~maxiberta/canonical-identity-provider/prevent-forgot-password-user-enumeration : changes

~maxiberta/canonical-identity-provider/prevent-forgot-password-user-enumeration » Changes from revision 1536.1.3

From Revision 1536.1.3 to 1520

Rev	Summary	Authors	Date
1536.1.3	Remove more gpg-related bits. Remove more gpg-related bits.	Thomi Richards	7 years ago
1536.1.2	Remove gpgservice related hooks from Makefile. Remove gpgservice related hooks from Makefile.	Thomi Richards	7 years ago
1536.1.1	Remove GPG integration from SSO. Remove GPG integration from SSO.	Thomi Richards	7 years ago
1536	[r=matt-goodall] Catch one exception observed in the wild wh... [r=matt-goodall] Catch one exception observed in the wild when trying to get info from SAML request. There are no specific tests because I was unable to reproduce how this scenario can occur, but the exception was raised in the wild (though it only happened once) so it makes sense to be more defensive by catching that other exception.	Daniel Manrique	7 years ago
1535	[r=matt-goodall,roadmr] Make SAML2IDP_REMOTES ordering predi... [r=matt-goodall,roadmr] Make SAML2IDP_REMOTES ordering predictable. This setting contains a dict of SAML remotes, which is iterated to find the first one willing to handle a SAML request. Since the ordering is not predictable and more than one remote could be willing to handle a particular request, the behavior can (and has) cause(d) problems in production. This change moves the setting to use an OrderedDict and "rearranges" the initial contents to be ordered alphabetically by key. This makes it easy to decide ordering by, for example, prefixing each remote's key with an integer.	Daniel Manrique	7 years ago
1534	[r=nataliabidart] Fix bug-1626102 [r=nataliabidart] Fix bug-1626102	Para Siva	7 years ago
1533	[r=roadmr,ricardokirkner] Show friendlier SAML errors, inste... [r=roadmr,ricardokirkner] Show friendlier SAML errors, instead of just oopsing on the user. - If a proper SAML assertion comes but can't be handled by any of our remotes, show the SAML ACS URL (truncating any path components) in a nice page. The user can't do much about this anyway, but at least we'll tell them it's not their fault and give them a chance to file a bug. - Accessing the /+saml endpoint without a SAML request will either tell the user they're using this endpoint improperly (if they hit it directly), or tell them the page that sent them here is misconfigured and to talk to the owners of that page (if we get a HTTP_REFERER, which we'll also show to give them info about who to complain to). We can't show an ACS URL here because there's no SAML assertion :( - Log an exception in all cases so if users still need help, we can look the problem up in the logs.	Daniel Manrique	7 years ago
1532	[r=cprov] Assign a distinct "twofactor-required" error code. [r=cprov] Assign a distinct "twofactor-required" error code.	Colin Watson	7 years ago
1531	[r=fgallina] Reorder the account registration logic to use f... [r=fgallina] Reorder the account registration logic to use form validation instead of relying on handlers' exceptions.	Para Siva	7 years ago
1530	[r=fgallina,ricardokirkner,maxiberta] Make Username in webui [r=fgallina,ricardokirkner,maxiberta] Make Username in webui registration mandatory	Para Siva	7 years ago
1529	[r=ricardokirkner] SAML processor for Rocket.Chat integratio... [r=ricardokirkner] SAML processor for Rocket.Chat integration. Note this is specific for rocket.ubuntu.com domain; since the processor checks the originating domain, this needs tweaking for other domain names. In addition to this code, configuration is needed: - In the SAML2IDP_REMOTES setting 'rocketchat': { 'saml_url': 'https://rocket.ubuntu.com/home', 'processor': 'ubuntu_sso_saml.processors.RocketchatProcessor', 'acs_url': 'https://rocket.ubuntu.com/_saml/validate/openidp', }, Rocket.chat needs to be configured with (by an admin, on Administration -> SAML): Custom provider: openidp Custom entry point: https://login.ubuntu.com/+saml Custom issuer: https://rocket.ubuntu.com Custom cert: copy and paste the content of the certificate.pem (ask IS for the production one). Do NOT include the lines with --BEGIN/END CERTIFICATE--- Button text: Sign in with Ubuntu One SSO Generate username: FALSE To disable non-SAML logins: Under users, choose someone who can log in via SAML/SSO and "make admin" Under settings -> accounts, disable "show form-based login"	Daniel Manrique	7 years ago
1528	[r=facundo] update the snap related 2 endpoints to use the [r=facundo] update the snap related 2 endpoints to use the normalization error format.	Kelvin Li	7 years ago
1527	[r=nataliabidart] To optionally set/unset need_username_refr... [r=nataliabidart] To optionally set/unset need_username_refresh flag of an account via the admin view.	Para Siva	7 years ago
1526	[r=cjwatson] Direct people with problems to the appropriate ... [r=cjwatson] Direct people with problems to the appropriate IRC channel	Barry Price	7 years ago
1525	[r=matiasb] Removed the deprecated way of refreshing macaroo... [r=matiasb] Removed the deprecated way of refreshing macaroons (sending both root and discharge).	Facundo Batista	7 years ago
1524	[r=fgallina] Include 'username' into v2 api responses. [r=fgallina] Include 'username' into v2 api responses.	Para Siva	7 years ago
1523	[r=maxiberta,matt-goodall] Add username in discharge_macaroo... [r=maxiberta,matt-goodall] Add username in discharge_macaroon.	Para Siva	7 years ago
1522	[r=roadmr] Update deps to django-modeldict-yplan-1.5.2 (incl... [r=roadmr] Update deps to django-modeldict-yplan-1.5.2 (includes flag sync fixes merged upstream).	Maximiliano Bertacch...	7 years ago
1521	[r=cprov] Add an /api/v2/gpg/keys/<account> endpoint that li... [r=cprov] Add an /api/v2/gpg/keys/<account> endpoint that lists a user's GPG keys.	Colin Watson	7 years ago
1520	[r=cprov] Move webui.gpg to identityprovider.gpg so that it ... [r=cprov] Move webui.gpg to identityprovider.gpg so that it can be used by the API.	Colin Watson	7 years ago

Older »