providers/samlv2: remove SAMLv2 from master

passbook/providers/samlv2/apps.py

@@ -1,11 +0,0 @@
-"""passbook saml provider app config"""
-from django.apps import AppConfig
-
-
-class PassbookProviderSAMLv2Config(AppConfig):
-    """passbook samlv2 provider app config"""
-
-    name = "passbook.providers.samlv2"
-    label = "passbook_providers_samlv2"
-    verbose_name = "passbook Providers.SAMLv2"
-    mountpoint = "application/samlv2/"

passbook/providers/samlv2/saml/constants.py

@@ -1,15 +0,0 @@
-"""SAML-related constants"""
-NS_SAML_PROTOCOL = "urn:oasis:names:tc:SAML:2.0:protocol"
-NS_SAML_ASSERTION = "urn:oasis:names:tc:SAML:2.0:assertion"
-NS_SIGNATURE = "http://www.w3.org/2000/09/xmldsig#"
-
-REQ_KEY_REQUEST = "SAMLRequest"
-REQ_KEY_SIGNATURE = "Signature"
-
-SESSION_KEY = "passbook_saml_request"
-
-SAML_ATTRIB_ACS_URL = "AssertionConsumerServiceURL"
-SAML_ATTRIB_DESTINATION = "Destination"
-SAML_ATTRIB_ID = "ID"
-SAML_ATTRIB_ISSUE_INSTANT = "IssueInstant"
-SAML_ATTRIB_PROTOCOL_BINDING = "ProtocolBinding"

passbook/providers/samlv2/saml/parser.py

@@ -1,83 +0,0 @@
-"""SAML Request Parse/builder"""
-from typing import TYPE_CHECKING, Optional
-
-from defusedxml import ElementTree
-from signxml import XMLVerifier
-
-from passbook.crypto.models import CertificateKeyPair
-from passbook.providers.samlv2.saml.constants import (
-    NS_SAML_ASSERTION,
-    NS_SAML_PROTOCOL,
-    SAML_ATTRIB_ACS_URL,
-    SAML_ATTRIB_DESTINATION,
-    SAML_ATTRIB_ID,
-    SAML_ATTRIB_ISSUE_INSTANT,
-    SAML_ATTRIB_PROTOCOL_BINDING,
-)
-from passbook.providers.samlv2.saml.utils import decode_base64_and_inflate
-
-if TYPE_CHECKING:
-    from xml.etree.ElementTree import Element  # nosec
-
-
-# pylint: disable=too-many-instance-attributes
-class SAMLRequest:
-    """SAML Request data class, parse raw base64-encoded data, checks signature and more"""
-
-    _root: "Element"
-
-    acs_url: str
-    destination: str
-    id: str
-    issue_instant: str
-    protocol_binding: str
-
-    issuer: str
-
-    is_signed: bool
-    _detached_signature: str
-
-    def __init__(self):
-        self.acs_url = ""
-        self.destination = ""
-        # pylint: disable=invalid-name
-        self.id = ""
-        self.issue_instant = ""
-        self.protocol_binding = ""
-
-    @staticmethod
-    def parse(raw: str, detached_signature: Optional[str] = None) -> "SAMLRequest":
-        """Prase SAML request from raw string, which can be base64 encoded and deflated.
-        Optionally accepts a detached_signature, as from a REDIRECT request."""
-        decoded_xml = decode_base64_and_inflate(raw)
-        root = ElementTree.fromstring(decoded_xml)
-        req = SAMLRequest()
-        req._root = root  # pylint: disable=protected-access
-        # Verify the root element's tag
-        _expected_tag = f"{{{NS_SAML_PROTOCOL}}}AuthnRequest"
-        if root.tag != _expected_tag:
-            raise ValueError(
-                f"Invalid root tag, got '{root.tag}', expected '{_expected_tag}."
-            )
-        req.acs_url = root.attrib[SAML_ATTRIB_ACS_URL]
-        req.destination = root.attrib[SAML_ATTRIB_DESTINATION]
-        req.id = root.attrib[SAML_ATTRIB_ID]
-        req.issue_instant = root.attrib[SAML_ATTRIB_ISSUE_INSTANT]
-        req.protocol_binding = root.attrib[SAML_ATTRIB_PROTOCOL_BINDING]
-        req.issuer = root.find(f"{{{NS_SAML_ASSERTION}}}Issuer").text
-        # Check if this Request is signed
-        if detached_signature:
-            # pylint: disable=protected-access
-            req._detached_signature = detached_signature
-        return req
-
-    def verify_signature(self, keypair: CertificateKeyPair):
-        """Verify signature of SAML Request.
-        Raises `cryptography.exceptions.InvalidSignature` on validaton failure."""
-        verifier = XMLVerifier()
-        if self._detached_signature:
-            verifier.verify(
-                self._detached_signature, x509_cert=keypair.certificate_data
-            )
-        else:
-            verifier.verify(self._root, x509_cert=keypair.certificate_data)

passbook/providers/samlv2/saml/provider.py

@@ -1,5 +0,0 @@
-"""SAML Provider logic"""
-
-
-class SAMLProvider:
-    """SAML Provider"""

passbook/providers/samlv2/saml/utils.py

@@ -1,24 +0,0 @@
-"""Wrappers to de/encode and de/inflate strings"""
-import base64
-import zlib
-
-
-def decode_base64_and_inflate(encoded: str, encoding="utf-8") -> str:
-    """Base64 decode and ZLib decompress b64string"""
-    decoded_data = base64.b64decode(encoded)
-    try:
-        return zlib.decompress(decoded_data, -15).decode(encoding)
-    except zlib.error:
-        return decoded_data.decode(encoding)
-
-
-def deflate_and_base64_encode(inflated: bytes, encoding="utf-8"):
-    """Base64 and ZLib Compress b64string"""
-    zlibbed_str = zlib.compress(inflated)
-    compressed_string = zlibbed_str[2:-4]
-    return base64.b64encode(compressed_string).decode(encoding)
-
-
-def nice64(src):
-    """ Returns src base64-encoded and formatted nicely for our XML. """
-    return base64.b64encode(src).decode("utf-8").replace("\n", "")

passbook/providers/samlv2/urls.py

@@ -1,35 +0,0 @@
-"""passbook samlv2 URLs"""
-from django.urls import path
-
-from passbook.providers.samlv2.views import authorize, idp_initiated, slo, sso
-
-urlpatterns = [
-    path(
-        "<slug:app_slug>/authorize/",
-        authorize.AuthorizeView.as_view(),
-        name="authorize",
-    ),
-    path(
-        "<slug:app_slug>/sso/redirect/",
-        sso.SAMLRedirectBindingView.as_view(),
-        name="sso-redirect",
-    ),
-    path(
-        "<slug:app_slug>/sso/post/", sso.SAMLPostBindingView.as_view(), name="sso-post",
-    ),
-    path(
-        "<slug:app_slug>/slo/redirect/",
-        slo.SAMLRedirectBindingView.as_view(),
-        name="slo-redirect",
-    ),
-    path(
-        "<slug:app_slug>/slo/redirect/",
-        slo.SAMLPostBindingView.as_view(),
-        name="slo-post",
-    ),
-    path(
-        "<slug:app_slug>/initiate/",
-        idp_initiated.IDPInitiatedView.as_view(),
-        name="initiate",
-    ),
-]

passbook/providers/samlv2/views/authorize.py

@@ -1,6 +0,0 @@
-"""SAML Provider authorization view"""
-from django.views.generic import FormView
-
-
-class AuthorizeView(FormView):
-    """Authorization view"""

passbook/providers/samlv2/views/base.py

@@ -1,31 +0,0 @@
-"""SAML base views"""
-from typing import Optional
-
-from django.http import HttpRequest, HttpResponse
-from django.shortcuts import get_object_or_404
-from django.views import View
-
-from passbook.core.models import Application
-from passbook.policies.mixins import PolicyAccessMixin
-from passbook.providers.samlv2.saml.constants import SESSION_KEY
-from passbook.providers.samlv2.saml.parser import SAMLRequest
-
-
-class BaseSAMLView(PolicyAccessMixin, View):
-    """Base SAML View to resolve app_slug"""
-
-    application: Application
-
-    def setup(self, request: HttpRequest, *args, **kwargs):
-        View.setup(self, request, *args, **kwargs)
-        self.application = self.get_application(self.kwargs.get("app_slug"))
-
-    def get_application(self, app_slug: str) -> Optional[Application]:
-        """Return application or raise 404"""
-        return get_object_or_404(Application, slug=app_slug)
-
-    def handle_saml_request(self, request: SAMLRequest) -> HttpResponse:
-        """Handle SAML Request"""
-        self.request.SESSION[SESSION_KEY] = request
-        if self.application.skip_authorization:
-            pass

passbook/providers/samlv2/views/idp_initiated.py

@@ -1,6 +0,0 @@
-"""IDP-Initiated Views"""
-from django.views import View
-
-
-class IDPInitiatedView(View):
-    """IDP-initiated Handler"""

passbook/providers/samlv2/views/slo.py

@@ -1,10 +0,0 @@
-"""Single Logout Views"""
-from django.views import View
-
-
-class SAMLPostBindingView(View):
-    """Handle SAML POST-type Requests"""
-
-
-class SAMLRedirectBindingView(View):
-    """Handle SAML Redirect-type Requests"""

passbook/providers/samlv2/views/sso.py

@@ -1,41 +0,0 @@
-"""Single Signon Views"""
-from django.http import HttpRequest, HttpResponse, HttpResponseBadRequest
-
-from passbook.providers.samlv2.saml.constants import REQ_KEY_REQUEST, REQ_KEY_SIGNATURE
-from passbook.providers.samlv2.saml.parser import SAMLRequest
-from passbook.providers.samlv2.views.base import BaseSAMLView
-
-# SAML Authentication flow in passbook
-# - Parse and Verify SAML Request
-# - Check access to application (this is done after parsing as it might take a few seconds)
-# - Ask for user authorization (if required from Application)
-# - Log Access to audit log
-# - Create response with unique ID to protect against replay
-
-
-class SAMLPostBindingView(BaseSAMLView):
-    """Handle SAML POST-type Requests"""
-
-    # pylint: disable=unused-argument
-    def post(self, request: HttpRequest, app_slug: str) -> HttpResponse:
-        """Handle POST Requests"""
-        if REQ_KEY_REQUEST not in request.POST:
-            return HttpResponseBadRequest()
-        raw_saml_request = request.POST.get(REQ_KEY_REQUEST)
-        detached_signature = request.POST.get(REQ_KEY_SIGNATURE, None)
-        srq = SAMLRequest.parse(raw_saml_request, detached_signature)
-        return self.handle_saml_request(srq)
-
-
-class SAMLRedirectBindingView(BaseSAMLView):
-    """Handle SAML Redirect-type Requests"""
-
-    # pylint: disable=unused-argument
-    def get(self, request: HttpRequest, app_slug: str) -> HttpResponse:
-        """Handle GET Requests"""
-        if REQ_KEY_REQUEST not in request.GET:
-            return HttpResponseBadRequest()
-        raw_saml_request = request.GET.get(REQ_KEY_REQUEST)
-        detached_signature = request.GET.get(REQ_KEY_SIGNATURE, None)
-        srq = SAMLRequest.parse(raw_saml_request, detached_signature)
-        return self.handle_saml_request(srq)

passbook/root/settings.py

@@ -92,7 +92,6 @@ INSTALLED_APPS = [
     "passbook.providers.oauth.apps.PassbookProviderOAuthConfig",
     "passbook.providers.oidc.apps.PassbookProviderOIDCConfig",
     "passbook.providers.saml.apps.PassbookProviderSAMLConfig",
-    "passbook.providers.samlv2.apps.PassbookProviderSAMLv2Config",
     "passbook.recovery.apps.PassbookRecoveryConfig",
     "passbook.sources.ldap.apps.PassbookSourceLDAPConfig",
     "passbook.sources.oauth.apps.PassbookSourceOAuthConfig",