feat: update README and JSON files for Visione integration, enhance error handling, and add new templates for user consent and login
This commit is contained in:
gabdevele
@@ -1,84 +1,22 @@
|
||||
# Visione CIE Auth Stack
|
||||
|
||||
This folder contains deployable CIE auth services for Visione:
|
||||
Fork di [italia/spid-cie-oidc-django](https://github.com/italia/spid-cie-oidc-django) riadattato leggermente al progetto Visione.
|
||||
|
||||
## Setup rapido
|
||||
|
||||
1. Copia `.env.example` in `.env`.
|
||||
2. Imposta domini pubblici, secret Django, `DJANGO_RP_BACKEND_EXCHANGE_URL` e `DJANGO_RP_SHARED_SECRET`.
|
||||
3. Avvia tutto con `docker compose up --build -d`.
|
||||
|
||||
Stack:
|
||||
- `federation-authority`
|
||||
- `provider`
|
||||
- `relying-party`
|
||||
|
||||
It is now structured to work with Docker Compose and Dokploy without host networking.
|
||||
Il RP Visione usa `/visione/start` per iniziare il flow e `/visione/complete` per chiuderlo verso backend Visione.
|
||||
|
||||
## Configuration
|
||||
Copy [.env.example](/workspace/cie-auth/.env.example) to `.env` and set only what changes in real deploy:
|
||||
- public domains / internal URLs
|
||||
- Django secret keys
|
||||
- shared secret between relying party and Visione backend
|
||||
## Note
|
||||
|
||||
Main variables:
|
||||
- `CIE_AUTH_ALLOWED_HOSTS`
|
||||
- `DJANGO_TRUST_ANCHOR`
|
||||
- `DJANGO_PROVIDER_ISSUER`
|
||||
- `DJANGO_RP_BACKEND_EXCHANGE_URL`
|
||||
- `DJANGO_RP_SHARED_SECRET`
|
||||
- `FEDERATION_AUTHORITY_SECRET_KEY`
|
||||
- `PROVIDER_SECRET_KEY`
|
||||
- `RELYING_PARTY_SECRET_KEY`
|
||||
|
||||
## Deploy with Dokploy
|
||||
Use [docker-compose.yml](/workspace/cie-auth/docker-compose.yml) as compose source.
|
||||
Expose:
|
||||
- `federation-authority` on port `8000`
|
||||
- `provider` on port `8002`
|
||||
- `relying-party` on port `8001`
|
||||
|
||||
Each service persists its own SQLite DB in a named volume.
|
||||
|
||||
## Local start
|
||||
|
||||
```bash
|
||||
docker compose up --build -d
|
||||
```
|
||||
|
||||
## Visione backend
|
||||
Visione backend must expose exchange endpoint configured in `DJANGO_RP_BACKEND_EXCHANGE_URL`.
|
||||
Shared secret must match backend `cie_auth.shared_secret`.
|
||||
|
||||
## Bootstrap behavior
|
||||
On first boot, each Django service:
|
||||
1. runs migrations
|
||||
2. loads `dumps/example.json` only if DB is empty
|
||||
|
||||
Disable fixture import per service with:
|
||||
- `FEDERATION_AUTHORITY_LOAD_FIXTURE_ON_EMPTY_DB=false`
|
||||
- `PROVIDER_LOAD_FIXTURE_ON_EMPTY_DB=false`
|
||||
- `RELYING_PARTY_LOAD_FIXTURE_ON_EMPTY_DB=false`
|
||||
|
||||
## Smoke test
|
||||
|
||||
```bash
|
||||
curl -sS -X POST http://127.0.0.1:5555/api/v1/auth/cie/start \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d '{"frontend_redirect_uri":"http://localhost:3000/auth/cie/callback"}'
|
||||
```
|
||||
|
||||
Then complete login and poll:
|
||||
|
||||
```bash
|
||||
curl -sS http://127.0.0.1:5555/api/v1/auth/cie/session/<state>
|
||||
```
|
||||
|
||||
## Reset data
|
||||
|
||||
```bash
|
||||
docker compose down -v
|
||||
```
|
||||
|
||||
If the stack was started before June 17, 2026 DB path fix, also remove legacy SQLite files that were created outside named volumes:
|
||||
|
||||
```bash
|
||||
rm -f federation_authority/db.sqlite3 provider/db.sqlite3 relying_party/db.sqlite3
|
||||
```
|
||||
|
||||
## Logs
|
||||
```bash
|
||||
docker compose logs -f
|
||||
```
|
||||
- Il RP si chiama `Visione`.
|
||||
- Rifiuto / annullo tornano sempre a Visione.
|
||||
- Grafica provider allineata a schermata CIE, senza QR e senza lettura carta.
|
||||
|
||||
@@ -257,7 +257,7 @@
|
||||
]
|
||||
},
|
||||
"openid_relying_party": {
|
||||
"organization_name": "that fancy RP",
|
||||
"organization_name": "Visione",
|
||||
"application_type": "web",
|
||||
"client_id": "http://127.0.0.1:8000/oidc/rp",
|
||||
"client_registration_types": [
|
||||
@@ -285,7 +285,7 @@
|
||||
},
|
||||
"jwks_uri": "http://127.0.0.1:8000/oidc/rp/openid_relying_party/jwks.json",
|
||||
"signed_jwks_uri": "http://127.0.0.1:8000/oidc/rp/openid_relying_party/jwks.jose",
|
||||
"client_name": "Name of an example organization",
|
||||
"client_name": "Visione",
|
||||
"contacts": [
|
||||
"[email protected]"
|
||||
],
|
||||
@@ -1461,7 +1461,7 @@
|
||||
}
|
||||
]
|
||||
},
|
||||
"client_name": "Name of an example organization",
|
||||
"client_name": "Visione",
|
||||
"contacts": [
|
||||
"[email protected]"
|
||||
],
|
||||
@@ -1475,7 +1475,8 @@
|
||||
"response_types": [
|
||||
"code"
|
||||
],
|
||||
"subject_type": "pairwise"
|
||||
"subject_type": "pairwise",
|
||||
"organization_name": "Visione"
|
||||
}
|
||||
},
|
||||
"trust_marks": [],
|
||||
@@ -1726,7 +1727,7 @@
|
||||
}
|
||||
]
|
||||
},
|
||||
"client_name": "Name of an example organization",
|
||||
"client_name": "Visione",
|
||||
"contacts": [
|
||||
"[email protected]"
|
||||
],
|
||||
@@ -1740,7 +1741,8 @@
|
||||
"response_types": [
|
||||
"code"
|
||||
],
|
||||
"subject_type": "pairwise"
|
||||
"subject_type": "pairwise",
|
||||
"organization_name": "Visione"
|
||||
}
|
||||
},
|
||||
"trust_marks": [],
|
||||
|
||||
@@ -670,7 +670,7 @@
|
||||
}
|
||||
]
|
||||
},
|
||||
"client_name": "Name of an example organization",
|
||||
"client_name": "Visione",
|
||||
"contacts": [
|
||||
"[email protected]"
|
||||
],
|
||||
@@ -684,7 +684,8 @@
|
||||
"response_types": [
|
||||
"code"
|
||||
],
|
||||
"subject_type": "pairwise"
|
||||
"subject_type": "pairwise",
|
||||
"organization_name": "Visione"
|
||||
}
|
||||
},
|
||||
"trust_marks": [],
|
||||
@@ -744,7 +745,7 @@
|
||||
}
|
||||
]
|
||||
},
|
||||
"client_name": "Name of an example organization",
|
||||
"client_name": "Visione",
|
||||
"contacts": [
|
||||
"[email protected]"
|
||||
],
|
||||
@@ -758,7 +759,8 @@
|
||||
"response_types": [
|
||||
"code"
|
||||
],
|
||||
"subject_type": "pairwise"
|
||||
"subject_type": "pairwise",
|
||||
"organization_name": "Visione"
|
||||
}
|
||||
},
|
||||
"trust_marks": [],
|
||||
|
||||
Binary file not shown.
@@ -28,7 +28,7 @@ ROOT_URLCONF = 'provider.urls'
|
||||
TEMPLATES = [
|
||||
{
|
||||
'BACKEND': 'django.template.backends.django.DjangoTemplates',
|
||||
'DIRS': [],
|
||||
'DIRS': [os.path.join(BASE_DIR, 'templates')],
|
||||
'APP_DIRS': True,
|
||||
'OPTIONS': {
|
||||
'context_processors': [
|
||||
|
||||
@@ -0,0 +1,253 @@
|
||||
{% load i18n %}
|
||||
<!DOCTYPE html>
|
||||
<html lang="it">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>{% block page_title %}Visione CIE{% endblock page_title %}</title>
|
||||
<style>
|
||||
:root {
|
||||
--visione-blue: #0059b3;
|
||||
--visione-blue-dark: #00428a;
|
||||
--visione-border: #d8e3f0;
|
||||
--visione-text: #16324f;
|
||||
--visione-muted: #58708d;
|
||||
--visione-bg: #f4f7fb;
|
||||
}
|
||||
* { box-sizing: border-box; }
|
||||
body {
|
||||
margin: 0;
|
||||
font-family: "Titillium Web", "Segoe UI", sans-serif;
|
||||
background:
|
||||
radial-gradient(circle at top left, rgba(0, 89, 179, 0.06), transparent 28%),
|
||||
linear-gradient(180deg, #fbfdff 0%, var(--visione-bg) 100%);
|
||||
color: var(--visione-text);
|
||||
}
|
||||
a { color: var(--visione-blue); }
|
||||
.visione-shell { min-height: 100vh; }
|
||||
.visione-topbar {
|
||||
background: #fff;
|
||||
border-bottom: 1px solid var(--visione-border);
|
||||
}
|
||||
.visione-topbar-inner,
|
||||
.visione-content {
|
||||
width: min(1080px, calc(100% - 32px));
|
||||
margin: 0 auto;
|
||||
}
|
||||
.visione-topbar-inner {
|
||||
display: flex;
|
||||
justify-content: space-between;
|
||||
align-items: center;
|
||||
gap: 24px;
|
||||
padding: 18px 0;
|
||||
}
|
||||
.visione-brand,
|
||||
.visione-brand-right {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 14px;
|
||||
}
|
||||
.visione-flag {
|
||||
width: 26px;
|
||||
height: 38px;
|
||||
border-radius: 2px;
|
||||
background: linear-gradient(90deg, #008c45 0 33%, #ffffff 33% 66%, #cd212a 66% 100%);
|
||||
box-shadow: 0 0 0 1px rgba(0,0,0,0.04);
|
||||
}
|
||||
.visione-cie-mark {
|
||||
width: 42px;
|
||||
height: 42px;
|
||||
border: 2px solid #6ba5de;
|
||||
border-radius: 50%;
|
||||
position: relative;
|
||||
}
|
||||
.visione-cie-mark::after {
|
||||
content: "";
|
||||
position: absolute;
|
||||
inset: 9px;
|
||||
border-top: 2px solid #6ba5de;
|
||||
border-right: 2px solid #6ba5de;
|
||||
border-radius: 50%;
|
||||
transform: rotate(18deg);
|
||||
}
|
||||
.visione-brand-text small,
|
||||
.visione-brand-right small {
|
||||
display: block;
|
||||
color: var(--visione-muted);
|
||||
font-size: 12px;
|
||||
letter-spacing: 0.04em;
|
||||
text-transform: uppercase;
|
||||
}
|
||||
.visione-brand-text strong,
|
||||
.visione-brand-right strong {
|
||||
display: block;
|
||||
font-size: 18px;
|
||||
}
|
||||
.visione-content { padding: 34px 0 56px; }
|
||||
.visione-eyebrow {
|
||||
color: var(--visione-blue-dark);
|
||||
font-weight: 700;
|
||||
font-size: 15px;
|
||||
letter-spacing: 0.02em;
|
||||
margin: 0 0 8px;
|
||||
text-transform: uppercase;
|
||||
}
|
||||
.visione-title {
|
||||
color: var(--visione-blue);
|
||||
font-size: clamp(32px, 5vw, 54px);
|
||||
line-height: 1.05;
|
||||
margin: 0 0 26px;
|
||||
font-weight: 700;
|
||||
}
|
||||
.visione-card {
|
||||
background: #fff;
|
||||
border-radius: 18px;
|
||||
box-shadow: 0 18px 45px rgba(22, 50, 79, 0.08);
|
||||
border: 1px solid rgba(216, 227, 240, 0.85);
|
||||
overflow: hidden;
|
||||
}
|
||||
.visione-grid {
|
||||
display: grid;
|
||||
grid-template-columns: minmax(0, 1fr) minmax(280px, 360px);
|
||||
}
|
||||
.visione-panel {
|
||||
padding: 34px 34px 30px;
|
||||
}
|
||||
.visione-panel + .visione-panel {
|
||||
border-left: 1px solid var(--visione-border);
|
||||
background: linear-gradient(180deg, #ffffff 0%, #f9fbfe 100%);
|
||||
}
|
||||
.visione-panel-title {
|
||||
margin: 0 0 12px;
|
||||
color: var(--visione-blue);
|
||||
font-size: 22px;
|
||||
line-height: 1.2;
|
||||
}
|
||||
.visione-copy {
|
||||
margin: 0 0 24px;
|
||||
color: var(--visione-muted);
|
||||
line-height: 1.6;
|
||||
}
|
||||
.visione-form-field { margin-bottom: 26px; }
|
||||
.visione-form-label {
|
||||
display: block;
|
||||
color: var(--visione-muted);
|
||||
font-size: 15px;
|
||||
margin-bottom: 10px;
|
||||
}
|
||||
.visione-form-input,
|
||||
.visione-form-textarea {
|
||||
width: 100%;
|
||||
border: 0;
|
||||
border-bottom: 1px solid #8ca3bd;
|
||||
border-radius: 0;
|
||||
padding: 10px 0;
|
||||
font-size: 18px;
|
||||
color: var(--visione-text);
|
||||
background: transparent;
|
||||
outline: 0;
|
||||
}
|
||||
.visione-form-textarea {
|
||||
min-height: 120px;
|
||||
resize: vertical;
|
||||
}
|
||||
.visione-form-input:focus,
|
||||
.visione-form-textarea:focus {
|
||||
border-bottom-color: var(--visione-blue);
|
||||
box-shadow: inset 0 -1px 0 var(--visione-blue);
|
||||
}
|
||||
.visione-actions {
|
||||
display: flex;
|
||||
gap: 16px;
|
||||
flex-wrap: wrap;
|
||||
margin-top: 10px;
|
||||
}
|
||||
.visione-btn {
|
||||
display: inline-flex;
|
||||
justify-content: center;
|
||||
align-items: center;
|
||||
min-width: 180px;
|
||||
padding: 14px 22px;
|
||||
border-radius: 8px;
|
||||
border: 2px solid var(--visione-blue);
|
||||
text-decoration: none;
|
||||
font-size: 18px;
|
||||
font-weight: 700;
|
||||
cursor: pointer;
|
||||
}
|
||||
.visione-btn-primary {
|
||||
background: var(--visione-blue);
|
||||
color: #fff;
|
||||
}
|
||||
.visione-btn-primary:hover { background: var(--visione-blue-dark); }
|
||||
.visione-btn-secondary {
|
||||
background: #fff;
|
||||
color: var(--visione-blue);
|
||||
}
|
||||
.visione-btn-secondary:hover { background: #eef5fd; }
|
||||
.visione-meta {
|
||||
padding: 16px 18px;
|
||||
border: 1px solid var(--visione-border);
|
||||
border-radius: 14px;
|
||||
background: #fff;
|
||||
}
|
||||
.visione-claims {
|
||||
margin: 18px 0 0;
|
||||
padding-left: 18px;
|
||||
color: var(--visione-text);
|
||||
line-height: 1.7;
|
||||
}
|
||||
.visione-claims li + li { margin-top: 6px; }
|
||||
.visione-error {
|
||||
color: #b11f2a;
|
||||
font-size: 14px;
|
||||
margin-top: 8px;
|
||||
}
|
||||
.visione-muted-note {
|
||||
color: var(--visione-muted);
|
||||
font-size: 14px;
|
||||
margin-top: 18px;
|
||||
}
|
||||
.visione-inline-nav {
|
||||
display: flex;
|
||||
gap: 16px;
|
||||
margin-top: 18px;
|
||||
font-size: 14px;
|
||||
}
|
||||
@media (max-width: 900px) {
|
||||
.visione-grid { grid-template-columns: 1fr; }
|
||||
.visione-panel + .visione-panel { border-left: 0; border-top: 1px solid var(--visione-border); }
|
||||
.visione-topbar-inner { flex-wrap: wrap; }
|
||||
.visione-panel { padding: 28px 22px; }
|
||||
.visione-actions { flex-direction: column; }
|
||||
.visione-btn { width: 100%; }
|
||||
}
|
||||
</style>
|
||||
{% block extra_head %}{% endblock extra_head %}
|
||||
</head>
|
||||
<body>
|
||||
<div class="visione-shell">
|
||||
<header class="visione-topbar">
|
||||
<div class="visione-topbar-inner">
|
||||
<div class="visione-brand">
|
||||
<div class="visione-flag" aria-hidden="true"></div>
|
||||
<div class="visione-brand-text">
|
||||
<small>{% trans "Ministero dell'interno" %}</small>
|
||||
<strong>{% trans "Accesso CIE" %}</strong>
|
||||
</div>
|
||||
</div>
|
||||
<div class="visione-brand-right">
|
||||
<div class="visione-cie-mark" aria-hidden="true"></div>
|
||||
<div>
|
||||
<small>{% trans "Relying party" %}</small>
|
||||
<strong>Visione</strong>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</header>
|
||||
<main class="visione-content">
|
||||
{% block container %}{% endblock container %}
|
||||
</main>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,68 @@
|
||||
{% extends 'op_base.html' %}
|
||||
{% load i18n %}
|
||||
|
||||
{% block page_title %}Visione CIE Consent{% endblock page_title %}
|
||||
|
||||
{% block container %}
|
||||
<p class="visione-eyebrow">{% trans "Richiesta d'accesso CIE livello 2" %}</p>
|
||||
<h1 class="visione-title">{{ client_organization_name|default:"Visione" }}</h1>
|
||||
|
||||
<section class="visione-card">
|
||||
<div class="visione-grid">
|
||||
<div class="visione-panel">
|
||||
<h2 class="visione-panel-title">{% trans "Conferma rilascio dati" %}</h2>
|
||||
<p class="visione-copy">
|
||||
{% blocktrans with service=client_organization_name|default:"Visione" %}
|
||||
Per completare accesso a {{ service }} devi autorizzare rilascio degli attributi richiesti.
|
||||
{% endblocktrans %}
|
||||
</p>
|
||||
<form method="post" action="{% url 'oidc_provider_consent' %}">
|
||||
{% csrf_token %}
|
||||
{% for form_field in form.visible_fields %}
|
||||
<div class="visione-form-field">
|
||||
<label class="visione-form-label" for="id_{{ form_field.html_name }}">{{ form_field.label }}</label>
|
||||
{% if form_field.field.widget.input_type %}
|
||||
<input
|
||||
id="id_{{ form_field.html_name }}"
|
||||
class="visione-form-input"
|
||||
type="{{ form_field.field.widget.input_type }}"
|
||||
name="{{ form_field.name }}"
|
||||
value="{{ form_field.value|default_if_none:'' }}">
|
||||
{% else %}
|
||||
<textarea id="id_{{ form_field.html_name }}" class="visione-form-textarea" name="{{ form_field.name }}">{{ form.public_jwks.value }}</textarea>
|
||||
{% endif %}
|
||||
{% if form_field.errors %}
|
||||
<div class="visione-error">{{ form_field.errors }}</div>
|
||||
{% endif %}
|
||||
</div>
|
||||
{% endfor %}
|
||||
{% for hidden in form.hidden_fields %}
|
||||
{{ hidden }}
|
||||
{% endfor %}
|
||||
<div class="visione-actions">
|
||||
<a class="visione-btn visione-btn-secondary" href="{% url 'oidc_provider_not_consent' %}?redirect_uri={{ redirect_uri|urlencode }}&state={{ state|urlencode }}" id="do_not_agree">
|
||||
{% trans "Annulla" %}
|
||||
</a>
|
||||
<button class="visione-btn visione-btn-primary" id="agree" type="submit">{% trans "Autorizza" %}</button>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
<aside class="visione-panel">
|
||||
<h2 class="visione-panel-title">{% trans "Dati richiesti" %}</h2>
|
||||
<p class="visione-copy">
|
||||
{% trans "Questi attributi saranno condivisi con Visione per completare autenticazione." %}
|
||||
</p>
|
||||
<div class="visione-meta">
|
||||
<ul class="visione-claims">
|
||||
{% for claim in user_claims %}
|
||||
<li>{{ claim }}</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
</div>
|
||||
<div class="visione-inline-nav">
|
||||
<a href="{% url 'oidc_provider_access_history' %}">{% trans "Storico accessi" %}</a>
|
||||
</div>
|
||||
</aside>
|
||||
</div>
|
||||
</section>
|
||||
{% endblock container %}
|
||||
@@ -0,0 +1,65 @@
|
||||
{% extends 'op_base.html' %}
|
||||
{% load i18n %}
|
||||
|
||||
{% block page_title %}Visione CIE Login{% endblock page_title %}
|
||||
|
||||
{% block container %}
|
||||
<p class="visione-eyebrow">{% trans "Richiesta d'accesso CIE livello 2" %}</p>
|
||||
<h1 class="visione-title">{{ client_organization_name|default:"Visione" }}</h1>
|
||||
|
||||
<section class="visione-card">
|
||||
<div class="visione-grid">
|
||||
<div class="visione-panel">
|
||||
<h2 class="visione-panel-title">{% trans "Entra con le tue credenziali CIE" %}</h2>
|
||||
<p class="visione-copy">
|
||||
{% blocktrans with acr=acr_value|upper %}
|
||||
Autenticazione richiesta con livello {{ acr }}. Inserisci le credenziali associate alla tua identità digitale.
|
||||
{% endblocktrans %}
|
||||
</p>
|
||||
<form method="post" action="{% url 'oidc_provider_authnrequest' %}">
|
||||
{% csrf_token %}
|
||||
{% for form_field in form.visible_fields %}
|
||||
<div class="visione-form-field">
|
||||
<label class="visione-form-label" for="id_{{ form_field.html_name }}">{{ form_field.label }}</label>
|
||||
{% if form_field.field.widget.input_type %}
|
||||
<input
|
||||
id="id_{{ form_field.html_name }}"
|
||||
class="visione-form-input"
|
||||
type="{{ form_field.field.widget.input_type }}"
|
||||
name="{{ form_field.name }}"
|
||||
value="{{ form_field.value|default_if_none:'' }}">
|
||||
{% endif %}
|
||||
{% if form_field.errors %}
|
||||
<div class="visione-error">{{ form_field.errors }}</div>
|
||||
{% endif %}
|
||||
</div>
|
||||
{% endfor %}
|
||||
{% for hidden in hidden_form.hidden_fields %}
|
||||
{{ hidden }}
|
||||
{% endfor %}
|
||||
<div class="visione-actions">
|
||||
<a class="visione-btn visione-btn-secondary" href="{% url 'oidc_provider_not_consent' %}?redirect_uri={{ redirect_uri|urlencode }}&state={{ state|urlencode }}">
|
||||
{% trans "Annulla" %}
|
||||
</a>
|
||||
<button class="visione-btn visione-btn-primary" type="submit">{% trans "Procedi" %}</button>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
<aside class="visione-panel">
|
||||
<h2 class="visione-panel-title">{% trans "Accesso al servizio" %}</h2>
|
||||
<p class="visione-copy">
|
||||
{% blocktrans with service=client_organization_name|default:"Visione" %}
|
||||
Stai autorizzando accesso a {{ service }} tramite provider CIE configurato per progetto Visione.
|
||||
{% endblocktrans %}
|
||||
</p>
|
||||
<div class="visione-meta">
|
||||
<strong>{% trans "Servizio richiedente" %}</strong>
|
||||
<p class="visione-copy" style="margin: 8px 0 0;">{{ client_organization_name|default:"Visione" }}</p>
|
||||
</div>
|
||||
<p class="visione-muted-note">
|
||||
{% trans "Se annulli o l'autorizzazione viene rifiutata, il browser tornerà a Visione." %}
|
||||
</p>
|
||||
</aside>
|
||||
</div>
|
||||
</section>
|
||||
{% endblock container %}
|
||||
@@ -87,7 +87,7 @@
|
||||
},
|
||||
"openid_relying_party": {
|
||||
"application_type": "web",
|
||||
"organization_name": "Example RP",
|
||||
"organization_name": "Visione",
|
||||
"client_id": "http://127.0.0.1:8001",
|
||||
"client_registration_types": [
|
||||
"automatic"
|
||||
@@ -114,7 +114,7 @@
|
||||
}
|
||||
]
|
||||
},
|
||||
"client_name": "Name of an example organization",
|
||||
"client_name": "Visione",
|
||||
"contacts": [
|
||||
"[email protected]"
|
||||
],
|
||||
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,337 @@
|
||||
import json
|
||||
import logging
|
||||
from urllib.parse import urlencode
|
||||
|
||||
from django.http import HttpResponseRedirect
|
||||
from django.shortcuts import render
|
||||
from django.utils.translation import gettext as _
|
||||
from spid_cie_oidc.entity.jwtse import (
|
||||
unpad_jwt_payload,
|
||||
verify_at_hash,
|
||||
verify_jws,
|
||||
)
|
||||
from spid_cie_oidc.entity.models import FederationEntityConfiguration
|
||||
from spid_cie_oidc.entity.settings import HTTPC_PARAMS
|
||||
from spid_cie_oidc.entity.utils import get_jwk_from_jwt, get_jwks
|
||||
from spid_cie_oidc.relying_party.exceptions import ValidationException
|
||||
from spid_cie_oidc.relying_party.oidc import iat_now
|
||||
from spid_cie_oidc.relying_party.settings import RP_ATTR_MAP, RP_DEFAULT_PROVIDER_PROFILES, RP_PROVIDER_PROFILES
|
||||
from spid_cie_oidc.relying_party.utils import process_user_attributes
|
||||
from spid_cie_oidc.relying_party.views.rp_begin import SpidCieOidcRpBeginView
|
||||
from spid_cie_oidc.relying_party.views.rp_callback import SpidCieOidcRpCallbackView
|
||||
from spid_cie_oidc.relying_party.models import OidcAuthentication, OidcAuthenticationToken
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
schema_profile = RP_PROVIDER_PROFILES[RP_DEFAULT_PROVIDER_PROFILES]
|
||||
|
||||
|
||||
def _visione_redirect_uri(request):
|
||||
return request.session.get("visione_frontend_redirect_uri")
|
||||
|
||||
|
||||
def _visione_error_redirect(request, error, error_description="", status=302):
|
||||
frontend_redirect_uri = _visione_redirect_uri(request)
|
||||
if frontend_redirect_uri:
|
||||
params = {
|
||||
"state": request.session.get("visione_state", ""),
|
||||
"error": error,
|
||||
}
|
||||
if error_description:
|
||||
params["error_description"] = error_description
|
||||
separator = "&" if "?" in frontend_redirect_uri else "?"
|
||||
return HttpResponseRedirect(
|
||||
f"{frontend_redirect_uri}{separator}{urlencode(params)}",
|
||||
status=status,
|
||||
)
|
||||
return None
|
||||
|
||||
|
||||
class VisioneRpBeginView(SpidCieOidcRpBeginView):
|
||||
def get(self, request, *args, **kwargs):
|
||||
response = super().get(request, *args, **kwargs)
|
||||
if getattr(response, "status_code", None) and response.status_code >= 400:
|
||||
frontend_redirect = _visione_error_redirect(
|
||||
request,
|
||||
"request_rejected",
|
||||
"Authentication request rejected",
|
||||
)
|
||||
if frontend_redirect:
|
||||
return frontend_redirect
|
||||
return response
|
||||
|
||||
|
||||
def visione_rp_error_context(request):
|
||||
frontend_redirect_uri = _visione_redirect_uri(request)
|
||||
if not frontend_redirect_uri:
|
||||
return {}
|
||||
params = {
|
||||
"state": request.session.get("visione_state", ""),
|
||||
"error": "invalid_request",
|
||||
}
|
||||
separator = "&" if "?" in frontend_redirect_uri else "?"
|
||||
return {
|
||||
"visione_return_url": f"{frontend_redirect_uri}{separator}{urlencode(params)}",
|
||||
}
|
||||
|
||||
|
||||
class VisioneRpCallbackView(SpidCieOidcRpCallbackView):
|
||||
def get(self, request, *args, **kwargs):
|
||||
if "error" in request.GET and _visione_redirect_uri(request):
|
||||
return _visione_error_redirect(
|
||||
request,
|
||||
request.GET.get("error", "invalid_request"),
|
||||
request.GET.get("error_description", ""),
|
||||
)
|
||||
request_args = {k: v for k, v in request.GET.items()}
|
||||
authz = OidcAuthentication.objects.filter(state=request_args.get("state"))
|
||||
try:
|
||||
self.validate_json_schema(
|
||||
request.GET.dict(),
|
||||
"authn_response",
|
||||
"Authn response object validation failed",
|
||||
)
|
||||
except ValidationException:
|
||||
return _visione_error_redirect(
|
||||
request,
|
||||
"invalid_request",
|
||||
"Authn response object validation failed",
|
||||
) or render(
|
||||
request,
|
||||
self.error_template,
|
||||
{
|
||||
"error": "invalid_request",
|
||||
"error_description": "Authn response object validation failed",
|
||||
**visione_rp_error_context(request),
|
||||
},
|
||||
status=400,
|
||||
)
|
||||
|
||||
if not authz:
|
||||
return _visione_error_redirect(
|
||||
request,
|
||||
"unauthorized_request",
|
||||
"Authentication not found",
|
||||
) or render(
|
||||
request,
|
||||
self.error_template,
|
||||
{
|
||||
"error": "unauthorized request",
|
||||
"error_description": _("Authentication not found"),
|
||||
**visione_rp_error_context(request),
|
||||
},
|
||||
status=401,
|
||||
)
|
||||
|
||||
authz = authz.last()
|
||||
if request.GET.get("iss") and request.GET["iss"] != authz.provider_id:
|
||||
return _visione_error_redirect(
|
||||
request,
|
||||
"invalid_request",
|
||||
"authn response validation failed: mixups attack prevention.",
|
||||
) or render(
|
||||
request,
|
||||
self.error_template,
|
||||
{
|
||||
"error": "invalid request",
|
||||
"error_description": _(
|
||||
"authn response validation failed: mixups attack prevention."
|
||||
),
|
||||
**visione_rp_error_context(request),
|
||||
},
|
||||
status=400,
|
||||
)
|
||||
|
||||
code = request.GET.get("code")
|
||||
authz_token = OidcAuthenticationToken.objects.create(authz_request=authz, code=code)
|
||||
self.rp_conf = FederationEntityConfiguration.objects.filter(
|
||||
sub=authz_token.authz_request.client_id
|
||||
).first()
|
||||
if not self.rp_conf:
|
||||
return _visione_error_redirect(
|
||||
request,
|
||||
"invalid_request",
|
||||
"Relying party not found",
|
||||
) or render(
|
||||
request,
|
||||
self.error_template,
|
||||
{
|
||||
"error": "invalid request",
|
||||
"error_description": _("Relying party not found"),
|
||||
**visione_rp_error_context(request),
|
||||
},
|
||||
status=400,
|
||||
)
|
||||
|
||||
authz_data = json.loads(authz.data)
|
||||
token_response = self.access_token_request(
|
||||
redirect_uri=authz_data["redirect_uri"],
|
||||
state=authz.state,
|
||||
code=code,
|
||||
issuer_id=authz.provider_id,
|
||||
client_conf=self.rp_conf,
|
||||
token_endpoint_url=authz.provider_configuration["token_endpoint"],
|
||||
audience=[authz.provider_id],
|
||||
code_verifier=authz_data.get("code_verifier"),
|
||||
)
|
||||
if not token_response:
|
||||
return _visione_error_redirect(
|
||||
request,
|
||||
"invalid_token_response",
|
||||
"Token response seems not to be valid",
|
||||
) or render(
|
||||
request,
|
||||
self.error_template,
|
||||
{
|
||||
"error": "invalid token response",
|
||||
"error_description": _("Token response seems not to be valid"),
|
||||
**visione_rp_error_context(request),
|
||||
},
|
||||
status=400,
|
||||
)
|
||||
|
||||
try:
|
||||
self.validate_json_schema(
|
||||
token_response,
|
||||
"token_response",
|
||||
"Token response object validation failed",
|
||||
)
|
||||
except ValidationException:
|
||||
return _visione_error_redirect(
|
||||
request,
|
||||
"invalid_request",
|
||||
"Token response object validation failed",
|
||||
) or render(
|
||||
request,
|
||||
self.error_template,
|
||||
{
|
||||
"error": "invalid_request",
|
||||
"error_description": "Token response object validation failed",
|
||||
**visione_rp_error_context(request),
|
||||
},
|
||||
status=400,
|
||||
)
|
||||
|
||||
jwks = get_jwks(authz.provider_configuration)
|
||||
access_token = token_response["access_token"]
|
||||
id_token = token_response["id_token"]
|
||||
op_ac_jwk = get_jwk_from_jwt(access_token, jwks)
|
||||
op_id_jwk = get_jwk_from_jwt(id_token, jwks)
|
||||
if not op_ac_jwk or not op_id_jwk:
|
||||
return _visione_error_redirect(
|
||||
request,
|
||||
"invalid_token",
|
||||
"Authentication token seems not to be valid.",
|
||||
) or render(
|
||||
request,
|
||||
self.error_template,
|
||||
{
|
||||
"error": "invalid_token",
|
||||
"error_description": _("Authentication token seems not to be valid."),
|
||||
**visione_rp_error_context(request),
|
||||
},
|
||||
status=403,
|
||||
)
|
||||
|
||||
try:
|
||||
verify_jws(access_token, op_ac_jwk)
|
||||
verify_jws(id_token, op_id_jwk)
|
||||
decoded_id_token = unpad_jwt_payload(id_token)
|
||||
verify_at_hash(decoded_id_token, access_token)
|
||||
except Exception as exc:
|
||||
logger.warning("Token validation error: %s", exc)
|
||||
return _visione_error_redirect(
|
||||
request,
|
||||
"token_verification_failed",
|
||||
"Authentication token validation error.",
|
||||
) or render(
|
||||
request,
|
||||
self.error_template,
|
||||
{
|
||||
"error": "token verification failed",
|
||||
"error_description": _("Authentication token validation error."),
|
||||
**visione_rp_error_context(request),
|
||||
},
|
||||
status=403,
|
||||
)
|
||||
|
||||
decoded_access_token = unpad_jwt_payload(access_token)
|
||||
authz_token.access_token = access_token
|
||||
authz_token.id_token = id_token
|
||||
authz_token.scope = token_response.get("scope")
|
||||
authz_token.token_type = token_response["token_type"]
|
||||
authz_token.expires_in = token_response["expires_in"]
|
||||
authz_token.save()
|
||||
|
||||
userinfo = self.get_userinfo(
|
||||
authz.state,
|
||||
authz_token.access_token,
|
||||
authz.provider_configuration,
|
||||
verify=HTTPC_PARAMS.get("connection", {}).get("ssl", True),
|
||||
)
|
||||
if not userinfo:
|
||||
return _visione_error_redirect(
|
||||
request,
|
||||
"invalid_userinfo_response",
|
||||
"UserInfo response seems not to be valid",
|
||||
) or render(
|
||||
request,
|
||||
self.error_template,
|
||||
{
|
||||
"error": "invalid userinfo response",
|
||||
"error_description": _("UserInfo response seems not to be valid"),
|
||||
**visione_rp_error_context(request),
|
||||
},
|
||||
status=400,
|
||||
)
|
||||
|
||||
user_attrs = process_user_attributes(userinfo, RP_ATTR_MAP, authz.__dict__)
|
||||
if not user_attrs:
|
||||
return _visione_error_redirect(
|
||||
request,
|
||||
"missing_user_attributes",
|
||||
"No user attributes have been processed",
|
||||
) or render(
|
||||
request,
|
||||
self.error_template,
|
||||
{
|
||||
"error": "missing user attributes",
|
||||
"error_description": _("No user attributes have been processed"),
|
||||
**visione_rp_error_context(request),
|
||||
},
|
||||
status=403,
|
||||
)
|
||||
|
||||
user = self.user_reunification(user_attrs)
|
||||
if not user:
|
||||
return _visione_error_redirect(
|
||||
request,
|
||||
"no_user_found",
|
||||
"No user found",
|
||||
) or render(
|
||||
request,
|
||||
self.error_template,
|
||||
{
|
||||
"error": _("No user found"),
|
||||
"error_description": "",
|
||||
**visione_rp_error_context(request),
|
||||
},
|
||||
status=403,
|
||||
)
|
||||
|
||||
request.session["rt_expiration"] = 0
|
||||
if token_response.get("refresh_token"):
|
||||
refresh_token = token_response["refresh_token"]
|
||||
authz_token.refresh_token = refresh_token
|
||||
decoded_refresh_token = unpad_jwt_payload(refresh_token)
|
||||
request.session["rt_expiration"] = decoded_refresh_token["exp"] - iat_now()
|
||||
request.session["rt_jti"] = decoded_refresh_token["jti"]
|
||||
|
||||
from django.contrib.auth import login
|
||||
login(request, user)
|
||||
request.session["oidc_rp_user_attrs"] = user_attrs
|
||||
request.session["at_expiration"] = decoded_access_token["exp"] - iat_now()
|
||||
request.session["at_jti"] = decoded_access_token["jti"]
|
||||
authz_token.user = user
|
||||
authz_token.save()
|
||||
return HttpResponseRedirect("/visione/complete")
|
||||
@@ -28,7 +28,7 @@ ROOT_URLCONF = 'relying_party.urls'
|
||||
TEMPLATES = [
|
||||
{
|
||||
'BACKEND': 'django.template.backends.django.DjangoTemplates',
|
||||
'DIRS': [],
|
||||
'DIRS': [os.path.join(BASE_DIR, 'templates')],
|
||||
'APP_DIRS': True,
|
||||
'OPTIONS': {
|
||||
'context_processors': [
|
||||
|
||||
@@ -21,6 +21,7 @@ from django.views.static import serve
|
||||
from scripts.build_probe import build_probe_view, diag_view
|
||||
from spid_cie_oidc.entity.urls import urlpatterns as ta_urlpatterns
|
||||
from .visione_views import VisioneCompleteView, VisioneStartView
|
||||
from .rp_overrides import VisioneRpBeginView, VisioneRpCallbackView
|
||||
|
||||
admin.site.site_header = "OIDC Federation Relying Party Administration"
|
||||
admin.site.site_title = "OIDC Federation Relying Party"
|
||||
@@ -47,6 +48,10 @@ urlpatterns.extend(ta_urlpatterns)
|
||||
if 'spid_cie_oidc.relying_party' in settings.INSTALLED_APPS:
|
||||
from spid_cie_oidc.relying_party.urls import urlpatterns as rp_urlpatterns
|
||||
urlpatterns.extend(rp_urlpatterns)
|
||||
urlpatterns = [
|
||||
path("oidc/rp/authorization", VisioneRpBeginView.as_view(), name="spid_cie_rp_begin"),
|
||||
path("oidc/rp/callback", VisioneRpCallbackView.as_view(), name="spid_cie_rp_callback"),
|
||||
] + [u for u in urlpatterns if getattr(u, "name", None) not in {"spid_cie_rp_begin", "spid_cie_rp_callback"}]
|
||||
|
||||
from spid_cie_oidc.entity.views import entity_configuration, resolve_entity_statement
|
||||
|
||||
|
||||
@@ -171,3 +171,17 @@ class VisioneCompleteView(View):
|
||||
if redirect_url:
|
||||
return HttpResponseRedirect(redirect_url)
|
||||
return HttpResponseServerError("Visione backend exchange did not redirect")
|
||||
|
||||
|
||||
def visione_error_redirect(request, error, error_description=""):
|
||||
frontend_redirect_uri = request.session.get("visione_frontend_redirect_uri")
|
||||
if not frontend_redirect_uri:
|
||||
return None
|
||||
params = {
|
||||
"state": request.session.get("visione_state", ""),
|
||||
"error": error,
|
||||
}
|
||||
if error_description:
|
||||
params["error_description"] = error_description
|
||||
separator = "&" if "?" in frontend_redirect_uri else "?"
|
||||
return HttpResponseRedirect(f"{frontend_redirect_uri}{separator}{urlencode(params)}")
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
{% extends 'rp_base.html' %}
|
||||
{% load i18n %}
|
||||
|
||||
{% block centered_container %}
|
||||
<div class="col-12 col-lg-8 pl-lg-4">
|
||||
<div class="callout danger">
|
||||
<div class="callout-title">{% trans error %}</div>
|
||||
<p>{% trans error_description %}</p>
|
||||
{% if visione_return_url %}
|
||||
<p class="mt-4 mb-0">
|
||||
<a href="{{ visione_return_url }}">{% trans "Torna a Visione" %}</a>
|
||||
</p>
|
||||
{% endif %}
|
||||
</div>
|
||||
</div>
|
||||
{% endblock %}
|
||||
Reference in New Issue
Block a user