Isolate all SSO code into dojo/sso/ as a plain Python package

Move all SSO functionality (OAuth2, SAML2, OIDC, remote user auth) into
dojo/sso/ so that removing SSO requires only deleting the directory and
removing packages from requirements.txt. All hooks in shared files use
try/except ImportError guards that gracefully degrade when dojo/sso/ is
absent.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Maffooch

.dryrunsecurity.yaml

@@ -40,8 +40,8 @@ sensitiveCodepaths:
   - 'dojo/middleware.py'
   - 'dojo/models.py'
   - 'dojo/okta.py'
-  - 'dojo/pipeline.py'
-  - 'dojo/remote_user.py'
+  - 'dojo/sso/pipeline.py'
+  - 'dojo/sso/remote_user.py'
   - 'dojo/tasks.py'
   - 'dojo/urls.py'
   - 'dojo/utils.py'

dojo/context_processors.py

@@ -16,22 +16,6 @@ def globalize_vars(request):
         "FORGOT_PASSWORD": settings.FORGOT_PASSWORD,
         "FORGOT_USERNAME": settings.FORGOT_USERNAME,
         "CLASSIC_AUTH_ENABLED": settings.CLASSIC_AUTH_ENABLED,
-        "OIDC_ENABLED": settings.OIDC_AUTH_ENABLED,
-        "SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT": settings.SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT,
-        "AUTH0_ENABLED": settings.AUTH0_OAUTH2_ENABLED,
-        "GOOGLE_ENABLED": settings.GOOGLE_OAUTH_ENABLED,
-        "OKTA_ENABLED": settings.OKTA_OAUTH_ENABLED,
-        "GITLAB_ENABLED": settings.GITLAB_OAUTH2_ENABLED,
-        "AZUREAD_TENANT_OAUTH2_ENABLED": settings.AZUREAD_TENANT_OAUTH2_ENABLED,
-        "AZUREAD_TENANT_OAUTH2_GET_GROUPS": settings.AZUREAD_TENANT_OAUTH2_GET_GROUPS,
-        "AZUREAD_TENANT_OAUTH2_GROUPS_FILTER": settings.AZUREAD_TENANT_OAUTH2_GROUPS_FILTER,
-        "AZUREAD_TENANT_OAUTH2_CLEANUP_GROUPS": settings.AZUREAD_TENANT_OAUTH2_CLEANUP_GROUPS,
-        "KEYCLOAK_ENABLED": settings.KEYCLOAK_OAUTH2_ENABLED,
-        "SOCIAL_AUTH_KEYCLOAK_LOGIN_BUTTON_TEXT": settings.SOCIAL_AUTH_KEYCLOAK_LOGIN_BUTTON_TEXT,
-        "GITHUB_ENTERPRISE_ENABLED": settings.GITHUB_ENTERPRISE_OAUTH2_ENABLED,
-        "SAML2_ENABLED": settings.SAML2_ENABLED,
-        "SAML2_LOGIN_BUTTON_TEXT": settings.SAML2_LOGIN_BUTTON_TEXT,
-        "SAML2_LOGOUT_URL": settings.SAML2_LOGOUT_URL,
         "DOCUMENTATION_URL": settings.DOCUMENTATION_URL,
         "API_TOKENS_ENABLED": settings.API_TOKENS_ENABLED,
         "API_TOKEN_AUTH_ENDPOINT_ENABLED": settings.API_TOKEN_AUTH_ENDPOINT_ENABLED,

dojo/middleware.py

@@ -6,15 +6,10 @@
 from urllib.parse import quote
 
 import pghistory.middleware
-import requests
 from django.conf import settings
-from django.contrib import messages
 from django.db import models
 from django.http import HttpResponseRedirect
-from django.shortcuts import redirect
 from django.urls import reverse
-from social_core.exceptions import AuthCanceled, AuthFailed, AuthForbidden, AuthTokenError
-from social_django.middleware import SocialAuthExceptionMiddleware
 from watson.middleware import SearchContextMiddleware
 from watson.search import search_context_manager
 
@@ -79,31 +74,6 @@ def __call__(self, request):
         return response
 
 
-class CustomSocialAuthExceptionMiddleware(SocialAuthExceptionMiddleware):
-    def process_exception(self, request, exception):
-        if isinstance(exception, requests.exceptions.RequestException):
-            messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_REQUEST_EXCEPTION)
-            return redirect("/login?force_login_form")
-        if isinstance(exception, AuthCanceled):
-            messages.warning(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_CANCELED)
-            return redirect("/login?force_login_form")
-        if isinstance(exception, AuthFailed):
-            messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_FAILED)
-            return redirect("/login?force_login_form")
-        if isinstance(exception, AuthForbidden):
-            messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_FORBIDDEN)
-            return redirect("/login?force_login_form")
-        if isinstance(exception, AuthTokenError):
-            messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_TOKEN_ERROR)
-            return redirect("/login?force_login_form")
-        if isinstance(exception, TypeError) and "'NoneType' object is not iterable" in str(exception):
-            logger.warning("OIDC login error: NoneType is not iterable")
-            messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_NONE_TYPE)
-            return redirect("/login?force_login_form")
-        logger.error(f"Unhandled exception during social login: {exception}")
-        return super().process_exception(request, exception)
-
-
 class DojoSytemSettingsMiddleware:
     _thread_local = local()
 

dojo/settings/settings.dist.py

@@ -0,0 +1,22 @@
+from django.conf import settings
+
+
+def sso_context(request):
+    return {
+        "OIDC_ENABLED": settings.OIDC_AUTH_ENABLED,
+        "SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT": settings.SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT,
+        "AUTH0_ENABLED": settings.AUTH0_OAUTH2_ENABLED,
+        "GOOGLE_ENABLED": settings.GOOGLE_OAUTH_ENABLED,
+        "OKTA_ENABLED": settings.OKTA_OAUTH_ENABLED,
+        "GITLAB_ENABLED": settings.GITLAB_OAUTH2_ENABLED,
+        "AZUREAD_TENANT_OAUTH2_ENABLED": settings.AZUREAD_TENANT_OAUTH2_ENABLED,
+        "AZUREAD_TENANT_OAUTH2_GET_GROUPS": settings.AZUREAD_TENANT_OAUTH2_GET_GROUPS,
+        "AZUREAD_TENANT_OAUTH2_GROUPS_FILTER": settings.AZUREAD_TENANT_OAUTH2_GROUPS_FILTER,
+        "AZUREAD_TENANT_OAUTH2_CLEANUP_GROUPS": settings.AZUREAD_TENANT_OAUTH2_CLEANUP_GROUPS,
+        "KEYCLOAK_ENABLED": settings.KEYCLOAK_OAUTH2_ENABLED,
+        "SOCIAL_AUTH_KEYCLOAK_LOGIN_BUTTON_TEXT": settings.SOCIAL_AUTH_KEYCLOAK_LOGIN_BUTTON_TEXT,
+        "GITHUB_ENTERPRISE_ENABLED": settings.GITHUB_ENTERPRISE_OAUTH2_ENABLED,
+        "SAML2_ENABLED": settings.SAML2_ENABLED,
+        "SAML2_LOGIN_BUTTON_TEXT": settings.SAML2_LOGIN_BUTTON_TEXT,
+        "SAML2_LOGOUT_URL": settings.SAML2_LOGOUT_URL,
+    }

dojo/settings/attribute-maps/__init__.py dojo/sso/__init__.pydojo/settings/attribute-maps/__init__.py renamed to dojo/sso/__init__.py

@@ -0,0 +1,35 @@
+import logging
+
+import requests
+from django.conf import settings
+from django.contrib import messages
+from django.shortcuts import redirect
+from social_core.exceptions import AuthCanceled, AuthFailed, AuthForbidden, AuthTokenError
+from social_django.middleware import SocialAuthExceptionMiddleware
+
+logger = logging.getLogger(__name__)
+
+
+class CustomSocialAuthExceptionMiddleware(SocialAuthExceptionMiddleware):
+    def process_exception(self, request, exception):
+        if isinstance(exception, requests.exceptions.RequestException):
+            messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_REQUEST_EXCEPTION)
+            return redirect("/login?force_login_form")
+        if isinstance(exception, AuthCanceled):
+            messages.warning(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_CANCELED)
+            return redirect("/login?force_login_form")
+        if isinstance(exception, AuthFailed):
+            messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_FAILED)
+            return redirect("/login?force_login_form")
+        if isinstance(exception, AuthForbidden):
+            messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_FORBIDDEN)
+            return redirect("/login?force_login_form")
+        if isinstance(exception, AuthTokenError):
+            messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_AUTH_TOKEN_ERROR)
+            return redirect("/login?force_login_form")
+        if isinstance(exception, TypeError) and "'NoneType' object is not iterable" in str(exception):
+            logger.warning("OIDC login error: NoneType is not iterable")
+            messages.error(request, settings.SOCIAL_AUTH_EXCEPTION_MESSAGE_NONE_TYPE)
+            return redirect("/login?force_login_form")
+        logger.error(f"Unhandled exception during social login: {exception}")
+        return super().process_exception(request, exception)