Package: hl.pas.samlplugin
IntroductionContentsIntroductionInstallationConfigurationCreditsChangelog1.3 (2015-03-02)1.2 (2015-02-24)1.1 (2014-06-04)1.0 (2014-04-22)0.9 (2014-04-17)0.8 (2013-11-25)0.7.1 (2013-09-06)0.7 (2013-08-19)0.6 (2013-08-16)0.5 (2013-07-24)0.4 (2013-07-04)0.3 (2013-07-02)0.2 (2013-07-02)0.1 (2013-07-02)ContributorsDownloadhl.pas.samlpluginprovides a SAML2 plugin for Zope’sPluggableAuthService. It provides
the IExtractionPlugin, IAuthenticationPlugin, IChallengePlugin, ICredentialsResetPlugin
interfaces.hl.pas.samlpluginso far has been tested with OpenAM.InstallationAdd the package to your buildoutInstallxmlsecRun buildoutRestart ZopeVisit your site’s Pluggable Auth Service in ZMI and add a SAML2 PAS pluginConfigurationYou will need to provide your IDP with an endpoint configuration for your Zope site containing your sites’
settings for AssertionConsumerService and SingleLogoutService. This will be an XML file looking like e.g:<EntityDescriptor entityID="http://zopehost:8080/spEntityID" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
    <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false"
                     protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
                             Location="http://zopehost:8080/site/logout"
                             ResponseLocation="https://zopehost:8080/site/logout"/>
        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
        <AssertionConsumerService isDefault="true" index="0" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Location="http://zopehost:8080/site"/>
    </SPSSODescriptor>
    <RoleDescriptor xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                    xmlns:query="urn:oasis:names:tc:SAML:metadata:ext:query"
                    xsi:type="query:AttributeQueryDescriptorType"
                    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    </RoleDescriptor>
</EntityDescriptor>At the moment the bindings specified in the above example (i.e. HTTP-Redirect for the SingleLogoutService and HTTP-POST
for the AssertionConsumerService) are the only ones that are supported. For the authentication request, HTTP-Redirect is used.Please refer to available SAML2 documentation for further information.On the SAML2 PAS plugins’ properties tab, you will need to specify some more properties to make things work:the absolute path to the IDP config file. This XML file should be provided by your IDPthe service endpoint URL, i.e.http://zopehost:8080/sitein the example abovethe service endpoint entity id as given to the IDPthe AuthnContextClass to use with the authentication requestthe service URL binding to use for the passive session checkthe absolute path to the xmlsec executablethe attribute provided by the IDP that should be used as the users login attribute (i.e. the user id used by Zope)additional user properties given by the IDP that should be stored in the users sessionPlease have a look in thebrowserand theskins/authsubdirectories for examples on how to handle login/logout
for a CMFSite.It seems important to note that this PAS plugin (and the SAML2 protocol) only provides authentication. It is rather likely
that you will have to implement your own plugins to provide the IPropertiesPlugin and the IUserEnumerationPlugin interfaces,
at least if you have to deal with user generated content or want to use the Zope CMF.CreditsMost of the code in the saml2 subfolder was taken from thepysaml2package.Changelog1.3 (2015-03-02)keywords1.2 (2015-02-24)added parts of the pysaml2 library (https://github.com/rohe/pysaml2) in subdirectory “saml2” to fix dependency issues with repoze.who and current Zope versionschanged license from GPL to Apache 2.0the “passive”, “active” and “checksession” methods now take an optional parameter to override the default AuthnContextClass (from properties) on a per request basis1.1 (2014-06-04)pop SAMLart from request form to prevent endless redirect in certain caseshandle artifact response encoding correctlyupdated keywords1.0 (2014-04-22)fix test0.9 (2014-04-17)added support for artifact service url binding0.8 (2013-11-25)added support for AuthnContextClass0.7.1 (2013-09-06)require pysaml2 == 1.0.2 (1.0.3 not working)0.7 (2013-08-19)Python 2.6 compatibility0.6 (2013-08-16)use pysaml2 >= 1.00.5 (2013-07-24)fixed configuration caching issue (when using multiple plugins)0.4 (2013-07-04)improved config cachingadd sample data for unittests0.3 (2013-07-02)add icon0.2 (2013-07-02)fix MANIFEST.in0.1 (2013-07-02)initial releaseContributorsDownload