ims.sso 1.0.0a1__tar.gz

ims_sso-1.0.0a1/.gitignore

@@ -0,0 +1,59 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+env/
+build/
+_build/
+public/
+develop-eggs/
+dist/
+downloads/
+eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+*.egg-info/
+.installed.cfg
+*.egg
+.DS_Store
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.coverage
+.cache
+nosetests.xml
+coverage.xml
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+/node_modules/

ims_sso-1.0.0a1/PKG-INFO

@@ -0,0 +1,17 @@
+Metadata-Version: 2.4
+Name: ims.sso
+Version: 1.0.0a1
+Summary: Shibboleth integration and security considerations
+Project-URL: homepage, https://github.com/imsweb/ims.sso
+Author-email: Eric Wohnlich <wohnlice@imsweb.com>, Taina Dumay <dumayt@imsweb.com>
+License: GPL
+Classifier: Framework :: Plone :: 6.1
+Classifier: Programming Language :: Python
+Requires-Python: >=3.11
+Requires-Dist: plone
+Provides-Extra: test
+Requires-Dist: formencode; extra == 'test'
+Requires-Dist: plone-app-robotframework; extra == 'test'
+Requires-Dist: plone-app-testing; extra == 'test'
+Requires-Dist: plone-mocktestcase; extra == 'test'
+Requires-Dist: pytest-plone; extra == 'test'

ims_sso-1.0.0a1/ims/sso/__init__.py

@@ -0,0 +1,16 @@
+from Products.PluggableAuthService import registerMultiPlugin
+
+from . import plugin
+
+__version__ = "1.0.0a1"
+
+
+def initialize(context):
+    registerMultiPlugin(plugin.ImsSsoPlugin.meta_type)
+    context.registerClass(
+        plugin.ImsSsoPlugin,
+        permission="Manage portal",
+        constructors=(plugin.manage_addImsSsoForm, plugin.manage_addImsSso),
+        visibility=None,
+        icon="static/multiplugin.gif",
+    )

ims_sso-1.0.0a1/ims/sso/browser/__init__.py

@@ -0,0 +1 @@
+#

ims_sso-1.0.0a1/ims/sso/browser/configure.zcml

@@ -0,0 +1,142 @@
+<configure
+    xmlns="http://namespaces.zope.org/zope"
+    xmlns:browser="http://namespaces.zope.org/browser"
+    i18n_domain="ims.sso"
+    >
+
+  <!-- Plone override -->
+  <browser:page
+      name="usergroup-userprefs"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      class=".usergroups_usersoverview.UsersOverviewControlPanel"
+      template="templates/usergroups_usersoverview.pt"
+      permission="plone.app.controlpanel.UsersAndGroups"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+  <browser:page
+      name="sso-tasks"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      class=".cron.PeriodicTasks"
+      permission="cmf.ManagePortal"
+      />
+
+  <!-- Plone override -->
+  <browser:page
+      name="new-user"
+      for="plone.app.layout.navigation.interfaces.INavigationRoot"
+      class=".register.AddUserForm"
+      permission="plone.app.controlpanel.UsersAndGroups"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+  <!-- login/logout -->
+  <browser:page
+      name="sso-logout"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      class=".login.SsoLogout"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="linkaccount"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      class=".login.SsoLinkaccount"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="request_reactivation"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      class=".login.RequestReactivation"
+      attribute="render"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="reactivation"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      template="templates/reactivation.pt"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="reactivate_user"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      class=".login.ReactivateUserAccount"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="get_login_url"
+      for="zope.interface.Interface"
+      class=".login.LoginUrl"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="unauthorized_shib_unauthenticated"
+      for="zope.interface.Interface"
+      class=".unauthorized.Unauthorized"
+      template="templates/unauthorized_shib_unauthenticated.pt"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="unauthorized_shib_authenticated"
+      for="zope.interface.Interface"
+      class=".unauthorized.Unauthorized"
+      template="templates/unauthorized_shib_authenticated.pt"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="login_condition"
+      for="zope.interface.Interface"
+      class=".login.LoginCondition"
+      permission="zope.Public"
+      />
+  <browser:page
+      name="logout_url"
+      for="zope.interface.Interface"
+      class=".login.LogoutUrl"
+      permission="zope.Public"
+      />
+  <!-- change password -->
+  <browser:page
+      name="change-password"
+      for="plone.app.layout.navigation.interfaces.INavigationRoot"
+      class=".password.ChangePassword"
+      permission="cmf.SetOwnPassword"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+
+  <browser:page
+      name="require_login"
+      for="*"
+      class=".login.RequireLoginView"
+      permission="zope.Public"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+
+  <browser:viewlet
+      name="sso_warnings"
+      manager="plone.app.layout.viewlets.interfaces.IAboveContent"
+      class=".viewlets.SsoWarningsViewlet"
+      permission="zope.Public"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+
+  <browser:page
+      name="relog-success"
+      for="Products.CMFPlone.interfaces.IPloneSiteRoot"
+      template="templates/relog.pt"
+      permission="zope2.Public"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+  <!-- this just prevents the default login form -->
+  <browser:page
+      name="login"
+      for="plone.base.interfaces.INavigationRoot"
+      class=".login.RedirectLogin"
+      permission="zope.Public"
+      layer="..interfaces.IBrowserLayer"
+      />
+
+</configure>

ims_sso-1.0.0a1/ims/sso/browser/cron.py

@@ -0,0 +1,23 @@
+from plone.protect.interfaces import IDisableCSRFProtection
+from Products.Five import BrowserView
+from zope.component import getUtility
+from zope.interface.declarations import alsoProvides
+
+from ..interfaces import IReactivationUtility, ISingleSignonUtility
+
+
+class PeriodicTasks(BrowserView):
+    """This should be called by a cron job. It does three things
+    1. Users that have not been linked since X days will be deleted
+    2. Users who have not logged in in Y days will have their accounts disabled
+    3. Remove expired annotations
+    """
+
+    def __call__(self, *args, **kwargs):
+        alsoProvides(self.request, IDisableCSRFProtection)
+        sso = getUtility(ISingleSignonUtility)
+        react = getUtility(IReactivationUtility)
+        sso.purge_unlinked()
+        sso.disable_user_accounts()
+        react.purge_activation_keys()
+        return "User accounts updated."

ims_sso-1.0.0a1/ims/sso/browser/login.py

@@ -0,0 +1,257 @@
+from plone import api
+from plone.protect import CheckAuthenticator, PostOnly
+from plone.protect.interfaces import IDisableCSRFProtection
+from Products.CMFPlone.browser.login.login import LoginForm
+from Products.CMFPlone.PasswordResetTool import InvalidRequestError
+from Products.Five import BrowserView
+from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
+from zope.annotation.interfaces import IAnnotations
+from zope.component import getMultiAdapter, getUtility
+from zope.event import notify
+from zope.interface.declarations import alsoProvides, implementer
+from zope.publisher.interfaces import IPublishTraverse
+
+from ..configs import AUTHENTICATED_KEY, NOT_LINKED, _
+from ..events import UserIdpUpdated
+from ..interfaces import IReactivationUtility, ISingleSignonUtility
+
+
+class RedirectLogin(LoginForm):
+    """This is the Plone default login page. SSO sites do not use it."""
+
+    def __call__(self):
+        self.request.response.redirect(api.portal.get().absolute_url())
+        return
+
+
+class SsoLogout(BrowserView):
+    @property
+    def sso(self):
+        return getUtility(ISingleSignonUtility)
+
+    def __call__(self):
+        self.context.restrictedTraverse("browser_id_manager").flushBrowserIdCookie()
+        for cookie in self.request.cookies:
+            self.request.response.setCookie(
+                cookie,
+                self.request.cookies[cookie],
+                path="/",
+                expires="Thu, 01 Jan 1970 00:00:00 GMT",
+            )
+
+        self.request.response.redirect(self.sso.get_url_logout(request=self.request))
+
+
+@implementer(IPublishTraverse)
+class SsoLinkaccount(BrowserView):
+    def __init__(self, context, request):
+        self.subpath = []
+        super().__init__(context, request)
+
+    def publishTraverse(self, request, name):
+        self.subpath.append(name)
+        return self
+
+    def __call__(self):
+        if not api.user.is_anonymous():
+            # most likely a re-click or a tester
+            return self.invalid_key()
+        alsoProvides(self.request, IDisableCSRFProtection)
+        sso = getUtility(ISingleSignonUtility)
+        try:
+            key = self.subpath[0]
+            user_id = self.subpath[1]
+        except IndexError:
+            return self.invalid_key()
+
+        usr = api.user.get(userid=user_id)
+        is_relink = usr and NOT_LINKED not in usr.getUserName()
+        login_name = sso.get_login_from_request(self.request)
+
+        email = self.request.get(sso.get_setting("shib_header_email"))
+
+        if login_name and email:
+            pw_tool = api.portal.get_tool("portal_password_reset")
+            try:
+                pw_tool.verifyKey(key)
+                password = sso.generate_password(user_id)  # random, unknown password
+                pw_tool.resetPassword(user_id, key, password)
+            except InvalidRequestError:
+                return self.invalid_key()
+
+            try:
+                sso.set_login_name(user_id, login_name)
+            except ValueError:  # likely duplicate
+                return self.disallowed()
+            else:
+                sso.send_portal_link(email)
+                usr = api.user.get(userid=user_id)  # we must reinstantiate after change
+                if is_relink:
+                    plone_view = getMultiAdapter((self.context, self.request), name="plone")
+                    sso.notify_relinked(usr, email, plone_view)
+                    notify(UserIdpUpdated(usr))
+            return self.success()
+        else:
+            return ViewPageTemplateFile("templates/linkaccount_anonymous.pt")(self)
+
+    def disallowed(self):
+        return ViewPageTemplateFile("templates/linkaccount_disallowed.pt")(self)
+
+    def success(self):
+        return ViewPageTemplateFile("templates/linkaccount_finish.pt")(self)
+
+    def invalid_key(self):
+        username = api.user.get_current().getUserName()
+        if username != "Anonymous User":
+            api.portal.show_message(
+                _(
+                    "Invalid or expired key. No accounts were linked, but you are already logged in. Please update "
+                    "your bookmark to this page."
+                ),
+                self.request,
+                type="warning",
+            )
+            return self.request.response.redirect(api.portal.get().absolute_url())
+        else:
+            return ViewPageTemplateFile("templates/linkaccount_invalid.pt")(self)
+
+
+class LoginUrl(BrowserView):
+    def __call__(self):
+        acl = api.portal.get_tool("acl_users")
+        if "ims_sso_plugin" not in acl.objectIds():
+            return api.portal.get().absolute_url()
+        login_url = acl.ims_sso_plugin.login_url(self.request.ACTUAL_URL)
+        # stops loop if they try to login to an unauth page
+        # if "target=" in login_url and self.request.get("came_from"):
+        #     return login_url.split("target=")[0] + "target=" + self.request["came_from"]
+        # else:
+        return login_url
+
+
+class LoginCondition(BrowserView):
+    def __call__(self):
+        if not api.user.is_anonymous():  # sanity fallback
+            return False
+        sso = getUtility(ISingleSignonUtility)
+        return not sso.is_shibboleth_authenticated(self.request)
+
+
+class LogoutUrl(BrowserView):
+    def __call__(self):
+        return f"{api.portal.get().absolute_url()}/sso-logout"
+
+
+class RequireLoginView(BrowserView):
+    def __call__(self, *args, **kw):
+
+        utility = getUtility(ISingleSignonUtility)
+
+        if utility.is_plone_authenticated():
+            return api.content.get_view(
+                context=api.portal.get(),
+                request=self.request,
+                name="insufficient-privileges",
+            )()
+        else:
+            if utility.is_shibboleth_authenticated(self.request):
+                return api.content.get_view(
+                    context=self.context,
+                    request=self.request,
+                    name="unauthorized_shib_authenticated",
+                )()
+            else:
+                return api.content.get_view(
+                    context=self.context,
+                    request=self.request,
+                    name="unauthorized_shib_unauthenticated",
+                )()
+
+
+class RequestReactivation(BrowserView):
+    def render(self):
+        PostOnly(self.request)
+        CheckAuthenticator(self.request)
+
+        util = getUtility(IReactivationUtility)
+        portal = api.portal.get()
+        portal_url = portal.absolute_url()
+
+        _key = util.request_reactivation()
+        if not _key:
+            api.portal.show_message(
+                message="An activation key could not be obtained, contact the site administrator",
+                type="error",
+            )
+            self.request.response.redirect(portal_url)
+            return
+        _key, expiry = _key
+        expiry = api.portal.get_tool("translation_service").ulocalized_time(expiry, long_format=1)
+
+        reg_link = f"{portal_url}/reactivate_user/{_key}"
+        portal_title = api.portal.get_registry_record("plone.site_title")
+        msg = (
+            f"You are receiving this because you requested to have your account on {portal_title} \
+reactivated. To reactivate your account, visit {reg_link}.\n\n"
+            f"This link will expire in 1 day (by {expiry}). If the link expires, log into {portal_url} and "
+            f"reactivate your account again.\n\n"
+            f"If you did not initiate this action, you may ignore this message."
+        )
+        user_id = IAnnotations(self.request)[AUTHENTICATED_KEY]
+        api.portal.send_email(
+            recipient=api.user.get(user_id).getProperty("email"),
+            subject=f"Reactivate your account for {portal_title}",
+            body=msg,
+            immediate=False,
+        )
+        api.portal.show_message(
+            "An email with a link to reactivate your account has been sent to the address "
+            "associated with your account. If you do not receive the email, contact the "
+            f"<a href='{api.portal.get().absolute_url()}/contact-info'>site "
+            "administrator</a>."
+        )
+        self.request.response.redirect(portal_url + "/reactivation")
+        return
+
+
+class ReactivateUserAccount(BrowserView):
+    def __init__(self, context, request):
+        self.subpath = []
+        super().__init__(context, request)
+
+    def publishTraverse(self, request, name):
+        self.subpath.append(name)
+        return self
+
+    def __call__(self):
+        util = getUtility(IReactivationUtility)
+        try:
+            key = self.subpath[0]
+        except IndexError:
+            api.portal.show_message(
+                "Sorry, this appears to be an invalid request. Please make sure you copied "
+                "the URL exactly as it appears in your email.",
+                type="warning",
+            )
+            self.request.response.redirect(api.portal.get().absolute_url() + "/reactivation")
+            return
+        status = util.reactivate_user(key)
+        if status:
+            api.portal.show_message("Your account has been successfully reactivated.")
+            self.request.response.redirect(api.portal.get().absolute_url())
+        else:
+            if not api.user.is_anonymous():
+                # the activation key is invalid but the user is authenticated. They are probably visiting using
+                # the reactivation email link, after already doing that step.
+                self.request.response.redirect(api.portal.get().absolute_url())
+                return
+
+            api.portal.show_message(
+                "Your account could not be activated. This may "
+                "be due to an invalid or expired reactivation link, or "
+                "your account may have been disabled after the reactivation link was sent. "
+                f'Contact the <a href="{api.portal.get().absolute_url()}/contact-info">'
+                "site administrator</a> for help with accessing the site.",
+                type="error",
+            )
+            self.request.response.redirect(api.portal.get().absolute_url() + "/reactivation")

ims_sso-1.0.0a1/ims/sso/browser/password.py

@@ -0,0 +1,9 @@
+from plone.app.users.browser.passwordpanel import PasswordPanel
+from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
+
+
+class ChangePassword(PasswordPanel):
+    cp_template = ViewPageTemplateFile("templates/change_password.pt")
+
+    def __call__(self):
+        return self.cp_template()

ims_sso-1.0.0a1/ims/sso/browser/personalpreferences.py

@@ -0,0 +1 @@
+#