feat: update README and JSON files for Visione integration, enhance error handling, and add new templates for user consent and login

2026-06-18 13:58:15 +02:00
parent 171f84ae4c
commit 4567948fa2
16 changed files with 790 additions and 90 deletions
@@ -87,7 +87,7 @@
        },
        "openid_relying_party": {
          "application_type": "web",
-          "organization_name": "Example RP",
+          "organization_name": "Visione",
          "client_id": "http://127.0.0.1:8001",
          "client_registration_types": [
            "automatic"
@@ -114,7 +114,7 @@
              }
            ]
          },
-          "client_name": "Name of an example organization",
+          "client_name": "Visione",
          "contacts": [
            "[email protected]"
          ],
@@ -0,0 +1,337 @@
+import json
+import logging
+from urllib.parse import urlencode
+
+from django.http import HttpResponseRedirect
+from django.shortcuts import render
+from django.utils.translation import gettext as _
+from spid_cie_oidc.entity.jwtse import (
+    unpad_jwt_payload,
+    verify_at_hash,
+    verify_jws,
+)
+from spid_cie_oidc.entity.models import FederationEntityConfiguration
+from spid_cie_oidc.entity.settings import HTTPC_PARAMS
+from spid_cie_oidc.entity.utils import get_jwk_from_jwt, get_jwks
+from spid_cie_oidc.relying_party.exceptions import ValidationException
+from spid_cie_oidc.relying_party.oidc import iat_now
+from spid_cie_oidc.relying_party.settings import RP_ATTR_MAP, RP_DEFAULT_PROVIDER_PROFILES, RP_PROVIDER_PROFILES
+from spid_cie_oidc.relying_party.utils import process_user_attributes
+from spid_cie_oidc.relying_party.views.rp_begin import SpidCieOidcRpBeginView
+from spid_cie_oidc.relying_party.views.rp_callback import SpidCieOidcRpCallbackView
+from spid_cie_oidc.relying_party.models import OidcAuthentication, OidcAuthenticationToken
+
+logger = logging.getLogger(__name__)
+
+schema_profile = RP_PROVIDER_PROFILES[RP_DEFAULT_PROVIDER_PROFILES]
+
+
+def _visione_redirect_uri(request):
+    return request.session.get("visione_frontend_redirect_uri")
+
+
+def _visione_error_redirect(request, error, error_description="", status=302):
+    frontend_redirect_uri = _visione_redirect_uri(request)
+    if frontend_redirect_uri:
+        params = {
+            "state": request.session.get("visione_state", ""),
+            "error": error,
+        }
+        if error_description:
+            params["error_description"] = error_description
+        separator = "&" if "?" in frontend_redirect_uri else "?"
+        return HttpResponseRedirect(
+            f"{frontend_redirect_uri}{separator}{urlencode(params)}",
+            status=status,
+        )
+    return None
+
+
+class VisioneRpBeginView(SpidCieOidcRpBeginView):
+    def get(self, request, *args, **kwargs):
+        response = super().get(request, *args, **kwargs)
+        if getattr(response, "status_code", None) and response.status_code >= 400:
+            frontend_redirect = _visione_error_redirect(
+                request,
+                "request_rejected",
+                "Authentication request rejected",
+            )
+            if frontend_redirect:
+                return frontend_redirect
+        return response
+
+
+def visione_rp_error_context(request):
+    frontend_redirect_uri = _visione_redirect_uri(request)
+    if not frontend_redirect_uri:
+        return {}
+    params = {
+        "state": request.session.get("visione_state", ""),
+        "error": "invalid_request",
+    }
+    separator = "&" if "?" in frontend_redirect_uri else "?"
+    return {
+        "visione_return_url": f"{frontend_redirect_uri}{separator}{urlencode(params)}",
+    }
+
+
+class VisioneRpCallbackView(SpidCieOidcRpCallbackView):
+    def get(self, request, *args, **kwargs):
+        if "error" in request.GET and _visione_redirect_uri(request):
+            return _visione_error_redirect(
+                request,
+                request.GET.get("error", "invalid_request"),
+                request.GET.get("error_description", ""),
+            )
+        request_args = {k: v for k, v in request.GET.items()}
+        authz = OidcAuthentication.objects.filter(state=request_args.get("state"))
+        try:
+            self.validate_json_schema(
+                request.GET.dict(),
+                "authn_response",
+                "Authn response object validation failed",
+            )
+        except ValidationException:
+            return _visione_error_redirect(
+                request,
+                "invalid_request",
+                "Authn response object validation failed",
+            ) or render(
+                request,
+                self.error_template,
+                {
+                    "error": "invalid_request",
+                    "error_description": "Authn response object validation failed",
+                    **visione_rp_error_context(request),
+                },
+                status=400,
+            )
+
+        if not authz:
+            return _visione_error_redirect(
+                request,
+                "unauthorized_request",
+                "Authentication not found",
+            ) or render(
+                request,
+                self.error_template,
+                {
+                    "error": "unauthorized request",
+                    "error_description": _("Authentication not found"),
+                    **visione_rp_error_context(request),
+                },
+                status=401,
+            )
+
+        authz = authz.last()
+        if request.GET.get("iss") and request.GET["iss"] != authz.provider_id:
+            return _visione_error_redirect(
+                request,
+                "invalid_request",
+                "authn response validation failed: mixups attack prevention.",
+            ) or render(
+                request,
+                self.error_template,
+                {
+                    "error": "invalid request",
+                    "error_description": _(
+                        "authn response validation failed: mixups attack prevention."
+                    ),
+                    **visione_rp_error_context(request),
+                },
+                status=400,
+            )
+
+        code = request.GET.get("code")
+        authz_token = OidcAuthenticationToken.objects.create(authz_request=authz, code=code)
+        self.rp_conf = FederationEntityConfiguration.objects.filter(
+            sub=authz_token.authz_request.client_id
+        ).first()
+        if not self.rp_conf:
+            return _visione_error_redirect(
+                request,
+                "invalid_request",
+                "Relying party not found",
+            ) or render(
+                request,
+                self.error_template,
+                {
+                    "error": "invalid request",
+                    "error_description": _("Relying party not found"),
+                    **visione_rp_error_context(request),
+                },
+                status=400,
+            )
+
+        authz_data = json.loads(authz.data)
+        token_response = self.access_token_request(
+            redirect_uri=authz_data["redirect_uri"],
+            state=authz.state,
+            code=code,
+            issuer_id=authz.provider_id,
+            client_conf=self.rp_conf,
+            token_endpoint_url=authz.provider_configuration["token_endpoint"],
+            audience=[authz.provider_id],
+            code_verifier=authz_data.get("code_verifier"),
+        )
+        if not token_response:
+            return _visione_error_redirect(
+                request,
+                "invalid_token_response",
+                "Token response seems not to be valid",
+            ) or render(
+                request,
+                self.error_template,
+                {
+                    "error": "invalid token response",
+                    "error_description": _("Token response seems not to be valid"),
+                    **visione_rp_error_context(request),
+                },
+                status=400,
+            )
+
+        try:
+            self.validate_json_schema(
+                token_response,
+                "token_response",
+                "Token response object validation failed",
+            )
+        except ValidationException:
+            return _visione_error_redirect(
+                request,
+                "invalid_request",
+                "Token response object validation failed",
+            ) or render(
+                request,
+                self.error_template,
+                {
+                    "error": "invalid_request",
+                    "error_description": "Token response object validation failed",
+                    **visione_rp_error_context(request),
+                },
+                status=400,
+            )
+
+        jwks = get_jwks(authz.provider_configuration)
+        access_token = token_response["access_token"]
+        id_token = token_response["id_token"]
+        op_ac_jwk = get_jwk_from_jwt(access_token, jwks)
+        op_id_jwk = get_jwk_from_jwt(id_token, jwks)
+        if not op_ac_jwk or not op_id_jwk:
+            return _visione_error_redirect(
+                request,
+                "invalid_token",
+                "Authentication token seems not to be valid.",
+            ) or render(
+                request,
+                self.error_template,
+                {
+                    "error": "invalid_token",
+                    "error_description": _("Authentication token seems not to be valid."),
+                    **visione_rp_error_context(request),
+                },
+                status=403,
+            )
+
+        try:
+            verify_jws(access_token, op_ac_jwk)
+            verify_jws(id_token, op_id_jwk)
+            decoded_id_token = unpad_jwt_payload(id_token)
+            verify_at_hash(decoded_id_token, access_token)
+        except Exception as exc:
+            logger.warning("Token validation error: %s", exc)
+            return _visione_error_redirect(
+                request,
+                "token_verification_failed",
+                "Authentication token validation error.",
+            ) or render(
+                request,
+                self.error_template,
+                {
+                    "error": "token verification failed",
+                    "error_description": _("Authentication token validation error."),
+                    **visione_rp_error_context(request),
+                },
+                status=403,
+            )
+
+        decoded_access_token = unpad_jwt_payload(access_token)
+        authz_token.access_token = access_token
+        authz_token.id_token = id_token
+        authz_token.scope = token_response.get("scope")
+        authz_token.token_type = token_response["token_type"]
+        authz_token.expires_in = token_response["expires_in"]
+        authz_token.save()
+
+        userinfo = self.get_userinfo(
+            authz.state,
+            authz_token.access_token,
+            authz.provider_configuration,
+            verify=HTTPC_PARAMS.get("connection", {}).get("ssl", True),
+        )
+        if not userinfo:
+            return _visione_error_redirect(
+                request,
+                "invalid_userinfo_response",
+                "UserInfo response seems not to be valid",
+            ) or render(
+                request,
+                self.error_template,
+                {
+                    "error": "invalid userinfo response",
+                    "error_description": _("UserInfo response seems not to be valid"),
+                    **visione_rp_error_context(request),
+                },
+                status=400,
+            )
+
+        user_attrs = process_user_attributes(userinfo, RP_ATTR_MAP, authz.__dict__)
+        if not user_attrs:
+            return _visione_error_redirect(
+                request,
+                "missing_user_attributes",
+                "No user attributes have been processed",
+            ) or render(
+                request,
+                self.error_template,
+                {
+                    "error": "missing user attributes",
+                    "error_description": _("No user attributes have been processed"),
+                    **visione_rp_error_context(request),
+                },
+                status=403,
+            )
+
+        user = self.user_reunification(user_attrs)
+        if not user:
+            return _visione_error_redirect(
+                request,
+                "no_user_found",
+                "No user found",
+            ) or render(
+                request,
+                self.error_template,
+                {
+                    "error": _("No user found"),
+                    "error_description": "",
+                    **visione_rp_error_context(request),
+                },
+                status=403,
+            )
+
+        request.session["rt_expiration"] = 0
+        if token_response.get("refresh_token"):
+            refresh_token = token_response["refresh_token"]
+            authz_token.refresh_token = refresh_token
+            decoded_refresh_token = unpad_jwt_payload(refresh_token)
+            request.session["rt_expiration"] = decoded_refresh_token["exp"] - iat_now()
+            request.session["rt_jti"] = decoded_refresh_token["jti"]
+
+        from django.contrib.auth import login
+        login(request, user)
+        request.session["oidc_rp_user_attrs"] = user_attrs
+        request.session["at_expiration"] = decoded_access_token["exp"] - iat_now()
+        request.session["at_jti"] = decoded_access_token["jti"]
+        authz_token.user = user
+        authz_token.save()
+        return HttpResponseRedirect("/visione/complete")
@@ -28,7 +28,7 @@ ROOT_URLCONF = 'relying_party.urls'
 TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
-        'DIRS': [],
+        'DIRS': [os.path.join(BASE_DIR, 'templates')],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
@@ -21,6 +21,7 @@ from django.views.static import serve
 from scripts.build_probe import build_probe_view, diag_view
 from spid_cie_oidc.entity.urls import urlpatterns as ta_urlpatterns
 from .visione_views import VisioneCompleteView, VisioneStartView
+from .rp_overrides import VisioneRpBeginView, VisioneRpCallbackView

 admin.site.site_header = "OIDC Federation Relying Party Administration"
 admin.site.site_title = "OIDC Federation Relying Party"
@@ -47,6 +48,10 @@ urlpatterns.extend(ta_urlpatterns)
 if 'spid_cie_oidc.relying_party' in settings.INSTALLED_APPS:
    from spid_cie_oidc.relying_party.urls import urlpatterns as rp_urlpatterns
    urlpatterns.extend(rp_urlpatterns)
+    urlpatterns = [
+        path("oidc/rp/authorization", VisioneRpBeginView.as_view(), name="spid_cie_rp_begin"),
+        path("oidc/rp/callback", VisioneRpCallbackView.as_view(), name="spid_cie_rp_callback"),
+    ] + [u for u in urlpatterns if getattr(u, "name", None) not in {"spid_cie_rp_begin", "spid_cie_rp_callback"}]

    from spid_cie_oidc.entity.views import entity_configuration, resolve_entity_statement

@@ -171,3 +171,17 @@ class VisioneCompleteView(View):
        if redirect_url:
            return HttpResponseRedirect(redirect_url)
        return HttpResponseServerError("Visione backend exchange did not redirect")
+
+
+def visione_error_redirect(request, error, error_description=""):
+    frontend_redirect_uri = request.session.get("visione_frontend_redirect_uri")
+    if not frontend_redirect_uri:
+        return None
+    params = {
+        "state": request.session.get("visione_state", ""),
+        "error": error,
+    }
+    if error_description:
+        params["error_description"] = error_description
+    separator = "&" if "?" in frontend_redirect_uri else "?"
+    return HttpResponseRedirect(f"{frontend_redirect_uri}{separator}{urlencode(params)}")
@@ -0,0 +1,16 @@
+{% extends 'rp_base.html' %}
+{% load i18n %}
+
+{% block centered_container %}
+<div class="col-12 col-lg-8 pl-lg-4">
+    <div class="callout danger">
+        <div class="callout-title">{% trans error %}</div>
+        <p>{% trans error_description %}</p>
+        {% if visione_return_url %}
+        <p class="mt-4 mb-0">
+            <a href="{{ visione_return_url }}">{% trans "Torna a Visione" %}</a>
+        </p>
+        {% endif %}
+    </div>
+</div>
+{% endblock %}