canaille 0.0.1__tar.gz

Canaille-0.0.1/Canaille.egg-info/PKG-INFO

@@ -0,0 +1,82 @@
+Metadata-Version: 2.1
+Name: Canaille
+Version: 0.0.1
+Summary: Simple OAuth2/OpenID Connect server based upon LDAP
+Home-page: https://gitlab.com/yaal/canaille
+Maintainer: Yaal
+Maintainer-email: contact@yaal.fr
+License: MIT
+Project-URL: Code, https://gitlab.com/yaal/canaille
+Project-URL: Issue Tracker, https://gitlab.com/yaal/canaille/-/issues
+Description: ⚠ Canaille is under development. Do not use in production yet. ⚠
+        
+        # Canaille
+        
+        Canaille is a French word meaning *rascal*, and is pronounced approximatively **Can I?**,
+        as in *Can I access this data please?*. It is a simple OpenID Connect provider based upon OpenLDAP.
+        
+        It aims to be very light, simple to install and simple to maintain. Its main features are :
+        - OAuth/OpenID Connect support;
+        - Authentication against a LDAP directory;
+        - No additional database required. Everything is stored in your OpenLDAP server;
+        - The code is easy to read and easy to edit in case you want to write a patch.
+        
+        ## Install
+        
+        First you need to install the schemas into your LDAP server. There are several ways to achieve this:
+        
+        ### LDAP schemas
+        
+        #### Option 1: Add the schema into your filesystem
+        
+        ```bash
+        test -d /etc/openldap/schema && sudo cp schema/* /etc/openldap/schema
+        test -d /etc/ldap/schema && sudo cp schema/* /etc/ldap/schema
+        sudo service slapd restart
+        ```
+        
+        #### Option 2: Use slapadd
+        
+        ```bash
+        sudo slapadd -n0 -l schema/*.ldif
+        ```
+        
+        ### Web interface
+        
+        Then you can deploy the code either by copying the git repository or installing the pip package:
+        
+        ```bash
+        pip install canaille
+        ```
+        
+        Finally you have to run the website in a WSGI server:
+        
+        ```bash
+        pip install gunicorn
+        gunicorn "canaille:create_app()"
+        ```
+        
+        ## Contribute
+        
+        Contributions are welcome!
+        To run the tests, you just need to run `tox`.
+        
+        To try a development environment, you can run the docker image and then open https://127.0.0.1:5000
+        You can then connect with user *admin* and password *admin* to access an admin account, or user *user* and password *user* for a regular one.
+        
+        ```bash
+        cp canaille/conf/config.sample.toml canaille/conf/config.toml
+        cp canaille/conf/oauth-authorization-server.sample.json canaille/conf/oauth-authorization-server.json
+        cp canaille/conf/openid-configuration.sample.json canaille/conf/openid-configuration.json
+        docker-compose up
+        ```
+        
+Platform: UNKNOWN
+Classifier: Environment :: Web Environment
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
+Classifier: Topic :: System :: Systems Administration :: Authentication/Directory :: LDAP
+Requires-Python: >=3.6
+Description-Content-Type: text/markdown

Canaille-0.0.1/Canaille.egg-info/SOURCES.txt

@@ -0,0 +1,77 @@
+LICENSE.md
+MANIFEST.in
+README.md
+setup.cfg
+setup.py
+Canaille.egg-info/PKG-INFO
+Canaille.egg-info/SOURCES.txt
+Canaille.egg-info/dependency_links.txt
+Canaille.egg-info/requires.txt
+Canaille.egg-info/top_level.txt
+canaille/__init__.py
+canaille/account.py
+canaille/consents.py
+canaille/flaskutils.py
+canaille/forms.py
+canaille/ldaputils.py
+canaille/models.py
+canaille/oauth.py
+canaille/oauth2utils.py
+canaille/tokens.py
+canaille/well_known.py
+canaille/admin/__init__.py
+canaille/admin/authorizations.py
+canaille/admin/clients.py
+canaille/admin/tokens.py
+canaille/conf/config.sample.toml
+canaille/conf/oauth-authorization-server.sample.json
+canaille/conf/openid-configuration.sample.json
+canaille/static/css/base.css
+canaille/static/datatables/French.json
+canaille/static/datatables/dataTables.semanticui.min.css
+canaille/static/datatables/dataTables.semanticui.min.js
+canaille/static/datatables/jquery.dataTables.min.css
+canaille/static/datatables/jquery.dataTables.min.js
+canaille/static/fomanticui/semantic.min.css
+canaille/static/fomanticui/semantic.min.js
+canaille/static/fomanticui/themes/default/assets/fonts/brand-icons.eot
+canaille/static/fomanticui/themes/default/assets/fonts/brand-icons.svg
+canaille/static/fomanticui/themes/default/assets/fonts/brand-icons.ttf
+canaille/static/fomanticui/themes/default/assets/fonts/brand-icons.woff
+canaille/static/fomanticui/themes/default/assets/fonts/brand-icons.woff2
+canaille/static/fomanticui/themes/default/assets/fonts/icons.eot
+canaille/static/fomanticui/themes/default/assets/fonts/icons.otf
+canaille/static/fomanticui/themes/default/assets/fonts/icons.svg
+canaille/static/fomanticui/themes/default/assets/fonts/icons.ttf
+canaille/static/fomanticui/themes/default/assets/fonts/icons.woff
+canaille/static/fomanticui/themes/default/assets/fonts/icons.woff2
+canaille/static/fomanticui/themes/default/assets/fonts/outline-icons.eot
+canaille/static/fomanticui/themes/default/assets/fonts/outline-icons.svg
+canaille/static/fomanticui/themes/default/assets/fonts/outline-icons.ttf
+canaille/static/fomanticui/themes/default/assets/fonts/outline-icons.woff
+canaille/static/fomanticui/themes/default/assets/fonts/outline-icons.woff2
+canaille/static/fomanticui/themes/default/assets/images/flags.png
+canaille/static/jquery/jquery.min.js
+canaille/static/js/base.js
+canaille/static/js/users.js
+canaille/templates/authorize.html
+canaille/templates/base.html
+canaille/templates/consent_list.html
+canaille/templates/error.html
+canaille/templates/fomanticui.j2
+canaille/templates/home.html
+canaille/templates/login.html
+canaille/templates/profile.html
+canaille/templates/token_list.html
+canaille/templates/admin/authorization_list.html
+canaille/templates/admin/authorization_view.html
+canaille/templates/admin/client_add.html
+canaille/templates/admin/client_edit.html
+canaille/templates/admin/client_list.html
+canaille/templates/admin/token_list.html
+canaille/templates/admin/token_view.html
+canaille/translations/messages.pot
+canaille/translations/fr/LC_MESSAGES/messages.mo
+canaille/translations/fr/LC_MESSAGES/messages.po
+schemas/oauth2-openldap.ldif
+schemas/oauth2-openldap.schema

Canaille-0.0.1/Canaille.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

Canaille-0.0.1/Canaille.egg-info/requires.txt

@@ -0,0 +1,8 @@
+authlib
+email_validator
+flask
+flask-babel
+flask-wtf
+python-ldap
+sentry-sdk[flask]
+toml

Canaille-0.0.1/Canaille.egg-info/top_level.txt

@@ -0,0 +1 @@
+canaille

Canaille-0.0.1/LICENSE.md

@@ -0,0 +1,19 @@
+Copyright (c) 2020 by Yaal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

Canaille-0.0.1/MANIFEST.in

@@ -0,0 +1,6 @@
+include schemas/*
+include canaille/conf/*.sample.*
+graft canaille/templates
+graft canaille/translations
+graft canaille/static
+exclude tests/*

Canaille-0.0.1/PKG-INFO

@@ -0,0 +1,82 @@
+Metadata-Version: 2.1
+Name: Canaille
+Version: 0.0.1
+Summary: Simple OAuth2/OpenID Connect server based upon LDAP
+Home-page: https://gitlab.com/yaal/canaille
+Maintainer: Yaal
+Maintainer-email: contact@yaal.fr
+License: MIT
+Project-URL: Code, https://gitlab.com/yaal/canaille
+Project-URL: Issue Tracker, https://gitlab.com/yaal/canaille/-/issues
+Description: ⚠ Canaille is under development. Do not use in production yet. ⚠
+        
+        # Canaille
+        
+        Canaille is a French word meaning *rascal*, and is pronounced approximatively **Can I?**,
+        as in *Can I access this data please?*. It is a simple OpenID Connect provider based upon OpenLDAP.
+        
+        It aims to be very light, simple to install and simple to maintain. Its main features are :
+        - OAuth/OpenID Connect support;
+        - Authentication against a LDAP directory;
+        - No additional database required. Everything is stored in your OpenLDAP server;
+        - The code is easy to read and easy to edit in case you want to write a patch.
+        
+        ## Install
+        
+        First you need to install the schemas into your LDAP server. There are several ways to achieve this:
+        
+        ### LDAP schemas
+        
+        #### Option 1: Add the schema into your filesystem
+        
+        ```bash
+        test -d /etc/openldap/schema && sudo cp schema/* /etc/openldap/schema
+        test -d /etc/ldap/schema && sudo cp schema/* /etc/ldap/schema
+        sudo service slapd restart
+        ```
+        
+        #### Option 2: Use slapadd
+        
+        ```bash
+        sudo slapadd -n0 -l schema/*.ldif
+        ```
+        
+        ### Web interface
+        
+        Then you can deploy the code either by copying the git repository or installing the pip package:
+        
+        ```bash
+        pip install canaille
+        ```
+        
+        Finally you have to run the website in a WSGI server:
+        
+        ```bash
+        pip install gunicorn
+        gunicorn "canaille:create_app()"
+        ```
+        
+        ## Contribute
+        
+        Contributions are welcome!
+        To run the tests, you just need to run `tox`.
+        
+        To try a development environment, you can run the docker image and then open https://127.0.0.1:5000
+        You can then connect with user *admin* and password *admin* to access an admin account, or user *user* and password *user* for a regular one.
+        
+        ```bash
+        cp canaille/conf/config.sample.toml canaille/conf/config.toml
+        cp canaille/conf/oauth-authorization-server.sample.json canaille/conf/oauth-authorization-server.json
+        cp canaille/conf/openid-configuration.sample.json canaille/conf/openid-configuration.json
+        docker-compose up
+        ```
+        
+Platform: UNKNOWN
+Classifier: Environment :: Web Environment
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
+Classifier: Topic :: System :: Systems Administration :: Authentication/Directory :: LDAP
+Requires-Python: >=3.6
+Description-Content-Type: text/markdown

Canaille-0.0.1/README.md

@@ -0,0 +1,62 @@
+⚠ Canaille is under development. Do not use in production yet. ⚠
+
+# Canaille
+
+Canaille is a French word meaning *rascal*, and is pronounced approximatively **Can I?**,
+as in *Can I access this data please?*. It is a simple OpenID Connect provider based upon OpenLDAP.
+
+It aims to be very light, simple to install and simple to maintain. Its main features are :
+- OAuth/OpenID Connect support;
+- Authentication against a LDAP directory;
+- No additional database required. Everything is stored in your OpenLDAP server;
+- The code is easy to read and easy to edit in case you want to write a patch.
+
+## Install
+
+First you need to install the schemas into your LDAP server. There are several ways to achieve this:
+
+### LDAP schemas
+
+#### Option 1: Add the schema into your filesystem
+
+```bash
+test -d /etc/openldap/schema && sudo cp schema/* /etc/openldap/schema
+test -d /etc/ldap/schema && sudo cp schema/* /etc/ldap/schema
+sudo service slapd restart
+```
+
+#### Option 2: Use slapadd
+
+```bash
+sudo slapadd -n0 -l schema/*.ldif
+```
+
+### Web interface
+
+Then you can deploy the code either by copying the git repository or installing the pip package:
+
+```bash
+pip install canaille
+```
+
+Finally you have to run the website in a WSGI server:
+
+```bash
+pip install gunicorn
+gunicorn "canaille:create_app()"
+```
+
+## Contribute
+
+Contributions are welcome!
+To run the tests, you just need to run `tox`.
+
+To try a development environment, you can run the docker image and then open https://127.0.0.1:5000
+You can then connect with user *admin* and password *admin* to access an admin account, or user *user* and password *user* for a regular one.
+
+```bash
+cp canaille/conf/config.sample.toml canaille/conf/config.toml
+cp canaille/conf/oauth-authorization-server.sample.json canaille/conf/oauth-authorization-server.json
+cp canaille/conf/openid-configuration.sample.json canaille/conf/openid-configuration.json
+docker-compose up
+```

Canaille-0.0.1/canaille/__init__.py

@@ -0,0 +1,197 @@
+import ldap
+import os
+import toml
+
+import canaille.admin
+import canaille.admin.tokens
+import canaille.admin.authorizations
+import canaille.admin.clients
+import canaille.consents
+import canaille.oauth
+import canaille.account
+import canaille.tokens
+import canaille.well_known
+
+from cryptography.hazmat.primitives import serialization as crypto_serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.backends import default_backend as crypto_default_backend
+
+from flask import Flask, g, request, render_template
+from flask_babel import Babel
+
+from .flaskutils import current_user
+from .ldaputils import LDAPObject
+from .oauth2utils import config_oauth
+from .models import User, Token, AuthorizationCode, Client, Consent
+
+try:  # pragma: no cover
+    import sentry_sdk
+    from sentry_sdk.integrations.flask import FlaskIntegration
+
+    SENTRY = True
+except Exception:
+    SENTRY = False
+
+
+def create_app(config=None):
+    app = Flask(__name__)
+    dir_path = os.path.dirname(os.path.realpath(__file__))
+
+    app.config.from_mapping(
+        {
+            "SESSION_COOKIE_NAME": "canaille",
+            "OAUTH2_REFRESH_TOKEN_GENERATOR": True,
+        }
+    )
+    if config:
+        app.config.from_mapping(config)
+    elif "CONFIG" in os.environ:
+        app.config.from_mapping(toml.load(os.environ.get("CONFIG")))
+    elif os.path.exists(os.path.join(dir_path, "conf", "config.toml")):
+        app.config.from_mapping(
+            toml.load(os.path.join(dir_path, "conf", "config.toml"))
+        )
+    else:
+        raise Exception(
+            "No configuration file found. "
+            "Either create conf/config.toml or set the 'CONFIG' variable environment."
+        )
+
+    setup_dev_keypair(app)
+
+    if not os.path.exists(app.config["JWT"]["PUBLIC_KEY"]) or not os.path.exists(
+        app.config["JWT"]["PRIVATE_KEY"]
+    ):
+        raise Exception("Invalid keypair")
+    setup_app(app)
+
+    return app
+
+
+def setup_dev_keypair(app):
+    if not os.environ.get("FLASK_ENV") == "development":
+        return
+
+    if os.path.exists(app.config["JWT"]["PUBLIC_KEY"]) or os.path.exists(
+        app.config["JWT"]["PRIVATE_KEY"]
+    ):
+        return
+
+    key = rsa.generate_private_key(
+        backend=crypto_default_backend(), public_exponent=65537, key_size=2048
+    )
+    private_key = key.private_bytes(
+        crypto_serialization.Encoding.PEM,
+        crypto_serialization.PrivateFormat.PKCS8,
+        crypto_serialization.NoEncryption(),
+    )
+    public_key = key.public_key().public_bytes(
+        crypto_serialization.Encoding.OpenSSH, crypto_serialization.PublicFormat.OpenSSH
+    )
+
+    with open(app.config["JWT"]["PUBLIC_KEY"], "wb") as fd:
+        fd.write(public_key)
+
+    with open(app.config["JWT"]["PRIVATE_KEY"], "wb") as fd:
+        fd.write(private_key)
+
+
+def setup_ldap_tree(app):
+    conn = ldap.initialize(app.config["LDAP"]["URI"])
+    conn.simple_bind_s(app.config["LDAP"]["BIND_DN"], app.config["LDAP"]["BIND_PW"])
+    Token.initialize(conn)
+    AuthorizationCode.initialize(conn)
+    Client.initialize(conn)
+    Consent.initialize(conn)
+    conn.unbind_s()
+
+
+def setup_app(app):
+    if SENTRY and app.config.get("SENTRY_DSN"):
+        sentry_sdk.init(dsn=app.config["SENTRY_DSN"], integrations=[FlaskIntegration()])
+
+    try:
+        LDAPObject.root_dn = app.config["LDAP"]["ROOT_DN"]
+        base = app.config["LDAP"]["USER_BASE"]
+        if base.endswith(app.config["LDAP"]["ROOT_DN"]):
+            base = base[: -len(app.config["LDAP"]["ROOT_DN"]) - 1]
+        User.base = base
+
+        app.url_map.strict_slashes = False
+
+        config_oauth(app)
+        setup_ldap_tree(app)
+        app.register_blueprint(canaille.account.bp)
+        app.register_blueprint(canaille.oauth.bp, url_prefix="/oauth")
+        app.register_blueprint(canaille.consents.bp, url_prefix="/consent")
+        app.register_blueprint(canaille.tokens.bp, url_prefix="/token")
+        app.register_blueprint(
+            canaille.well_known.bp, url_prefix="/.well-known"
+        )
+        app.register_blueprint(
+            canaille.admin.tokens.bp, url_prefix="/admin/token"
+        )
+        app.register_blueprint(
+            canaille.admin.authorizations.bp, url_prefix="/admin/authorization"
+        )
+        app.register_blueprint(
+            canaille.admin.clients.bp, url_prefix="/admin/client"
+        )
+
+        babel = Babel(app)
+
+        @babel.localeselector
+        def get_locale():
+            user = getattr(g, "user", None)
+            if user is not None:
+                return user.locale
+
+            if app.config.get("LANGUAGE"):
+                return app.config.get("LANGUAGE")
+
+            return request.accept_languages.best_match(["fr_FR", "en_US"])
+
+        @babel.timezoneselector
+        def get_timezone():
+            user = getattr(g, "user", None)
+            if user is not None:
+                return user.timezone
+
+        @app.before_request
+        def before_request():
+            g.ldap = ldap.initialize(app.config["LDAP"]["URI"])
+            g.ldap.simple_bind_s(
+                app.config["LDAP"]["BIND_DN"], app.config["LDAP"]["BIND_PW"]
+            )
+
+        @app.after_request
+        def after_request(response):
+            if "ldap" in g:
+                g.ldap.unbind_s()
+            return response
+
+        @app.context_processor
+        def global_processor():
+            return {
+                "logo_url": app.config.get("LOGO"),
+                "website_name": app.config.get("NAME"),
+                "user": current_user(),
+                "menu": True,
+            }
+
+        @app.errorhandler(403)
+        def unauthorized(e):
+            return render_template("error.html", error=403), 403
+
+        @app.errorhandler(404)
+        def page_not_found(e):
+            return render_template("error.html", error=404), 404
+
+        @app.errorhandler(500)
+        def server_error(e):
+            return render_template("error.html", error=500), 500
+
+    except Exception as exc:
+        if SENTRY and app.config.get("SENTRY_DSN"):
+            sentry_sdk.capture_exception(exc)
+        raise

Canaille-0.0.1/canaille/account.py

@@ -0,0 +1,72 @@
+from flask import Blueprint, request, flash, url_for, current_app
+from flask import render_template, redirect
+from flask_babel import gettext
+
+from .forms import LoginForm, ProfileForm
+from .flaskutils import current_user, user_needed
+from .models import User
+
+
+bp = Blueprint(__name__, "home")
+
+
+@bp.route("/")
+def index():
+    if not current_user():
+        return redirect(url_for("canaille.account.login"))
+    return redirect(url_for("canaille.account.profile"))
+
+
+@bp.route("/login", methods=("GET", "POST"))
+def login():
+    form = LoginForm(request.form or None)
+
+    if request.form:
+        if not form.validate() or not User.authenticate(
+            form.login.data, form.password.data, True
+        ):
+            flash(gettext("Login failed, please check your information"), "error")
+            return render_template("login.html", form=form)
+
+        return redirect(url_for("canaille.account.index"))
+
+    return render_template("login.html", form=form)
+
+
+@bp.route("/logout")
+def logout():
+    if current_user():
+        current_user().logout()
+    return redirect("/")
+
+
+@bp.route("/profile", methods=("GET", "POST"))
+@user_needed()
+def profile(user):
+    claims = current_app.config["JWT"]["MAPPING"]
+    data = {
+        k.lower(): getattr(user, v)[0]
+        if getattr(user, v) and isinstance(getattr(user, v), list)
+        else getattr(user, v) or ""
+        for k, v in claims.items()
+    }
+    form = ProfileForm(request.form or None, data=data)
+
+    if request.form:
+        if not form.validate():
+            flash(gettext("Profile edition failed."), "error")
+
+        else:
+            for attribute in form:
+                model_attribute_name = claims.get(attribute.name.upper())
+                if not model_attribute_name or not hasattr(user, model_attribute_name):
+                    continue
+
+                user[model_attribute_name] = [attribute.data]
+
+            if not form.password1.data or user.set_password(form.password1.data):
+                flash(gettext("Profile updated successfuly."), "success")
+
+            user.save()
+
+    return render_template("profile.html", form=form, menuitem="profile")

Canaille-0.0.1/canaille/admin/authorizations.py

@@ -0,0 +1,24 @@
+from flask import Blueprint, render_template
+from canaille.models import AuthorizationCode
+from canaille.flaskutils import admin_needed
+
+
+bp = Blueprint(__name__, "authorizations")
+
+
+@bp.route("/")
+@admin_needed()
+def index():
+    authorizations = AuthorizationCode.filter()
+    return render_template(
+        "admin/authorization_list.html", authorizations=authorizations
+    )
+
+
+@bp.route("/<authorization_id>", methods=["GET", "POST"])
+@admin_needed()
+def view(authorization_id):
+    authorization = AuthorizationCode.get(authorization_id)
+    return render_template(
+        "admin/authorization_view.html", authorization=authorization, menuitem="admin"
+    )