ims.sso 1.0.0__py3-none-any.whl

ims/sso/__init__.py

@@ -0,0 +1,16 @@
+from Products.PluggableAuthService import registerMultiPlugin
+
+from . import plugin
+
+__version__ = "1.0.0"
+
+
+def initialize(context):
+    registerMultiPlugin(plugin.ImsSsoPlugin.meta_type)
+    context.registerClass(
+        plugin.ImsSsoPlugin,
+        permission="Manage portal",
+        constructors=(plugin.manage_addImsSsoForm, plugin.manage_addImsSso),
+        visibility=None,
+        icon="static/multiplugin.gif",
+    )

ims/sso/browser/__init__.py

@@ -0,0 +1 @@
+#

ims/sso/browser/configure.zcml

@@ -0,0 +1,142 @@
+<configure
+    xmlns="http://namespaces.zope.org/zope"
+    xmlns:browser="http://namespaces.zope.org/browser"
+    i18n_domain="ims.sso"
+    >
+
+  <!-- Plone override -->
+  <browser:page
+      name="usergroup-userprefs"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      class=".usergroups_usersoverview.UsersOverviewControlPanel"
+      template="templates/usergroups_usersoverview.pt"
+      permission="plone.app.controlpanel.UsersAndGroups"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+  <browser:page
+      name="sso-tasks"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      class=".cron.PeriodicTasks"
+      permission="cmf.ManagePortal"
+      />
+
+  <!-- Plone override -->
+  <browser:page
+      name="new-user"
+      for="plone.app.layout.navigation.interfaces.INavigationRoot"
+      class=".register.AddUserForm"
+      permission="plone.app.controlpanel.UsersAndGroups"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+  <!-- login/logout -->
+  <browser:page
+      name="sso-logout"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      class=".login.SsoLogout"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="linkaccount"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      class=".login.SsoLinkaccount"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="request_reactivation"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      class=".login.RequestReactivation"
+      attribute="render"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="reactivation"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      template="templates/reactivation.pt"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="reactivate_user"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      class=".login.ReactivateUserAccount"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="get_login_url"
+      for="zope.interface.Interface"
+      class=".login.LoginUrl"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="unauthorized_shib_unauthenticated"
+      for="zope.interface.Interface"
+      class=".unauthorized.Unauthorized"
+      template="templates/unauthorized_shib_unauthenticated.pt"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="unauthorized_shib_authenticated"
+      for="zope.interface.Interface"
+      class=".unauthorized.Unauthorized"
+      template="templates/unauthorized_shib_authenticated.pt"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="login_condition"
+      for="zope.interface.Interface"
+      class=".login.LoginCondition"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="logout_url"
+      for="zope.interface.Interface"
+      class=".login.LogoutUrl"
+      permission="zope.Public"
+      />
+  <!-- change password -->
+  <browser:page
+      name="change-password"
+      for="plone.app.layout.navigation.interfaces.INavigationRoot"
+      class=".password.ChangePassword"
+      permission="cmf.SetOwnPassword"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+
+  <browser:page
+      name="require_login"
+      for="*"
+      class=".login.RequireLoginView"
+      permission="zope.Public"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+
+  <browser:viewlet
+      name="sso_warnings"
+      manager="plone.app.layout.viewlets.interfaces.IAboveContent"
+      class=".viewlets.SsoWarningsViewlet"
+      permission="zope.Public"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+
+  <browser:page
+      name="relog-success"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      template="templates/relog.pt"
+      permission="zope2.Public"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+  <!-- this just prevents the default login form -->
+  <browser:page
+      name="login"
+      for="plone.base.interfaces.INavigationRoot"
+      class=".login.RedirectLogin"
+      permission="zope.Public"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+</configure>

ims/sso/browser/cron.py

@@ -0,0 +1,23 @@
+from plone.protect.interfaces import IDisableCSRFProtection
+from Products.Five import BrowserView
+from zope.component import getUtility
+from zope.interface.declarations import alsoProvides
+
+from ..interfaces import IReactivationUtility, ISingleSignonUtility
+
+
+class PeriodicTasks(BrowserView):
+    """This should be called by a cron job. It does three things
+    1. Users that have not been linked since X days will be deleted
+    2. Users who have not logged in in Y days will have their accounts disabled
+    3. Remove expired annotations
+    """
+
+    def __call__(self, *args, **kwargs):
+        alsoProvides(self.request, IDisableCSRFProtection)
+        sso = getUtility(ISingleSignonUtility)
+        react = getUtility(IReactivationUtility)
+        sso.purge_unlinked()
+        sso.disable_user_accounts()
+        react.purge_activation_keys()
+        return "User accounts updated."

ims/sso/browser/login.py

@@ -0,0 +1,257 @@
+from plone import api
+from plone.protect import CheckAuthenticator, PostOnly
+from plone.protect.interfaces import IDisableCSRFProtection
+from Products.CMFPlone.browser.login.login import LoginForm
+from Products.CMFPlone.PasswordResetTool import InvalidRequestError
+from Products.Five import BrowserView
+from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
+from zope.annotation.interfaces import IAnnotations
+from zope.component import getMultiAdapter, getUtility
+from zope.event import notify
+from zope.interface.declarations import alsoProvides, implementer
+from zope.publisher.interfaces import IPublishTraverse
+
+from ..configs import AUTHENTICATED_KEY, NOT_LINKED, _
+from ..events import UserIdpUpdated
+from ..interfaces import IReactivationUtility, ISingleSignonUtility
+
+
+class RedirectLogin(LoginForm):
+    """This is the Plone default login page. SSO sites do not use it."""
+
+    def __call__(self):
+        self.request.response.redirect(api.portal.get().absolute_url())
+        return
+
+
+class SsoLogout(BrowserView):
+    @property
+    def sso(self):
+        return getUtility(ISingleSignonUtility)
+
+    def __call__(self):
+        self.context.restrictedTraverse("browser_id_manager").flushBrowserIdCookie()
+        for cookie in self.request.cookies:
+            self.request.response.setCookie(
+                cookie,
+                self.request.cookies[cookie],
+                path="/",
+                expires="Thu, 01 Jan 1970 00:00:00 GMT",
+            )
+
+        self.request.response.redirect(self.sso.get_url_logout(request=self.request))
+
+
+@implementer(IPublishTraverse)
+class SsoLinkaccount(BrowserView):
+    def __init__(self, context, request):
+        self.subpath = []
+        super().__init__(context, request)
+
+    def publishTraverse(self, request, name):
+        self.subpath.append(name)
+        return self
+
+    def __call__(self):
+        if not api.user.is_anonymous():
+            # most likely a re-click or a tester
+            return self.invalid_key()
+        alsoProvides(self.request, IDisableCSRFProtection)
+        sso = getUtility(ISingleSignonUtility)
+        try:
+            key = self.subpath[0]
+            user_id = self.subpath[1]
+        except IndexError:
+            return self.invalid_key()
+
+        usr = api.user.get(userid=user_id)
+        is_relink = usr and NOT_LINKED not in usr.getUserName()
+        login_name = sso.get_login_from_request(self.request)
+
+        email = self.request.get(sso.get_setting("shib_header_email"))
+
+        if login_name and email:
+            pw_tool = api.portal.get_tool("portal_password_reset")
+            try:
+                pw_tool.verifyKey(key)
+                password = sso.generate_password(user_id)  # random, unknown password
+                pw_tool.resetPassword(user_id, key, password)
+            except InvalidRequestError:
+                return self.invalid_key()
+
+            try:
+                sso.set_login_name(user_id, login_name)
+            except ValueError:  # likely duplicate
+                return self.disallowed()
+            else:
+                sso.send_portal_link(email)
+                usr = api.user.get(userid=user_id)  # we must reinstantiate after change
+                if is_relink:
+                    plone_view = getMultiAdapter((self.context, self.request), name="plone")
+                    sso.notify_relinked(usr, email, plone_view)
+                    notify(UserIdpUpdated(usr))
+            return self.success()
+        else:
+            return ViewPageTemplateFile("templates/linkaccount_anonymous.pt")(self)
+
+    def disallowed(self):
+        return ViewPageTemplateFile("templates/linkaccount_disallowed.pt")(self)
+
+    def success(self):
+        return ViewPageTemplateFile("templates/linkaccount_finish.pt")(self)
+
+    def invalid_key(self):
+        username = api.user.get_current().getUserName()
+        if username != "Anonymous User":
+            api.portal.show_message(
+                _(
+                    "Invalid or expired key. No accounts were linked, but you are already logged in. Please update "
+                    "your bookmark to this page."
+                ),
+                self.request,
+                type="warning",
+            )
+            return self.request.response.redirect(api.portal.get().absolute_url())
+        else:
+            return ViewPageTemplateFile("templates/linkaccount_invalid.pt")(self)
+
+
+class LoginUrl(BrowserView):
+    def __call__(self):
+        acl = api.portal.get_tool("acl_users")
+        if "ims_sso_plugin" not in acl.objectIds():
+            return api.portal.get().absolute_url()
+        login_url = acl.ims_sso_plugin.login_url(self.request.ACTUAL_URL)
+        # stops loop if they try to login to an unauth page
+        # if "target=" in login_url and self.request.get("came_from"):
+        #     return login_url.split("target=")[0] + "target=" + self.request["came_from"]
+        # else:
+        return login_url
+
+
+class LoginCondition(BrowserView):
+    def __call__(self):
+        if not api.user.is_anonymous():  # sanity fallback
+            return False
+        sso = getUtility(ISingleSignonUtility)
+        return not sso.is_shibboleth_authenticated(self.request)
+
+
+class LogoutUrl(BrowserView):
+    def __call__(self):
+        return f"{api.portal.get().absolute_url()}/sso-logout"
+
+
+class RequireLoginView(BrowserView):
+    def __call__(self, *args, **kw):
+
+        utility = getUtility(ISingleSignonUtility)
+
+        if utility.is_plone_authenticated():
+            return api.content.get_view(
+                context=api.portal.get(),
+                request=self.request,
+                name="insufficient-privileges",
+            )()
+        else:
+            if utility.is_shibboleth_authenticated(self.request):
+                return api.content.get_view(
+                    context=self.context,
+                    request=self.request,
+                    name="unauthorized_shib_authenticated",
+                )()
+            else:
+                return api.content.get_view(
+                    context=self.context,
+                    request=self.request,
+                    name="unauthorized_shib_unauthenticated",
+                )()
+
+
+class RequestReactivation(BrowserView):
+    def render(self):
+        PostOnly(self.request)
+        CheckAuthenticator(self.request)
+
+        util = getUtility(IReactivationUtility)
+        portal = api.portal.get()
+        portal_url = portal.absolute_url()
+
+        _key = util.request_reactivation()
+        if not _key:
+            api.portal.show_message(
+                message="An activation key could not be obtained, contact the site administrator",
+                type="error",
+            )
+            self.request.response.redirect(portal_url)
+            return
+        _key, expiry = _key
+        expiry = api.portal.get_tool("translation_service").ulocalized_time(expiry, long_format=1)
+
+        reg_link = f"{portal_url}/reactivate_user/{_key}"
+        portal_title = api.portal.get_registry_record("plone.site_title")
+        msg = (
+            f"You are receiving this because you requested to have your account on {portal_title} \
+reactivated. To reactivate your account, visit {reg_link}.\n\n"
+            f"This link will expire in 1 day (by {expiry}). If the link expires, log into {portal_url} and "
+            f"reactivate your account again.\n\n"
+            f"If you did not initiate this action, you may ignore this message."
+        )
+        user_id = IAnnotations(self.request)[AUTHENTICATED_KEY]
+        api.portal.send_email(
+            recipient=api.user.get(user_id).getProperty("email"),
+            subject=f"Reactivate your account for {portal_title}",
+            body=msg,
+            immediate=False,
+        )
+        api.portal.show_message(
+            "An email with a link to reactivate your account has been sent to the address "
+            "associated with your account. If you do not receive the email, contact the "
+            f"<a href='{api.portal.get().absolute_url()}/contact-info'>site "
+            "administrator</a>."
+        )
+        self.request.response.redirect(portal_url + "/reactivation")
+        return
+
+
+class ReactivateUserAccount(BrowserView):
+    def __init__(self, context, request):
+        self.subpath = []
+        super().__init__(context, request)
+
+    def publishTraverse(self, request, name):
+        self.subpath.append(name)
+        return self
+
+    def __call__(self):
+        util = getUtility(IReactivationUtility)
+        try:
+            key = self.subpath[0]
+        except IndexError:
+            api.portal.show_message(
+                "Sorry, this appears to be an invalid request. Please make sure you copied "
+                "the URL exactly as it appears in your email.",
+                type="warning",
+            )
+            self.request.response.redirect(api.portal.get().absolute_url() + "/reactivation")
+            return
+        status = util.reactivate_user(key)
+        if status:
+            api.portal.show_message("Your account has been successfully reactivated.")
+            self.request.response.redirect(api.portal.get().absolute_url())
+        else:
+            if not api.user.is_anonymous():
+                # the activation key is invalid but the user is authenticated. They are probably visiting using
+                # the reactivation email link, after already doing that step.
+                self.request.response.redirect(api.portal.get().absolute_url())
+                return
+
+            api.portal.show_message(
+                "Your account could not be activated. This may "
+                "be due to an invalid or expired reactivation link, or "
+                "your account may have been disabled after the reactivation link was sent. "
+                f'Contact the <a href="{api.portal.get().absolute_url()}/contact-info">'
+                "site administrator</a> for help with accessing the site.",
+                type="error",
+            )
+            self.request.response.redirect(api.portal.get().absolute_url() + "/reactivation")

ims/sso/browser/password.py

@@ -0,0 +1,9 @@
+from plone.app.users.browser.passwordpanel import PasswordPanel
+from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
+
+
+class ChangePassword(PasswordPanel):
+    cp_template = ViewPageTemplateFile("templates/change_password.pt")
+
+    def __call__(self):
+        return self.cp_template()

ims/sso/browser/personalpreferences.py

@@ -0,0 +1 @@
+#

ims/sso/browser/register.py

@@ -0,0 +1,161 @@
+import datetime
+
+import plone.api as api
+from AccessControl import getSecurityManager
+from plone.app.users.browser.register import AddUserForm as BaseAddUserForm
+from Products.CMFCore.permissions import ManagePortal
+from Products.CMFCore.utils import getToolByName
+from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
+from z3c.form import button
+from zExceptions import Forbidden
+from zope.component import getUtility
+
+from ..configs import _
+from ..interfaces import IMailTemplatesUtility, ISingleSignonUtility
+
+
+class AddUserForm(BaseAddUserForm):
+    template = ViewPageTemplateFile("templates/newuser_form.pt")
+    enable_unload_protection = False  # we have two forms
+    confirmation_required = False
+    confirmation_user = ""
+
+    @property
+    def sso(self):
+        return getUtility(ISingleSignonUtility)
+
+    def sso_configured(self):
+        return self.sso.get_setting("mail_format")
+
+    def updateFields(self):
+        """override - hide some fields we want to generate (eg fullname) or require (mail_me)"""
+        super().updateFields()
+        if not self.sso_configured():
+            api.portal.show_message(
+                _("SSO not properly configured. Consult administrator."),
+                self.request,
+                type="error",
+            )
+            return self.request.response.redirect(f"{api.portal.get().absolute_url()}/@@usergroup-userprefs")
+        del self.fields["fullname"]
+        del self.fields["password"]
+        del self.fields["password_ctl"]
+        if "mail_me" in self.fields:
+            del self.fields["mail_me"]
+        del self.fields["username"]
+
+    def updateWidgets(self):
+        super().updateWidgets()
+
+        # technically these are customizable fields, so we should check that they
+        #   exist on the registration form
+        requested_fields = ("first_name", "last_name", "email")
+        for requested_field in requested_fields:
+            if requested_field in self.widgets and requested_field in self.request:
+                self.widgets[requested_field].value = self.request[requested_field]
+
+    def updateActions(self):
+        super().updateActions()
+        classes = self.actions["register"].klass
+        if "btn-secondary" in classes:
+            classes = classes.replace("btn-secondary", "")  # already has the primary class
+        self.actions["register"].klass = classes
+
+    def generate_user_id(self, data):
+        """we hide fullname and usernames, generate them"""
+        data["fullname"] = data.get("last_name") or ""
+        if data.get("first_name"):
+            data["fullname"] += ", " + data.get("first_name")
+        super().generate_user_id(data)
+        data["username"] = data["user_id"]
+        return data["user_id"]
+
+    def handle_join_success(self, data):
+        """always email the new user
+        update login name
+        """
+
+        data["mail_me"] = True
+        base_method = super().handle_join_success
+
+        getUtility(IMailTemplatesUtility).get_mailer()
+        data["fullname"] = data["last_name"]
+        if data.get("first_name"):
+            data["fullname"] += ", " + data["first_name"]
+        base_method(data)
+        self.sso.initialize_login(data["user_id"])
+
+        member = api.user.get(userid=data["user_id"])
+        member.setMemberProperties({
+            "created_date": datetime.date.today(),
+            "activation_date": datetime.date.today(),
+            "active": "active",
+        })
+
+    def applyProperties(self, userid, data):
+        """we needed to add fullname but now we have to remove it or applyProperties fails
+        this is because applyProperties assumes every key in data is a key of self.fields
+           except for ['login_name', 'user_id'] and getFieldNames(IRegisterSchema) + getFieldNames(IAddUserSchema)
+        we'll set this manually afterwards
+        """
+        fullname = data["fullname"]
+        del data["fullname"]
+        super().applyProperties(userid, data)
+        member = api.user.get(userid=userid)
+        member.setMemberProperties({"fullname": fullname})
+
+    @button.buttonAndHandler(_("label_register", default="Register"), name="register")
+    def action_join(self, action):
+        # we overwrite the super action_join so it doesn't redirect with search string
+
+        data, _errors = self.extractData()
+        # extra password validation
+        self.validate_registration(action, data)
+
+        if action.form.widgets.errors:
+            self.status = self.formErrorsMessage
+            return
+
+        match = api.portal.get_tool("acl_users").searchUsers(email=data["email"])
+        if match and not self.request.get("form.widgets.allow_match"):
+            self.confirmation_required = True
+
+            def wrap_name(name, match):
+                if len(match) > 1 and match[-1]["title"] == name:
+                    return f' and "{name}"'
+                return f'"{name}"'
+
+            joiner = ", " if len(match) > 2 else " "
+            self.confirmation_user = joiner.join([wrap_name(m["title"], match) for m in match])
+
+            return
+
+        self.handle_join_success(data)
+
+        if not self._finishedRegister:
+            return
+
+        portal_groups = getToolByName(self.context, "portal_groups")
+        user_id = data["user_id"]
+        is_zope_manager = getSecurityManager().checkPermission(
+            ManagePortal,
+            self.context,
+        )
+        try:
+            # Add user to the selected group(s)
+            if data.get("groups", None) is not None:
+                for groupname in data["groups"]:
+                    group = portal_groups.getGroupById(groupname)
+                    if "Manager" in group.getRoles() and not is_zope_manager:
+                        raise Forbidden
+                    portal_groups.addPrincipalToGroup(user_id, groupname, self.request)
+        except (AttributeError, ValueError) as err:
+            api.portal.show_message(err, type="error")
+            return
+        api.portal.show_message("User added.")
+        self.request.response.redirect(self.context.absolute_url() + "/@@usergroup-userprefs")
+
+    @button.buttonAndHandler("Cancel", name="cancel")
+    def handleCancel(self, action):
+        api.portal.show_message("User registration cancelled.")
+        self.request.response.redirect(self.context.absolute_url() + "/@@usergroup-userprefs")

ims/sso/browser/templates/add.pt

@@ -0,0 +1,46 @@
+<div tal:replace="structure context/manage_page_header"></div>
+<div tal:replace="structure context/manage_tabs"></div>
+
+<h2>Add ims.sso plugin</h2>
+
+<p class="form-help">
+    Install ims.sso plugin
+</p>
+
+<form action="manage_addImsSso"
+      method="POST"
+>
+  <table>
+    <tr>
+      <td class="form-label">
+                ID
+      </td>
+      <td>
+        <input name="id"
+               type="text"
+        />
+      </td>
+    </tr>
+    <tr>
+      <td class="form-label">
+                Title
+      </td>
+      <td>
+        <input name="title"
+               type="text"
+        />
+      </td>
+    </tr>
+    <tr>
+      <td colspan="2">
+        <div class="form-element">
+          <input type="submit"
+                 value="Add"
+          />
+        </div>
+      </td>
+    </tr>
+  </table>
+</form>
+
+<div tal:replace="structure context/manage_page_footer"></div>