Merge pull request #14900 from open-craft/haikuginger/sso-provider-session-expiry

[ENT-327] Allow per-SSO-provider session expiration limits

common/djangoapps/third_party_auth/tests/specs/base.py

@@ -144,7 +144,7 @@ class IntegrationTestMixin(object):
         """
         raise NotImplementedError
 
-    def _test_return_login(self, user_is_activated=True):
+    def _test_return_login(self, user_is_activated=True, previous_session_timed_out=False):
         """ Test logging in to an account that is already linked. """
         # Make sure we're not logged in:
         dashboard_response = self.client.get(reverse('dashboard'))
@@ -156,12 +156,14 @@ class IntegrationTestMixin(object):
         # The user should be redirected to the provider:
         self.assertEqual(try_login_response.status_code, 302)
         login_response = self.do_provider_login(try_login_response['Location'])
-        # There will be one weird redirect required to set the login cookie:
-        self.assertEqual(login_response.status_code, 302)
-        self.assertEqual(login_response['Location'], self.url_prefix + self.complete_url)
-        # And then we should be redirected to the dashboard:
-        login_response = self.client.get(login_response['Location'])
-        self.assertEqual(login_response.status_code, 302)
+        # If the previous session was manually logged out, there will be one weird redirect
+        # required to set the login cookie (it sticks around if the main session times out):
+        if not previous_session_timed_out:
+            self.assertEqual(login_response.status_code, 302)
+            self.assertEqual(login_response['Location'], self.url_prefix + self.complete_url)
+            # And then we should be redirected to the dashboard:
+            login_response = self.client.get(login_response['Location'])
+            self.assertEqual(login_response.status_code, 302)
         if user_is_activated:
             url_expected = reverse('dashboard')
         else:

common/djangoapps/third_party_auth/tests/specs/test_testshib.py

@@ -1,11 +1,14 @@
 """
 Third_party_auth integration tests using a mock version of the TestShib provider
 """
+import datetime
 import ddt
 import unittest
 import httpretty
 import json
+import time
 from mock import patch
+from freezegun import freeze_time
 from social.apps.django_app.default.models import UserSocialAuth
 from unittest import skip
 
@@ -90,6 +93,7 @@ class SamlIntegrationTestUtilities(object):
         kwargs.setdefault('metadata_source', TESTSHIB_METADATA_URL)
         kwargs.setdefault('icon_class', 'fa-university')
         kwargs.setdefault('attr_email', 'urn:oid:1.3.6.1.4.1.5923.1.1.1.6')  # eduPersonPrincipalName
+        kwargs.setdefault('max_session_length', None)
         self.configure_saml_provider(**kwargs)
 
         if fetch_metadata:
@@ -207,6 +211,26 @@ class TestShibIntegrationTest(SamlIntegrationTestUtilities, IntegrationTestMixin
         self.assertEqual(num_failed, 0)
         self.assertEqual(len(failure_messages), 0)
 
+    def test_login_with_testshib_provider_short_session_length(self):
+        """
+        Test that when we have a TPA provider which as an explicit maximum
+        session length set, waiting for longer than that between requests
+        results in us being logged out.
+        """
+        # Configure the provider with a 10-second timeout
+        self._configure_testshib_provider(max_session_length=10)
+
+        now = datetime.datetime.utcnow()
+        with freeze_time(now):
+            # Test the login flow, adding the user in the process
+            super(TestShibIntegrationTest, self).test_login()
+
+        # Wait 30 seconds; longer than the manually-set 10-second timeout
+        later = now + datetime.timedelta(seconds=30)
+        with freeze_time(later):
+            # Test returning as a logged in user; this method verifies that we're logged out first.
+            self._test_return_login(previous_session_timed_out=True)
+
 
 @unittest.skipUnless(testutil.AUTH_FEATURE_ENABLED, 'third_party_auth not enabled')
 class SuccessFactorsIntegrationTest(SamlIntegrationTestUtilities, IntegrationTestMixin, testutil.SAMLTestCase):

common/djangoapps/third_party_auth/tests/test_admin.py

@@ -66,6 +66,9 @@ class Oauth2ProviderConfigAdminTest(testutil.TestCase):
         # Remove the icon_image from the POST data, to simulate unchanged icon_image
         post_data = models.model_to_dict(provider1)
         del post_data['icon_image']
+        # Remove max_session_length; it has a default null value which must be POSTed
+        # back as an absent value, rather than as a "null-like" included value.
+        del post_data['max_session_length']
 
         # Change the name, to verify POST
         post_data['name'] = 'Another name'