Matrix-Mirrors/anonymousland-synapse
1
0
Fork 0
mirror of https://git.anonymousland.org/anonymousland/synapse.git synced 2025-05-04 18:44:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

Move all the saml stuff out to a centralised handler

Browse source
This commit is contained in:
Richard van der Hoff 2019-06-26 22:52:02 +01:00
parent 0ade403f55
commit 3705322103
4 changed files with 96 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

35
synapse/rest/saml2/response_resource.py
View file

@ -13,19 +13,11 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
import logging
import saml2
from twisted.web.resource import Resource
from twisted.web.server import NOT_DONE_YET
from synapse.api.errors import CodeMessageException
from synapse.http.server import wrap_html_request_handler
from synapse.http.servlet import parse_string
from synapse.rest.client.v1.login import SSOAuthHandler
logger = logging.getLogger(__name__)
class SAML2ResponseResource(Resource):
@ -35,8 +27,7 @@ class SAML2ResponseResource(Resource):
def __init__(self, hs):
Resource.__init__(self)
self._saml_client = hs.get_saml_client()
self._sso_auth_handler = SSOAuthHandler(hs)
self._saml_handler = hs.get_saml_handler()
def render_POST(self, request):
self._async_render_POST(request)
@ -44,26 +35,4 @@ class SAML2ResponseResource(Resource):
@wrap_html_request_handler
def _async_render_POST(self, request):
resp_bytes = parse_string(request, "SAMLResponse", required=True)
relay_state = parse_string(request, "RelayState", required=True)
try:
saml2_auth = self._saml_client.parse_authn_request_response(
resp_bytes, saml2.BINDING_HTTP_POST
)
except Exception as e:
logger.warning("Exception parsing SAML2 response", exc_info=1)
raise CodeMessageException(400, "Unable to parse SAML2 response: %s" % (e,))
if saml2_auth.not_signed:
raise CodeMessageException(400, "SAML2 response was not signed")
if "uid" not in saml2_auth.ava:
raise CodeMessageException(400, "uid not in SAML2 response")
username = saml2_auth.ava["uid"][0]
displayName = saml2_auth.ava.get("displayName", [None])[0]
return self._sso_auth_handler.on_successful_auth(
username, request, relay_state, user_display_name=displayName
)
return self._saml_handler.handle_saml_response(request)