ipsilon

#99 Add a plugin-based authorization system for SP user sessions
Merged by merlinthp. Opened by merlinthp.
merlinthp/ipsilon authz  into  master

Download 99.patch

This system allows SP authentication requests to be authorized in
Ipsilon based on SP and user data. Authorization takes places after the
user has been authenticated, and before a response is sent back to the
SP.

The authorization plugin execution order is defined by via the
loginstack admin page. Each plugin has the option to permit or deny the
user session, or abstain from making a decision. If all configured
plugins abstain, or there are no configured plugins, the session is
permitted. The first plugin to not abstain determines the result of the
authorization process.

Three plugins are included:
- "permit" unconditionally permits all sessions, and exists primarily
for testing purposes
- "deny" unconditionally denies all sessions, and can be used both for
testing, and as a final configured plugin to deny sessions not
explicitly permitted by other plugins
- "spgroup" requires a user to be a member of a group that matches the
name of the SP

As a new database table is added to the adminconfig database, the
database format version has been bumped to version 3. The database
upgrade test suite has been updated to test upgrades to v3.

Authorization support is currently limited to SAML2 SP sessions, but
should be added to other providers.

Signed-off-by: Howard Johnson merlin@merlinthp.org

A first go at authorization support. Currently only supports authz of SAML2 sessions. No test suite yet.

Instead of escaping the ', you could just use " ".

I would personally prefer to just deny by default if nothing allowed, and then add the Allow module by default.
That way, the allowing is at least explicit.

Perhaps name this Allow? My mind finds that easier to interpret.

One of my coding idiosyncrasies - not mixing quoting styles. I think it has something to do with the years I spent writing perl, where "" triggers the string interpolation. I'll switch this to "".

rebased

Agreed. I'll change this.

Fine by me.

would it be an idea to also pass the provider plugin name, so that plugins can for example allow a user access to the OpenIDC "intranet" site, while not allowing access to the SAML2 "intranet" site?

rebased

rebased

Updated with Patrick's suggestions.

rebased

And now with the test suite working again.

1 new commit added

  • Add tests for authz code

The test suite patch includes changes to some other supporting code (the login authtest provider, and the http test helper classes). Happy to split those out into separate commits.

This is a hold-over from when the authz code defaulted to accepting sessions if all plugins abstain. Now we deny by default, so I'm not sure when we'd need it, and I'm inclined to remove the option.

3 new commits added

  • Add tests for authz code
  • Add authorization to the SAML2 provider
  • Add a plugin-based authorization system for SP user sessions

Well, I think that the fact that the option exists makes clear what it does if the user is not in the group: that's up to the admin. If the option were not there, it would need more reading of documentation. Perhaps explain instead in the help that if this is disabled, it will fall over to the next module?

Perhaps change this to "Authorization Plugins"? Not everyone might know what authz stands for :)

rebased

rebased

OK, I think I'm happy with this version ;)

You want to use plugins.get('Authz Providers'. []). The problem otherwise is that current installs won't have this in their install.changes file.

rebased

1 new commit added

  • Add authorization support (and test) to OpenID provider

5 new commits added

  • Add authorization support (and tests) to OpenID Connect provider
  • Add authorization support (and tests) to OpenID provider
  • Add tests for authz code
  • Add authorization to the SAML2 provider
  • Add a plugin-based authorization system for SP user sessions

As said on irc, check the "client" object. It has lots and lots more provider info available.

5 new commits added

  • Add authorization support (and tests) to OpenID Connect provider
  • Add authorization support (and tests) to OpenID provider
  • Add tests for authz code
  • Add authorization to the SAML2 provider
  • Add a plugin-based authorization system for SP user sessions

1 new commit added

  • Update main admin page SVG for authorization plugin stack

rebased

This last occurrence need to have the names reversed of provider and provplugname.

rebased

Commit bd67f89d fixes this pull-request

Pull-Request has been merged by merlin@merlinthp.org
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.