WIP

Author: mdellweg

.github/workflows/scripts/before_install.sh

@@ -79,6 +79,11 @@ services:
     image: "docker.io/pulp/pulp-fixtures:latest"
     env:
       BASE_URL: "http://pulp-fixtures:8080"
+  - name: "saml2-idp"
+    image: "ghcr.io/pfrest/mock-saml2-idp:latest"
+    env:
+      SP_ENTITY_ID: "http://pulp"
+      SP_ACS_LOCATION: "http://pulp/saml/acs/"
 VARSYAML
 
 if [ "$TEST" = "s3" ]; then

ci_requirements.txt

@@ -1 +1 @@
-
+pulpcore[saml2]

pulpcore/app/settings.py

@@ -439,6 +439,38 @@
 # Replaces every non PulpException error msg with "An internal error occured"
 REDACT_UNSAFE_EXCEPTIONS = False
 
+# ---------- 8< ---------- 8< ---------
+# SAML2 config..
+LOGIN_URL = "/saml2/login/"
+SESSION_EXPIRE_AT_BROWSER_CLOSE = True
+SAML_CONFIG = {
+    "entityid": "http://localhost:5001/saml2/metadata/",
+    "entity_category": [],
+    "service": {
+        "sp": {
+            "name": "Pulp CI",
+            "endpoints": {},
+            "idp": {
+                "https://localhost:8443/sso/saml2/idp/metadata.php": {},
+            },
+        }
+    },
+    "key_file": "/etc/pki/saml2/saml2-private.key",
+    "cert_file": "/etc/pki/saml2/saml2-public.crt",
+    "xmlsec_binary": "/usr/bin/xmlsec1",
+    "metadata": {
+        # "local": [str(BASE_DIR / "remote_metadata.xml")],
+        "remote": [
+            {
+                "url": "https://saml2idp:8443/sso/saml2/idp/metadata.php",
+            },
+        ],
+    },
+    "debug": 1,
+    # DANGER!
+    "disable_ssl_certificate_validation": True,
+}
+
 # HERE STARTS DYNACONF EXTENSION LOAD (Keep at the very bottom of settings.py)
 # Read more at https://www.dynaconf.com/django/
 
@@ -594,6 +626,15 @@ def otel_middleware_hook(settings):
     return data
 
 
+def saml2_settings_hook(settings):
+    data = {"dynaconf_merge": True}
+    if "SAML_CONFIG" in settings:
+        data["INSTALLED_APPS"] = ["djangosaml2"]
+        data["MIDDLEWARE"] = ["djangosaml2.middleware.SamlSessionMiddleware"]
+        data["AUTHENTICATION_BACKENDS"] = ["djangosaml2.backends.Saml2Backend"]
+    return data
+
+
 del preload_settings
 
 settings = DjangoDynaconf(
@@ -618,7 +659,7 @@ def otel_middleware_hook(settings):
         otel_metrics_dispatch_interval_validator,
         distributed_publication_retention_period_validator,
     ],
-    post_hooks=(otel_middleware_hook,),
+    post_hooks=(otel_middleware_hook, saml2_settings_hook),
 )
 
 _logger = getLogger(__name__)

pulpcore/app/urls.py

@@ -245,6 +245,9 @@ class NoSchema(p.callback.cls):
         path("", include("social_django.urls", namespace=settings.SOCIAL_AUTH_URL_NAMESPACE))
     )
 
+if "djangosaml2" in settings.INSTALLED_APPS:
+    urlpatterns.append(path("saml2/", include("djangosaml2.urls")))
+
 #: The Pulp Platform v3 API router, which can be used to manually register ViewSets with the API.
 root_router = PulpDefaultRouter()
 

pyproject.toml

@@ -73,6 +73,7 @@ s3 = ["django-storages[boto3]==1.14.6"]
 google = ["django-storages[google]==1.14.6"]
 azure = ["django-storages[azure]==1.14.6"]
 prometheus = ["django-prometheus"]
+saml2 = ["djangosaml2>=1.12.0,<1.13"]
 kafka = [
   # Pinned because project warns "things might (and will) break with every update"
   "cloudevents==1.11.0",