<s> import urllib2 <EOL> from saml2 import ( <EOL> BINDING_HTTP_POST , <EOL> BINDING_HTTP_REDIRECT , <EOL> entity , <EOL> ) <EOL> from saml2 . client import Saml2Client <EOL> from saml2 . config import Config as Saml2Config <EOL> from django . conf import settings <EOL> from django . core . urlresolvers import reverse <EOL> from django . contrib . auth . models import ( User , Group ) <EOL> from django . contrib . auth . decorators import login_required <EOL> from django . contrib . auth import login , logout <EOL> from django . shortcuts import render <EOL> from django . views . decorators . csrf import csrf_exempt <EOL> from django . template import TemplateDoesNotExist <EOL> from django . http import HttpResponseRedirect <EOL> from django . utils . module_loading import import_string <EOL> def get_current_domain ( r ) : <EOL> return '<STR_LIT>' . format ( <EOL> scheme = r . scheme , <EOL> host = r . get_host ( ) , <EOL> ) <EOL> def _get_saml_client ( domain ) : <EOL> acs_url = domain + reverse ( '<STR_LIT>' ) <EOL> import tempfile <EOL> tmp = tempfile . NamedTemporaryFile ( ) <EOL> f = open ( tmp . name , '<STR_LIT:w>' ) <EOL> f . write ( urllib2 . urlopen ( settings . SAML2_AUTH [ '<STR_LIT>' ] ) . read ( ) ) <EOL> f . close ( ) <EOL> saml_settings = { <EOL> '<STR_LIT>' : { <EOL> "<STR_LIT>" : [ tmp . name ] , <EOL> } , <EOL> '<STR_LIT>' : { <EOL> '<STR_LIT>' : { <EOL> '<STR_LIT>' : { <EOL> '<STR_LIT>' : [ <EOL> ( acs_url , BINDING_HTTP_REDIRECT ) , <EOL> ( acs_url , BINDING_HTTP_POST ) <EOL> ] , <EOL> } , <EOL> '<STR_LIT>' : True , <EOL> '<STR_LIT>' : False , <EOL> '<STR_LIT>' : True , <EOL> '<STR_LIT>' : True , <EOL> '<STR_LIT>' : False , <EOL> } , <EOL> } , <EOL> } <EOL> spConfig = Saml2Config ( ) <EOL> spConfig . load ( saml_settings ) <EOL> spConfig . allow_unknown_attributes = True <EOL> saml_client = Saml2Client ( config = spConfig ) <EOL> tmp . close ( ) <EOL> return saml_client <EOL> @ login_required <EOL> def welcome ( r ) : <EOL> try : <EOL> return render ( r , '<STR_LIT>' , context = { '<STR_LIT:user>' : r . user } ) <EOL> except TemplateDoesNotExist : <EOL> return HttpResponseRedirect ( reverse ( '<STR_LIT>' ) ) <EOL> def denied ( r ) : <EOL> return render ( r , '<STR_LIT>' ) <EOL> def _create_new_user ( username , email , firstname , lastname ) : <EOL> user = User . objects . create_user ( username , email ) <EOL> user . first_name = firstname <EOL> user . last_name = lastname <EOL> user . groups = [ Group . objects . get ( name = x ) for x in settings . SAML2_AUTH . get ( '<STR_LIT>' , { } ) . get ( '<STR_LIT>' , [ ] ) ] <EOL> user . is_active = settings . SAML2_AUTH . get ( '<STR_LIT>' , { } ) . get ( '<STR_LIT>' , True ) <EOL> user . is_staff = settings . SAML2_AUTH . get ( '<STR_LIT>' , { } ) . get ( '<STR_LIT>' , True ) <EOL> user . is_superuser = settings . SAML2_AUTH . get ( '<STR_LIT>' , { } ) . get ( '<STR_LIT>' , False ) <EOL> user . save ( ) <EOL> return user <EOL> @ csrf_exempt <EOL> def acs ( r ) : <EOL> saml_client = _get_saml_client ( get_current_domain ( r ) ) <EOL> resp = r . POST . get ( '<STR_LIT>' , None ) <EOL> next_url = r . session . get ( '<STR_LIT>' , reverse ( '<STR_LIT>' ) ) <EOL> if not resp : <EOL> return HttpResponseRedirect ( reverse ( '<STR_LIT>' ) ) <EOL> authn_response = saml_client . parse_authn_request_response ( <EOL> resp , entity . BINDING_HTTP_POST ) <EOL> if authn_response is None : <EOL> return HttpResponseRedirect ( reverse ( '<STR_LIT>' ) ) <EOL> user_identity = authn_response . get_identity ( ) <EOL> if user_identity is None : <EOL> return HttpResponseRedirect ( reverse ( '<STR_LIT>' ) ) <EOL> user_email = user_identity [ settings . SAML2_AUTH . get ( '<STR_LIT>' , { } ) . get ( '<STR_LIT:email>' , '<STR_LIT>' ) ] [ <NUM_LIT:0> ] <EOL> user_name = user_identity [ settings . SAML2_AUTH . get ( '<STR_LIT>' , { } ) . get ( '<STR_LIT:username>' , '<STR_LIT>' ) ] [ <NUM_LIT:0> ] <EOL> user_first_name = user_identity [ settings . SAML2_AUTH . get ( '<STR_LIT>' , { } ) . get ( '<STR_LIT>' , '<STR_LIT>' ) ] [ <NUM_LIT:0> ] <EOL> user_last_name = user_identity [ settings . SAML2_AUTH . get ( '<STR_LIT>' , { } ) . get ( '<STR_LIT>' , '<STR_LIT>' ) ] [ <NUM_LIT:0> ] <EOL> target_user = None <EOL> is_new_user = False <EOL> try : <EOL> target_user = User . objects . get ( username = user_name ) <EOL> if settings . SAML2_AUTH . get ( '<STR_LIT>' , { } ) . get ( '<STR_LIT>' , None ) : <EOL> import_string ( settings . SAML2_AUTH [ '<STR_LIT>' ] [ '<STR_LIT>' ] ) ( user_identity ) <EOL> except User . DoesNotExist : <EOL> target_user = _create_new_user ( user_name , user_email , user_first_name , user_last_name ) <EOL> if settings . SAML2_AUTH . get ( '<STR_LIT>' , { } ) . get ( '<STR_LIT>' , None ) : <EOL> import_string ( settings . SAML2_AUTH [ '<STR_LIT>' ] [ '<STR_LIT>' ] ) ( user_identity ) <EOL> is_new_user = True <EOL> r . session . flush ( ) <EOL> if target_user . is_active : <EOL> target_user . backend = '<STR_LIT>' <EOL> login ( r , target_user ) <EOL> else : <EOL> return HttpResponseRedirect ( reverse ( '<STR_LIT>' ) ) <EOL> if is_new_user : <EOL> try : <EOL> return render ( r , '<STR_LIT>' , context = { '<STR_LIT:user>' : r . user } ) <EOL> except TemplateDoesNotExist : <EOL> return HttpResponseRedirect ( next_url ) <EOL> else : <EOL> return HttpResponseRedirect ( next_url ) <EOL> def signin ( r ) : <EOL> import urlparse <EOL> from urllib import unquote <EOL> next_url = r . GET . get ( '<STR_LIT>' , reverse ( '<STR_LIT>' ) ) <EOL> try : <EOL> if "<STR_LIT>" in unquote ( next_url ) : <EOL> next_url = urlparse . parse_qs ( urlparse . urlparse ( unquote ( next_url ) ) . query ) [ '<STR_LIT>' ] [ <NUM_LIT:0> ] <EOL> except : <EOL> next_url = r . GET . get ( '<STR_LIT>' , reverse ( '<STR_LIT>' ) ) <EOL> r . session [ '<STR_LIT>' ] = next_url <EOL> saml_client = _get_saml_client ( get_current_domain ( r ) ) <EOL> _ , info = saml_client . prepare_for_authenticate ( ) <EOL> redirect_url = None <EOL> for key , value in info [ '<STR_LIT>' ] : <EOL> if key == '<STR_LIT>' : <EOL> redirect_url = value <EOL> break <EOL> return HttpResponseRedirect ( redirect_url ) <EOL> def signout ( r ) : <EOL> logout ( r ) <EOL> return render ( r , '<STR_LIT>' ) </s>
