Skip to content

Commit 7b427fe

Browse files
dzanindzanin
committed
demo-tornado initial commit
1 parent ce81bcb commit 7b427fe

File tree

14 files changed

+574
-0
lines changed

14 files changed

+574
-0
lines changed

‎demo-tornado/Docs/DEVELOPING.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# OneLogin's SAML Python Toolkit (compatible with Python3)
2+
3+
Installation
4+
------------
5+
6+
### Dependencies ###
7+
8+
* python 3.6
9+
* apt-get install libxml2-dev libxmlsec1-dev libxmlsec1-openssl
10+
* pip install xmlsec
11+
* pip install isodate
12+
* pip install defusedxml
13+
* pip install python3-saml
14+
* pip install tornado
15+
16+
17+
***Virtualenv***
18+
19+
The use of virtualenv/virtualenvwrapper is highly recommended.
20+
21+
### Create certificates ###
22+
23+
in saml/cert run :
24+
* openssl req -new -x509 -days 3652 -nodes -out sp.crt -keyout sp.key
25+
* openssl req -new -x509 -days 3652 -nodes -out metadata.crt -keyout metadata.key
26+
27+
### Useful extesion for SAML messages ###
28+
* [SAML Chrome Panel 1.8.9](https://chrome.google.com/webstore/detail/saml-chrome-panel/paijfdbeoenhembfhkhllainmocckace/related)
29+
30+
31+
32+
# Test with keycloack idp
33+
34+
Installation
35+
------------
36+
37+
### Install Docker ###
38+
* sudo apt-get remove docker docker-engine docker.io containerd runc
39+
40+
* sudo apt-get update
41+
42+
* sudo apt-get install \
43+
apt-transport-https \
44+
ca-certificates \
45+
curl \
46+
gnupg-agent \
47+
software-properties-common
48+
* curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
49+
50+
* sudo add-apt-repository \
51+
"deb [arch=amd64] https://download.docker.com/linux/ubuntu \
52+
$(lsb_release -cs) \
53+
stable"
54+
55+
* sudo apt-get update
56+
57+
* sudo apt-get install docker-ce docker-ce-cli containerd.io
58+
59+
* sudo docker run hello-world
60+
61+
62+
### Keycloack starting ###
63+
First run only:
64+
* docker run --name keycloackContainer -d -p 8080:8080 -e KEYCLOAK_USER=admin -e KEYCLOAK_PASSWORD=admin -e DB_VENDOR=H2 jboss/keycloak
65+
66+
After first run:
67+
* sudo docker start keycloackContainer
68+
69+
Remember to stop keycloack after usage:
70+
* sudo docker stop keycloackContainer
71+
72+
73+
### Keycloack useful urls ###
74+
* master: http://localhost:8080/auth/admin
75+
* users: http://localhost:8080/auth/realms/idp_dacd/account/
76+
* saml request: http://localhost:8080/auth/realms/idp_dacd/protocol/saml
77+
* metadata: http://localhost:8080/auth/realms/idp_dacd/protocol/saml/descriptor
78+
79+
80+
81+
82+

‎demo-tornado/README.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Fully-working tornado-demo.
2+
3+
ABOUT ISSSUE
4+
This is only a demo, some issues about session still remain.
5+
6+
PRODUCTION
7+
Remember also to disable debugging in production.

‎demo-tornado/Settings.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
import os
2+
3+
BASE_DIR = os.path.dirname(__file__)
4+
5+
SAML_PATH = os.path.join(BASE_DIR, 'saml')
6+
TEMPLATE_PATH = os.path.join(BASE_DIR, 'templates')

‎demo-tornado/requirements.txt‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Click==7.0
2+
defusedxml==0.5.0
3+
isodate==0.6.0
4+
itsdangerous==1.1.0
5+
Jinja2==2.10.1
6+
lxml==4.3.3
7+
MarkupSafe==1.1.1
8+
pkgconfig==1.5.1
9+
python3-saml==1.6.0
10+
six==1.12.0
11+
tornado==6.0.2
12+
Werkzeug==0.15.2
13+
xmlsec==1.3.3

‎demo-tornado/saml/advanced_settings (copia).json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"security": {
3+
"nameIdEncrypted": false,
4+
"authnRequestsSigned": false,
5+
"logoutRequestSigned": false,
6+
"logoutResponseSigned": false,
7+
"signMetadata": false,
8+
"wantMessagesSigned": false,
9+
"wantAssertionsSigned": false,
10+
"wantNameId" : true,
11+
"wantNameIdEncrypted": false,
12+
"wantAssertionsEncrypted": false,
13+
"signatureAlgorithm": "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
14+
"digestAlgorithm": "http://www.w3.org/2000/09/xmldsig#sha1"
15+
},
16+
"contactPerson": {
17+
"technical": {
18+
"givenName": "technical_name",
19+
"emailAddress": "technical@example.com"
20+
},
21+
"support": {
22+
"givenName": "support_name",
23+
"emailAddress": "support@example.com"
24+
}
25+
},
26+
"organization": {
27+
"en-US": {
28+
"name": "sp_test",
29+
"displayname": "SP test",
30+
"url": "http://sp.example.com"
31+
}
32+
}
33+
}

‎demo-tornado/saml/advanced_settings.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"security": {
3+
"nameIdEncrypted": false,
4+
"authnRequestsSigned": true,
5+
"logoutRequestSigned": true,
6+
"logoutResponseSigned": true,
7+
"signMetadata": {
8+
"keyFileName": "metadata.key",
9+
"certFileName": "metadata.crt"
10+
},
11+
"wantMessagesSigned": false,
12+
"wantAssertionsSigned": true,
13+
"wantNameId" : true,
14+
"wantNameIdEncrypted": false,
15+
"wantAssertionsEncrypted": false,
16+
"signatureAlgorithm": "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
17+
"digestAlgorithm": "http://www.w3.org/2000/09/xmldsig#sha1"
18+
},
19+
"contactPerson": {
20+
"technical": {
21+
"givenName": "technical_name",
22+
"emailAddress": "technical@example.com"
23+
},
24+
"support": {
25+
"givenName": "support_name",
26+
"emailAddress": "support@example.com"
27+
}
28+
},
29+
"organization": {
30+
"en-US": {
31+
"name": "sp_test",
32+
"displayname": "SP test",
33+
"url": "http://sp.example.com"
34+
}
35+
}
36+
}

‎demo-tornado/saml/certs/README‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Take care of this folder that could contain private key. Be sure that this folder never is published.
2+
3+
Onelogin Python Toolkit expects that certs for the SP could be stored in this folder as:
4+
5+
* sp.key Private Key
6+
* sp.crt Public cert
7+
* sp_new.crt Future Public cert
8+
9+
10+
Also you can use other cert to sign the metadata of the SP using the:
11+
12+
* metadata.key
13+
* metadata.crt

‎demo-tornado/saml/settings (copia).json‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"strict": true,
3+
"debug": true,
4+
"sp": {
5+
"entityId": "https://<sp_domain>/metadata/",
6+
"assertionConsumerService": {
7+
"url": "https://<sp_domain>/?acs",
8+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
9+
},
10+
"singleLogoutService": {
11+
"url": "https://<sp_domain>/?sls",
12+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
13+
},
14+
"NameIDFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
15+
"x509cert": "",
16+
"privateKey": ""
17+
},
18+
"idp": {
19+
"entityId": "https://app.onelogin.com/saml/metadata/<onelogin_connector_id>",
20+
"singleSignOnService": {
21+
"url": "https://app.onelogin.com/trust/saml2/http-post/sso/<onelogin_connector_id>",
22+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
23+
},
24+
"singleLogoutService": {
25+
"url": "https://app.onelogin.com/trust/saml2/http-redirect/slo/<onelogin_connector_id>",
26+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
27+
},
28+
"x509cert": "<onelogin_connector_cert>"
29+
}
30+
}

‎demo-tornado/saml/settings (seconda copia).json‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"strict": true,
3+
"debug": true,
4+
"sp": {
5+
"entityId": "http://0.0.0.0:8000/metadata/",
6+
"assertionConsumerService": {
7+
"url": "http://0.0.0.0:8000/?acs",
8+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
9+
},
10+
"singleLogoutService": {
11+
"url": "http://0.0.0.0:8000/?sls",
12+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
13+
},
14+
"NameIDFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
15+
"x509cert": "",
16+
"privateKey": ""
17+
},
18+
"idp": {
19+
"entityId": "http://localhost:8080/auth/realms/idp_dacd",
20+
"singleSignOnService": {
21+
"url": "http://localhost:8080/auth/realms/idp_dacd/protocol/saml",
22+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
23+
},
24+
"singleLogoutService": {
25+
"url": "http://localhost:8080/auth/realms/idp_dacd/protocol/saml",
26+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
27+
},
28+
"x509cert": "MIICnzCCAYcCBgFqC3f1FDANBgkqhkiG9w0BAQsFADATMREwDwYDVQQDDAhpZHBfZGFjZDAeFw0xOTA0MTEwODE0MzJaFw0yOTA0MTEwODE2MTJaMBMxETAPBgNVBAMMCGlkcF9kYWNkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuhRERlbbwUxabS4lnGFOpxBKACpcwQwOSvyCKD3bLDvzfQIRh1x3RDq+6xxBcdP86PKRYjwZc/64HYFUbe9FCDLf1SDQz7XTtpftydRrTUydVaj+3FHhyCLcLkJldMVneVMZWIXSzUISvcURL3sr6HVJ74Uy0KPPOo3vQQ6RRaNaB3RCdZaNbzxjbG5eBgSvWHGE+vkozHpS7y6LHXDP1wXenH65RRrat8PQ/Qp4WVi2U5rVfA2SFbcwohjaJ+vOYH+oARnk5a2IosAMHBtONorPnPrcV7MqUXX7q19hnlFRZA34YVcF6kkWWsS1V/mRm2kK6EE/mABvX4mrefWg+QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARKkt9TKg5jLLc7HZSYxHD0MGqDQ8jMAXjpYYaEoIGyYnE31WOEG6HlzHFrkp5ioBT8vTIfejpGGkcL0qspSjQRBYH1eHOEToFo2vhmr0yDUtePNVcQtRN0ImAwNvKU/PciSi4dX0Y8Z/VfeRn8k979o0X82xZSYIxLhKlFp9toOHz0pNTU0Ie4h1zxcPd0L7KAn5eQPHoJwXsdWkM9aoZtCQCjbiexpfOdEOfnUn8QisinAWqcC/gKl9XG7XU4P5cevTeqZgnK0W+ilJVkkJX2zZWlAji+0PKLGr3BgJCfkwUcsm1C8U2ysTGkW1mZHfKVzK2NPA0bSlGgZwbvki+"
29+
}
30+
}

‎demo-tornado/saml/settings.json‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"strict": true,
3+
"debug": true,
4+
"sp": {
5+
"entityId": "http://localhost:8000/metadata/",
6+
"assertionConsumerService": {
7+
"url": "http://localhost:8000/?acs",
8+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
9+
},
10+
"singleLogoutService": {
11+
"url": "http://localhost:8000/?sls",
12+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
13+
},
14+
"NameIDFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
15+
"x509cert": "",
16+
"privateKey": ""
17+
},
18+
"idp": {
19+
"entityId": "http://localhost:8080/auth/realms/idp_dacd",
20+
"singleSignOnService": {
21+
"url": "http://localhost:8080/auth/realms/idp_dacd/protocol/saml",
22+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
23+
},
24+
"singleLogoutService": {
25+
"url": "http://localhost:8080/auth/realms/idp_dacd/protocol/saml",
26+
"binding": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
27+
},
28+
"x509cert": "MIICnzCCAYcCBgFqC3f1FDANBgkqhkiG9w0BAQsFADATMREwDwYDVQQDDAhpZHBfZGFjZDAeFw0xOTA0MTEwODE0MzJaFw0yOTA0MTEwODE2MTJaMBMxETAPBgNVBAMMCGlkcF9kYWNkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuhRERlbbwUxabS4lnGFOpxBKACpcwQwOSvyCKD3bLDvzfQIRh1x3RDq+6xxBcdP86PKRYjwZc/64HYFUbe9FCDLf1SDQz7XTtpftydRrTUydVaj+3FHhyCLcLkJldMVneVMZWIXSzUISvcURL3sr6HVJ74Uy0KPPOo3vQQ6RRaNaB3RCdZaNbzxjbG5eBgSvWHGE+vkozHpS7y6LHXDP1wXenH65RRrat8PQ/Qp4WVi2U5rVfA2SFbcwohjaJ+vOYH+oARnk5a2IosAMHBtONorPnPrcV7MqUXX7q19hnlFRZA34YVcF6kkWWsS1V/mRm2kK6EE/mABvX4mrefWg+QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQARKkt9TKg5jLLc7HZSYxHD0MGqDQ8jMAXjpYYaEoIGyYnE31WOEG6HlzHFrkp5ioBT8vTIfejpGGkcL0qspSjQRBYH1eHOEToFo2vhmr0yDUtePNVcQtRN0ImAwNvKU/PciSi4dX0Y8Z/VfeRn8k979o0X82xZSYIxLhKlFp9toOHz0pNTU0Ie4h1zxcPd0L7KAn5eQPHoJwXsdWkM9aoZtCQCjbiexpfOdEOfnUn8QisinAWqcC/gKl9XG7XU4P5cevTeqZgnK0W+ilJVkkJX2zZWlAji+0PKLGr3BgJCfkwUcsm1C8U2ysTGkW1mZHfKVzK2NPA0bSlGgZwbvki+"
29+
}
30+
}

0 commit comments

Comments
 (0)