151+
cd demo_pyramid
1152+
python3 -m venv env
1153+
env/bin/pip install --upgrade pip setuptools
1154+
env/bin/pip install -e ".[testing]"
1155+
```
1156+
1157+
If you want to make sure the tests pass, run:
1158+
```
1159+
env/bin/pytest
1160+
```
1161+
1162+
Next, edit the settings in `demo_pyramid/saml/settings.json`. (Pyramid runs on
1163+
port 6543 by default.)
1164+
1165+
Now you can run the demo like this:
1166+
```
1167+
env/bin/pserve development.ini
1168+
```
1169+
1170+
If that worked, the demo is now running at http://localhost:6543.
1171+
1172+
####Content####
1173+
1174+
The Pyramid project contains:
1175+
1176+
1177+
* ***\_\_init__.py*** is the main Pyramid file that configures the app and its routes.
1178+
1179+
* ***views.py*** is where all the SAML handling takes place.
1180+
1181+
* ***templates*** is the folder where Pyramid stores the templates of the project. It was implemented a layout.jinja2 template that is extended by index.jinja2 and attrs.jinja2, the templates of our simple demo that shows messages, user attributes when available and login and logout links.
1182+
1183+
* ***saml*** is a folder that contains the 'certs' folder that could be used to store the x509 public and private key, and the saml toolkit settings (settings.json and advanced_settings.json).
1184+
1185+
1186+
####SP setup####
1187+
1188+
The Onelogin's Python Toolkit allows you to provide the settings info in 2 ways: settings files or define a setting dict. In demo_pyramid the first method is used.
1189+
1190+
In the views.py file we define the SAML_PATH, which will target the 'saml' folder. We require it in order to load the settings files.
1191+
1192+
First we need to edit the saml/settings.json, configure the SP part and review the metadata of the IdP and complete the IdP info. Later edit the saml/advanced_settings.json files and configure the how the toolkit will work. Check the settings section of this document if you have any doubt.
1193+
1194+
####IdP setup####
1195+
1196+
Once the SP is configured, the metadata of the SP is published at the /metadata/ url. Based on that info, configure the IdP.
1197+
1198+
####How it works####
1199+
1200+
1. First time you access to the main view 'http://localhost:6543', you can select to login and return to the same view or login and be redirected to /?attrs (attrs view).
1201+
1202+
2. When you click:
1203+
1204+
2.1 in the first link, we access to /?sso (index view). An AuthNRequest is sent to the IdP, we authenticate at the IdP and then a Response is sent through the user's client to the SP, specifically the Assertion Consumer Service view: /?acs. Notice that a RelayState parameter is set to the url that initiated the process, the index view.
1205+
1206+
2.2 in the second link we access to /?attrs (attrs view), we will expetience have the same process described at 2.1 with the diference that as RelayState is set the attrs url.
1207+
1208+
3. The SAML Response is processed in the ACS /?acs, if the Response is not valid, the process stops here and a message is shown. Otherwise we are redirected to the RelayState view. a) / or b) /?attrs
1209+
1210+
4. We are logged in the app and the user attributes are showed. At this point, we can test the single log out functionality.
1211+
1212+
The single log out funcionality could be tested by 2 ways.
1213+
1214+
5.1 SLO Initiated by SP. Click on the "logout" link at the SP, after that a Logout Request is sent to the IdP, the session at the IdP is closed and replies through the client to the SP with a Logout Response (sent to the Single Logout Service endpoint). The SLS endpoint /?sls of the SP process the Logout Response and if is valid, close the user session of the local app. Notice that the SLO Workflow starts and ends at the SP.
1215+
1216+
5.2 SLO Initiated by IdP. In this case, the action takes place on the IdP side, the logout process is initiated at the IdP, sends a Logout Request to the SP (SLS endpoint, /?sls). The SLS endpoint of the SP process the Logout Request and if is valid, close the session of the user at the local app and send a Logout Response to the IdP (to the SLS endpoint of the IdP). The IdP receives the Logout Response, process it and close the session at of the IdP. Notice that the SLO Workflow starts and ends at the IdP.
1217+
1218+
Notice that all the SAML Requests and Responses are handled at a unique view (index) and how GET parameters are used to know the action that must be done.

‎demo_pyramid/.coveragerc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[run]
2+
source = demo_pyramid
3+
omit = demo_pyramid/test*

‎demo_pyramid/.gitignore‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
*.egg
2+
*.egg-info
3+
*.pyc
4+
*$py.class
5+
*~
6+
.coverage
7+
coverage.xml
8+
build/
9+
dist/
10+
.tox/
11+
nosetests.xml
12+
env*/
13+
tmp/
14+
Data.fs*
15+
*.sublime-project
16+
*.sublime-workspace
17+
.*.sw?
18+
.sw?
19+
.DS_Store
20+
coverage
21+
test

‎demo_pyramid/CHANGES.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
0.0
2+
---
3+
4+
- Initial version.

‎demo_pyramid/MANIFEST.in‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
include *.txt *.ini *.cfg *.rst
2+
recursive-include demo_pyramid *.ico *.png *.css *.gif *.jpg *.pt *.txt *.mak *.mako *.js *.html *.xml *.jinja2

‎demo_pyramid/README.txt‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
demo_pyramid
2+
===============================
3+
4+
Getting Started
5+
---------------
6+
7+
- Change directory into your newly created project.
8+
9+
cd demo_pyramid
10+
11+
- Create a Python virtual environment.
12+
13+
python3 -m venv env
14+
15+
- Upgrade packaging tools.
16+
17+
env/bin/pip install --upgrade pip setuptools
18+
19+
- Install the project in editable mode with its testing requirements.
20+
21+
env/bin/pip install -e ".[testing]"
22+
23+
- Run your project's tests.
24+
25+
env/bin/pytest
26+
27+
- Run your project.
28+
29+
env/bin/pserve development.ini

‎demo_pyramid/demo_pyramid/__init__.py‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
from pyramid.config import Configurator
2+
from pyramid.session import SignedCookieSessionFactory
3+
4+
5+
session_factory = SignedCookieSessionFactory('onelogindemopytoolkit')
6+
7+
8+
def main(global_config, **settings):
9+
""" This function returns a Pyramid WSGI application.
10+
"""
11+
config = Configurator(settings=settings)
12+
config.set_session_factory(session_factory)
13+
config.include('pyramid_jinja2')
14+
config.add_static_view('static', 'static', cache_max_age=3600)
15+
config.add_route('index', '/')
16+
config.add_route('attrs', '/attrs/')
17+
config.add_route('metadata', '/metadata/')
18+
config.scan()
19+
return config.make_wsgi_app()

‎demo_pyramid/demo_pyramid/saml/advanced_settings.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"security": {
3+
"nameIdEncrypted": false,
4+
"authnRequestsSigned": false,
5+
"logoutRequestSigned": false,
6+
"logoutResponseSigned": false,
7+
"signMetadata": false,
8+
"wantMessagesSigned": false,
9+
"wantAssertionsSigned": false,
10+
"wantNameId" : true,
11+
"wantNameIdEncrypted": false,
12+
"wantAssertionsEncrypted": false,
13+
"signatureAlgorithm": "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
14+
"digestAlgorithm": "http://www.w3.org/2000/09/xmldsig#sha1"
15+
},
16+
"contactPerson": {
17+
"technical": {
18+
"givenName": "technical_name",
19+
"emailAddress": "technical@example.com"
20+
},
21+
"support": {
22+
"givenName": "support_name",
23+
"emailAddress": "support@example.com"
24+
}
25+
},
26+
"organization": {
27+
"en-US": {
28+
"name": "sp_test",
29+
"displayname": "SP test",
30+
"url": "http://sp.example.com"
31+
}
32+
}
33+
}

‎demo_pyramid/demo_pyramid/saml/certs/README‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
Take care of this folder that could contain private key. Be sure that this folder never is published.
2+
3+
Onelogin Python Toolkit expects that certs for the SP could be stored in this folder as:
4+
5+
* sp.key Private Key
6+
* sp.crt Public cert
7+
8+
Also you can use other cert to sign the metadata of the SP using the:
9+
10+
* metadata.key
11+
* metadata.crt

‎demo_pyramid/demo_pyramid/saml/settings.json‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"strict": true,
3+
"debug": true,
4+
"sp": {
5+
"entityId": "https://<sp_domain>/metadata/",
6+
"assertionConsumerService": {
7+
"url": "https://<sp_domain>/?acs",
8+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
9+
},
10+
"singleLogoutService": {
11+
"url": "https://<sp_domain>/?sls",
12+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
13+
},
14+
"NameIDFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
15+
"x509cert": "",
16+
"privateKey": ""
17+
},
18+
"idp": {
19+
"entityId": "https://app.onelogin.com/saml/metadata/<onelogin_connector_id>",
20+
"singleSignOnService": {
21+
"url": "https://app.onelogin.com/trust/saml2/http-post/sso/<onelogin_connector_id>",
22+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
23+
},
24+
"singleLogoutService": {
25+
"url": "https://app.onelogin.com/trust/saml2/http-redirect/slo/<onelogin_connector_id>",
26+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
27+
},
28+
"x509cert": "<onelogin_connector_cert>"
29+
}
30+
}

0 commit comments

Comments
 (0)