Added single log out for auth_saml #27

TracyWR · 2021-07-01T15:04:14Z

Added single log out for auth_saml

Learning

Describe the research stage

Links to blog posts, patterns, libraries or addons used to solve this problem

busykoala

I believe this is very much work in progress. I could look into adding sessions in a easy way (most likely starlettes session middleware will do the job) to provide the userdata throughout the app. Were you able to look at testing the already newly introduced endpoints and the other things I mentioned?

fastapi_opa/auth/auth_saml.py

tests/test_oidc_auth.py

busykoala · 2021-07-03T08:50:45Z

fastapi_opa/auth/auth_saml.py

+            # sso_built_url = auth.login()
+            # request.session['AuthNRequestID'] = auth.get_last_request_id()
+            # return redirect(sso_built_url)
+        elif 'sso2' in request.query_params:


This should be tested.

I added a comment in the test. I don't quite agree that the test brings any value since it just repeats what's done in sso endpoint. In order to show the difference in a test you would also need to test the added attrs on calling with the sso2 param, while you just send a different url into the single sign on method (and there you can send anything, so not really an additional case in my eyes).

The add attrs are outside of the sso function, will think about how to test this.

fastapi_opa/auth/auth_saml.py

TracyWR · 2021-07-03T10:27:02Z

Thanks very much for your comments. Will look out soon. Cheers, Tracy

…

On Sat, 3 Jul 2021, 10:03 Matthias Osswald, ***@***.***> wrote: Assigned #27 <#27> to @TracyWR <https://github.com/TracyWR>. — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#27 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGK5YXPXSR5TNOHIIJYTMW3TV3G6DANCNFSM47U5CJDQ> .

fastapi_opa/auth/auth_saml.py

tests/test_oidc_auth.py

busykoala

I looked at how to make use of sessions. I checked out different approaches but ended up with the starlette implementation.

from starlette.middleware.sessions import SessionMiddleware
...

app = FastAPI()
app.add_middleware(OPAMiddleware, config=opa_config)
app.add_middleware(SessionMiddleware, secret_key="very-secret", max_age=3600)

Within the app the session keys can easily be gotten/set by just changing the value for a key:

request.session["user_session"] = "{'some': 'dict', 'as': 'string'}"
request.session.get("user_session")

I think this will be a good solution since it does not require additional dependencies, is very easy to handle in the opa middleware and doesn't require a interface change.

fastapi_opa/auth/auth_saml.py

tests/test_saml_auth.py

fastapi_opa/auth/auth_saml.py

tests/test_saml_auth.py

fastapi_opa/auth/auth_saml.py

busykoala · 2021-07-06T23:23:52Z

fastapi_opa/auth/auth_saml.py

+            # sso_built_url = auth.login()
+            # request.session['AuthNRequestID'] = auth.get_last_request_id()
+            # return redirect(sso_built_url)
+        elif 'sso2' in request.query_params:


I added a comment in the test. I don't quite agree that the test brings any value since it just repeats what's done in sso endpoint. In order to show the difference in a test you would also need to test the added attrs on calling with the sso2 param, while you just send a different url into the single sign on method (and there you can send anything, so not really an additional case in my eyes).

TracyWR · 2021-07-08T14:42:00Z

every single log out will redirect to using sls, so need sls method to finish single log out.

current sls method does not work, error is:

OneLogin_Saml2_Error: SAML LogoutRequest/LogoutResponse not found. Only supported HTTP_REDIRECT Binding

Traceback
\venv\lib\site-packages\onelogin\saml2\auth.py, line 203, in process_slo ‒

            return self.redirect_to(self.get_slo_response_url(), parameters)

```
    else:
```

        self.__errors.append('invalid_binding')

```
        raise OneLogin_Saml2_Error(
```

            'SAML LogoutRequest/LogoutResponse not found. Only supported HTTP_REDIRECT Binding',

            OneLogin_Saml2_Error.SAML_LOGOUTMESSAGE_NOT_FOUND

```
        )
```

busykoala

I did not yet setup the complete environment, but I created a little POC to show how the session indeed should be working just fine.

Let's define an in-package app like this:

# fastapi_opa/main.py
from typing import Dict

from fastapi import FastAPI
from starlette.middleware.sessions import SessionMiddleware
from starlette.requests import Request

from fastapi_opa import OPAConfig
from fastapi_opa import OPAMiddleware
from fastapi_opa.auth.auth_saml import SAMLAuthentication
from fastapi_opa.auth.auth_saml import SAMLConfig



opa_host = "http://localhost:8181"
# In this example we use OIDC authentication flow (using Keycloak)
saml_config = SAMLConfig(settings_directory="./tests/test_data/saml")
saml_auth = SAMLAuthentication(saml_config)

opa_config = OPAConfig(authentication=saml_auth, opa_host=opa_host)

app = FastAPI()
app.add_middleware(OPAMiddleware, config=opa_config)
app.add_middleware(SessionMiddleware, secret_key="secret", max_age=24*60*60)


@app.get("/")
async def root(request: Request) -> Dict:
    return {
        "msg": request.session.get("foo"),
    }

And now change the opa middleware into a simple example of using the session:

# fastapi_opa.opa.opa_middleware.py
import asyncio
import json
import logging
from json.decoder import JSONDecodeError

import requests
from fastapi.responses import JSONResponse
from starlette.requests import Request
from starlette.responses import RedirectResponse
from starlette.types import ASGIApp
from starlette.types import Receive
from starlette.types import Scope
from starlette.types import Send

from fastapi_opa.auth.exceptions import AuthenticationException
from fastapi_opa.opa.opa_config import OPAConfig

logger = logging.getLogger(__name__)


class OPAMiddleware:
    def __init__(self, app: ASGIApp, config: OPAConfig) -> None:
        self.config = config
        self.app = app

    async def __call__(
        self, scope: Scope, receive: Receive, send: Send
    ) -> None:
        request = Request(scope, receive, send)

        if "bar" in request.query_params:
            return await self.app(scope, receive, send)

        request.session["foo"] = "some data"
        return await RedirectResponse("?bar").__call__(
            scope, receive, send
        )
# end of file (for the POC)

Now additionally add uvicorn (just to run the example). If you start your app running poetry run uvicorn fastapi_opa.main:app and visit / a session is set with the key foo and the data some-data. Then the client is redirected to ?bar. On hitting ?bar the client will actually see the root route of fastapi, which checks what's in request.session.get("foo") and displays it in it's json msg. This also works within the middleware (just try printing it or so...).

The same works within the saml auth injectable. Feel free to add the session middleware for the test client since this will soon become a requirement for OIDC as well.

busykoala · 2021-07-13T21:18:43Z

fastapi_opa/auth/auth_saml.py

+        errors = saml_settings.validate_metadata(metadata)
+        status_code = 200
+        if len(errors) != 0:
+            metadata = ', '.join(errors)


I'm not sure about the flow specs here, or how you are planning to use this method (right now it is not used at all). But exposing the errors is a security issue usually.

busykoala · 2021-07-13T21:21:33Z

tests/test_saml_auth.py

+    assert response.status_code == 307
+
+
+async def async_return(result):


Where is this method used?

busykoala · 2021-07-13T21:35:48Z

fastapi_opa/auth/auth_saml.py

+
+        elif 'sls' in request.query_params:
+            logger.debug('--sls--')
+            return await self.single_log_out_from_IdP(request)


Please rename according to pep8 (self.single_log_out_from_idp).

busykoala · 2021-07-13T21:37:28Z

fastapi_opa/auth/auth_saml.py

@@ -39,18 +62,47 @@ async def init_saml_auth(self, request_args: Dict) -> OneLogin_Saml2_Auth:
        )

    @staticmethod
-    async def single_sign_on(auth: OneLogin_Saml2_Auth) -> RedirectResponse:
-        redirect_url = auth.login()
+    async def single_log_out_from_IdP(request: Request) -> \


If not explicitly required by black, please do now use \ here but wrap with parenthesis.

busykoala · 2021-07-13T21:38:52Z

fastapi_opa/auth/auth_saml.py

        }
+
+    async def get_metadata(self, request: Request):
+        saml_settings = OneLogin_Saml2_Settings(custom_base_path=self.custom_folder,


According to the type checker I think this should be self.custom_folder.as_posix() instead.

busykoala · 2021-07-13T22:34:40Z

every single log out will redirect to using sls, so need sls method to finish single log out.

current sls method does not work, error is:

OneLogin_Saml2_Error: SAML LogoutRequest/LogoutResponse not found. Only supported HTTP_REDIRECT Binding

Traceback
\venv\lib\site-packages\onelogin\saml2\auth.py, line 203, in process_slo ‒
1. ```
               return self.redirect_to(self.get_slo_response_url(), parameters)
   ```

2. ```
       else:
   ```

3. ```
           self.__errors.append('invalid_binding')
   ```

4. ```
           raise OneLogin_Saml2_Error(
   ```

5. ```
               'SAML LogoutRequest/LogoutResponse not found. Only supported HTTP_REDIRECT Binding',
   ```

6. ```
               OneLogin_Saml2_Error.SAML_LOGOUTMESSAGE_NOT_FOUND
   ```

7. ```
           )
   ```

This might be related (SAML-Toolkits/python-saml#146) but I was not yet able to dig into the issue much.

TracyWR · 2021-07-14T18:41:41Z

every single log out will redirect to using sls, so need sls method to finish single log out.

current sls method does not work, error is:

OneLogin_Saml2_Error: SAML LogoutRequest/LogoutResponse not found. Only supported HTTP_REDIRECT Binding

Traceback
\venv\lib\site-packages\onelogin\saml2\auth.py, line 203, in process_slo ‒
1. ```
               return self.redirect_to(self.get_slo_response_url(), parameters)
   ```

2. ```
       else:
   ```

3. ```
           self.__errors.append('invalid_binding')
   ```

4. ```
           raise OneLogin_Saml2_Error(
   ```

5. ```
               'SAML LogoutRequest/LogoutResponse not found. Only supported HTTP_REDIRECT Binding',
   ```

6. ```
               OneLogin_Saml2_Error.SAML_LOGOUTMESSAGE_NOT_FOUND
   ```

7. ```
           )
   ```

I have changed sls method, it works now

TracyWR · 2021-07-14T19:01:13Z

every single log out will redirect to using sls, so need sls method to finish single log out.

current sls method does not work, error is:
OneLogin_Saml2_Error: SAML LogoutRequest/LogoutResponse not found. Only supported HTTP_REDIRECT Binding
Traceback
\venv\lib\site-packages\onelogin\saml2\auth.py, line 203, in process_slo ‒
1. ```
               return self.redirect_to(self.get_slo_response_url(), parameters)
    else:
        self.__errors.append('invalid_binding')
        raise OneLogin_Saml2_Error(
            'SAML LogoutRequest/LogoutResponse not found. Only supported HTTP_REDIRECT Binding',
            OneLogin_Saml2_Error.SAML_LOGOUTMESSAGE_NOT_FOUND
        )
This might be related (onelogin/python-saml#146) but I was not yet able to dig into the issue much.

I have changed sls method, now it works

Added single log out for auth_saml

061a0d4

TracyWR force-pushed the tw_saml_opa branch from 3b72fc1 to a76a033 Compare July 2, 2021 19:02

Fix test about timestamp problem in windows 10

2a803d6

TracyWR force-pushed the tw_saml_opa branch from a76a033 to 2a803d6 Compare July 2, 2021 19:08

busykoala reviewed Jul 3, 2021

View reviewed changes

busykoala assigned TracyWR Jul 3, 2021

busykoala added enhancement New feature or request feature labels Jul 3, 2021

busykoala linked an issue Jul 3, 2021 that may be closed by this pull request

SAML: Implement additional endpoints #26

Closed

busykoala reviewed Jul 3, 2021

View reviewed changes

fastapi_opa/auth/auth_saml.py Outdated Show resolved Hide resolved

tests/test_oidc_auth.py Outdated Show resolved Hide resolved

busykoala reviewed Jul 3, 2021

View reviewed changes

TracyWR force-pushed the tw_saml_opa branch 2 times, most recently from 876c481 to 8004b91 Compare July 4, 2021 10:00

Changing print to logger and some format

9dd5d32

TracyWR marked this pull request as draft July 5, 2021 12:34

Add saml session in assertion_consumer_service

c86b593

TracyWR force-pushed the tw_saml_opa branch from 8004b91 to 77d6bba Compare July 5, 2021 15:18

Add test for sso2

2c524b4

TracyWR force-pushed the tw_saml_opa branch from 77d6bba to 2c524b4 Compare July 5, 2021 15:19

busykoala reviewed Jul 6, 2021

View reviewed changes

fastapi_opa/auth/auth_saml.py Outdated Show resolved Hide resolved

fastapi_opa/auth/auth_saml.py Outdated Show resolved Hide resolved

fastapi_opa/auth/auth_saml.py Show resolved Hide resolved

Tracy.Wu added 2 commits July 6, 2021 21:16

Delete extra code

1357417

Add sls method

a912465

TracyWR force-pushed the tw_saml_opa branch from 3b18a82 to a912465 Compare July 6, 2021 20:32

busykoala reviewed Jul 7, 2021

View reviewed changes

Tracy.Wu added 3 commits July 7, 2021 13:56

delete session when log out

950100f

Refactor sls method

35ed702

Add more tests

1f48326

TracyWR marked this pull request as ready for review July 8, 2021 12:20

Fix possible key error

c916415

TracyWR force-pushed the tw_saml_opa branch 4 times, most recently from a2d2215 to dab4ef7 Compare July 10, 2021 13:21

Changed sls method, need add test

4d28763

TracyWR force-pushed the tw_saml_opa branch from dab4ef7 to 4d28763 Compare July 10, 2021 13:29

Add get metadata method

96c00ce

busykoala reviewed Jul 13, 2021

View reviewed changes

TracyWR closed this Jul 14, 2021

TracyWR removed a link to an issue Jul 17, 2021

SAML: Implement additional endpoints #26

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added single log out for auth_saml #27

Added single log out for auth_saml #27

TracyWR commented Jul 1, 2021

busykoala left a comment

busykoala Jul 3, 2021

TracyWR Jul 6, 2021

busykoala Jul 6, 2021

TracyWR Jul 7, 2021

TracyWR commented Jul 3, 2021 via email

busykoala left a comment

busykoala Jul 6, 2021

TracyWR commented Jul 8, 2021 •

edited

Loading

busykoala left a comment

busykoala Jul 13, 2021

busykoala Jul 13, 2021

busykoala Jul 13, 2021

busykoala Jul 13, 2021

busykoala Jul 13, 2021

busykoala commented Jul 13, 2021

TracyWR commented Jul 14, 2021

TracyWR commented Jul 14, 2021

		assert response.status_code == 307


		async def async_return(result):

Added single log out for auth_saml #27

Added single log out for auth_saml #27

Conversation

TracyWR commented Jul 1, 2021

Learning

busykoala left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TracyWR commented Jul 3, 2021 via email

busykoala left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

TracyWR commented Jul 8, 2021 • edited Loading

busykoala left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

busykoala commented Jul 13, 2021

TracyWR commented Jul 14, 2021

TracyWR commented Jul 14, 2021

TracyWR commented Jul 8, 2021 •

edited

Loading