From 387508190a7fd69150a9d46d242bf02044301099 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 26 2016 09:01:42 +0000
Subject: openidc: Make it possible to disable dynamic client registration


This makes it possible for administrators to disable dynamic client registration.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/ipsilon/providers/openidc/auth.py b/ipsilon/providers/openidc/auth.py
index 46a6722..1a2f6d6 100644
--- a/ipsilon/providers/openidc/auth.py
+++ b/ipsilon/providers/openidc/auth.py
@@ -840,6 +840,10 @@ class Continue(AuthenticateRequest):
 class Registration(APIRequest):
 
     def POST(self, *args, **kwargs):
+        if not self.cfg.allow_dynamic_client_registration:
+            raise APIError(400, 'invalid_request',
+                           'dynamic client registration has been disabled')
+
         try:
             client_metadata = json.loads(cherrypy.request.rfile.read())
         except:
@@ -1135,8 +1139,6 @@ class OpenIDC(ProviderPageBase):
                                            'UserInfo'),
             'jwks_uri': '%s%s' % (self.cfg.endpoint_url,
                                   'Jwks'),
-            'registration_endpoint': '%s%s' % (self.cfg.endpoint_url,
-                                               'Registration'),
             'scopes_supported': self.cfg.supported_scopes,
             'response_types_supported': ['code', 'id_token' 'token',
                                          'token id_token'],
@@ -1183,6 +1185,11 @@ class OpenIDC(ProviderPageBase):
             'op_tos_uri': self.cfg.tos_url,
         }
 
+        if self.cfg.allow_dynamic_client_registration:
+            configuration['registration_endpoint'] = '%s%s' % (
+                self.cfg.endpoint_url,
+                'Registration')
+
         return json.dumps(configuration)
     wellknown_openid_configuration.public_function = True
 
diff --git a/ipsilon/providers/openidcp.py b/ipsilon/providers/openidcp.py
index 2d1b59a..f1706f7 100644
--- a/ipsilon/providers/openidcp.py
+++ b/ipsilon/providers/openidcp.py
@@ -69,6 +69,10 @@ Provides OpenID Connect authentication infrastructure. """
                 'idp subject salt',
                 'The salt used for pairwise subjects.',
                 None),
+            pconfig.Condition(
+                'allow dynamic client registration',
+                'Allow Dynamic Client registrations for Relying Parties',
+                True),
             pconfig.MappingList(
                 'default attribute mapping',
                 'Defines how to map attributes',
@@ -128,6 +132,10 @@ Provides OpenID Connect authentication infrastructure. """
         return self.get_config_value('idp subject salt')
 
     @property
+    def allow_dynamic_client_registration(self):
+        return self.get_config_value('allow dynamic client registration')
+
+    @property
     def default_attribute_mapping(self):
         return self.get_config_value('default attribute mapping')