This commit avoids raising AuthEntryError when auth_entry is None.
At some point of the authentication flow, when the auth_entry is
missing from the auth URL (eg. auth/login/tpa-saml/?idp=idp), the
request session stores auth_entry: None causing this edited line to fail
which stops the login from completing.
* feat: choose signing cert explicitly in saml metadata
when parsing, we want to explicitly choose the use='signing' cert instead of accidentally choosing the encryption one
ENT-677
* test: test for parse_metadata_xml
* feat: also address case when signing key is absent
in this case we consider the 'use'-less keydescriptior as if it's for both signing and encryption
* test: test case for missing use=signing attribute
* test: fix test failure
Modify the existing login api in a way that
it will allow the user to login via username as well.
currently it is only allowing email to log the user in.
VAN-445
Modify the existing login api in a way that
it will allow the user to login via username as well.
currently it is only allowing email to log the user in.
VAN-445
This change associates users signing in using oauth providers when tpa is required, verifying that only a single database user is associated with the email.
For more information as to why this was added in a separate pipeline, check edx-platform#25935.
* Remove authentication, including SessionAuthentication, to fix CSRF
exemption by dropping CSRF check of SessionAuthentication.
* Several changes to make it more clear that only POST is supported and
clean up GET method testing.
* Removed the temporary 403 error logging that wasn't working.
* Removed test_single_access_token which was written for DOP, but
doesn't work with DOT. See
[MA-2122](https://openedx.atlassian.net/browse/MA-2122) for a ticket
about implementing this for DOT, although it doesn't seem to be a
priority. NOTE: A comment was added to the ticket explaining that this
test was removed.
* GET now returns default error for methods not allowed.
ARCHBOM-1667
* Generate common/djangoapps import shims for LMS
* Generate common/djangoapps import shims for Studio
* Stop appending project root to sys.path
* Stop appending common/djangoapps to sys.path
* Import from common.djangoapps.course_action_state instead of course_action_state
* Import from common.djangoapps.course_modes instead of course_modes
* Import from common.djangoapps.database_fixups instead of database_fixups
* Import from common.djangoapps.edxmako instead of edxmako
* Import from common.djangoapps.entitlements instead of entitlements
* Import from common.djangoapps.pipline_mako instead of pipeline_mako
* Import from common.djangoapps.static_replace instead of static_replace
* Import from common.djangoapps.student instead of student
* Import from common.djangoapps.terrain instead of terrain
* Import from common.djangoapps.third_party_auth instead of third_party_auth
* Import from common.djangoapps.track instead of track
* Import from common.djangoapps.util instead of util
* Import from common.djangoapps.xblock_django instead of xblock_django
* Add empty common/djangoapps/__init__.py to fix pytest collection
* Fix pylint formatting violations
* Exclude import_shims/ directory tree from linting
* ENT-3007 auth/saml/v0/saml/providerdata and auth/saml/v0/saml/providerconfig endpoints
Move code to subfolder for samlproviderconfig
extra comma
undo accidental remove of import
GET works for a single config now
Use ModelViewSet to get all CRUD method. Test still fails
Add auth/saml/v0/providerdata endpoints
fixup reverse and test issue, remove leading caret
just triggering run, why is it failing in CI?
pycodelint fixes
Skip auth tests unless feature is on
Tests for post/put for samlproviderdata
move urls to their own folders
api tests for post samlprovierconfig
create 1 providerconfig test case
lint fixes
lint
lint
cleanup code local urls /samlproviderconfig works
note needed right now
Fix import errors
lint
unused import
wip: first attempt at rbac auth and jwt cookie in test
round 2 with enterprise uuid as url param for samlproviderconfig
improve tests, still dont pass
fix test by using system role, wip other test
fix create test
add get/post tests for providerdata
isort fixes
string lint fix
Cleanup based on feedback round1
move utils to tests package
Move util fn to openedx.feature area
lint
ENT-3007 : Round 2 of work on auth/saml/v0/providerconfig and auth/saml/v0/providerdata endpoints
* Fix test issue use string uuid for permission obj
* snake case changes provider_config
* snake case
* provider_data, tests and lint
* patch and delete tests for providerdata
* snake_case
* snake_case
* snake_case
* make patch test stronger
* 404 if invalid uuid for get param
* common util for validate uuid4
* unused import
* lint fixes for pycodestyle
* 400 when uuid is missing
* 400 instead of 404 for missing uuid
* spell fix
* update docstring for api usage
* docstring clarify
* Add auth/samlproviderconfig CRUD endpoints for use in admin portal
Fixes: ENT-3007
* Move code to subfolder for samlproviderconfig
* extra comma
* undo accidental remove of import
* GET works for a single config now
* Use ModelViewSet to get all CRUD method. Test still fails
* Add auth/saml/v0/providerdata endpoints
* fixup reverse and test issue, remove leading caret
* just triggering run, why is it failing in CI?
* pycodelint fixes
* Skip auth tests unless feature is on
* Tests for post/put for samlproviderdata
* move urls to their own folders
* api tests for post samlprovierconfig
* create 1 providerconfig test case
* lint fixes
* lint
* lint
* cleanup code local urls /samlproviderconfig works
* note needed right now
* Fix import errors
* lint
* unused import
* wip: first attempt at rbac auth and jwt cookie in test
* round 2 with enterprise uuid as url param for samlproviderconfig
* improve tests, still dont pass
* fix test by using system role, wip other test
* fix create test
* add get/post tests for providerdata
* isort fixes
* string lint fix
* Cleanup based on feedback round1
* move utils to tests package
* Move util fn to openedx.feature area
* lint
* lint fix
* remove unused import
Rather than fetching the Site for every provider in a loop, just look at
the ID of the site.
Added regression test, showing N `django_site` requests before and 0 after.
Apply same username restrictions during SSO pipeline as we have user registeration flow to avoid SSO flow breakage at the time of user creation.
ENT-2730
Code quality fixes
This performs a dark launch compare of the existing implementation
(still in use) for fetching TPA provider configs and a new
implementation, recording metrics on exceptions and mismatches.
The new implementation should have two benefits, once we're switched
over:
- Fix 1+N queries on login page view where the site for each config
was fetched in a loop (ARCHBOM-1139)
- Don't allow configs with the same key on different sites to
interfere with each other (regression test added)
The new impl does not use TieredCache, but only the request cache,
which we may want to adjust later.
Added more info to log in SSO request/response flow
Fixed django admin links on model's link fields which are broken due to django 2.2 upgrade.
ENT-2798
Fixed quality violations and unit test
Fix xsscommitlint violation
Fixed pylint violation
