This is a pre-production deployment of Warehouse. Changes made here affect the production instance of PyPI (pypi.python.org).
Help us improve Python packaging - Donate today!
Project Description

Introduction

hl.pas.samlplugin provides a SAML2 plugin for Zope’s PluggableAuthService. It provides the IExtractionPlugin, IAuthenticationPlugin, IChallengePlugin, ICredentialsResetPlugin interfaces.

hl.pas.samlplugin so far has been tested with OpenAM.

Installation

  1. Add the package to your buildout
  2. Install xmlsec
  3. Run buildout
  4. Restart Zope
  5. Visit your site’s Pluggable Auth Service in ZMI and add a SAML2 PAS plugin

Configuration

You will need to provide your IDP with an endpoint configuration for your Zope site containing your sites’ settings for AssertionConsumerService and SingleLogoutService. This will be an XML file looking like e.g:

<EntityDescriptor entityID="http://zopehost:8080/spEntityID" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
    <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false"
                     protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
                             Location="http://zopehost:8080/site/logout"
                             ResponseLocation="https://zopehost:8080/site/logout"/>
        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
        <AssertionConsumerService isDefault="true" index="0" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Location="http://zopehost:8080/site"/>
    </SPSSODescriptor>
    <RoleDescriptor xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                    xmlns:query="urn:oasis:names:tc:SAML:metadata:ext:query"
                    xsi:type="query:AttributeQueryDescriptorType"
                    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    </RoleDescriptor>
</EntityDescriptor>

At the moment the bindings specified in the above example (i.e. HTTP-Redirect for the SingleLogoutService and HTTP-POST for the AssertionConsumerService) are the only ones that are supported. For the authentication request, HTTP-Redirect is used.

Please refer to available SAML2 documentation for further information.

On the SAML2 PAS plugins’ properties tab, you will need to specify some more properties to make things work:

  • the absolute path to the IDP config file. This XML file should be provided by your IDP
  • the service endpoint URL, i.e. http://zopehost:8080/site in the example above
  • the service endpoint entity id as given to the IDP
  • the AuthnContextClass to use with the authentication request
  • the service URL binding to use for the passive session check
  • the absolute path to the xmlsec executable
  • the attribute provided by the IDP that should be used as the users login attribute (i.e. the user id used by Zope)
  • additional user properties given by the IDP that should be stored in the users session

Please have a look in the browser and the skins/auth subdirectories for examples on how to handle login/logout for a CMFSite.

It seems important to note that this PAS plugin (and the SAML2 protocol) only provides authentication. It is rather likely that you will have to implement your own plugins to provide the IPropertiesPlugin and the IUserEnumerationPlugin interfaces, at least if you have to deal with user generated content or want to use the Zope CMF.

Credits

Most of the code in the saml2 subfolder was taken from the pysaml2 package.

Changelog

1.3 (2015-03-02)

  • keywords

1.2 (2015-02-24)

  • added parts of the pysaml2 library (https://github.com/rohe/pysaml2) in subdirectory “saml2” to fix dependency issues with repoze.who and current Zope versions
  • changed license from GPL to Apache 2.0
  • the “passive”, “active” and “checksession” methods now take an optional parameter to override the default AuthnContextClass (from properties) on a per request basis

1.1 (2014-06-04)

  • pop SAMLart from request form to prevent endless redirect in certain cases
  • handle artifact response encoding correctly
  • updated keywords

1.0 (2014-04-22)

  • fix test

0.9 (2014-04-17)

  • added support for artifact service url binding

0.8 (2013-11-25)

  • added support for AuthnContextClass

0.7.1 (2013-09-06)

  • require pysaml2 == 1.0.2 (1.0.3 not working)

0.7 (2013-08-19)

  • Python 2.6 compatibility

0.6 (2013-08-16)

  • use pysaml2 >= 1.0

0.5 (2013-07-24)

  • fixed configuration caching issue (when using multiple plugins)

0.4 (2013-07-04)

  • improved config caching
  • add sample data for unittests

0.3 (2013-07-02)

  • add icon

0.2 (2013-07-02)

  • fix MANIFEST.in
Release History

Release History

1.3

This version

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

1.2

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

1.1

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

1.0

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.9

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.8

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.7.1

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.7

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.6

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.5

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.4

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.3

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.3dev

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.2

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

0.1

History Node

TODO: Figure out how to actually get changelog content.

Changelog content for this version goes here.

Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Show More

Download Files

Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
hl.pas.samlplugin-1.3.tar.gz (241.7 kB) Copy SHA256 Checksum SHA256 Source Mar 2, 2015

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting