Merge branch 'master' into master

WPI-LNL · Oct 9, 2018 · c064050 · c064050
2 parents 7cfeb02 + 87444d4
commit c064050
Show file tree

Hide file tree

Showing 3 changed files with 34 additions and 12 deletions.
diff --git a/AUTHORS.rst b/AUTHORS.rst
@@ -28,3 +28,5 @@ Contributors
 - `pintor <https://github.com/pintor>`_
 - `BaconAndEggs <https://github.com/BaconAndEggs>`_
 - `Ryan Mahaffey <https://github.com/mahaffey>`_
+- `ayr-ton <https://github.com/ayr-ton>`_
+_ `kevPo <https://github.com/kevPo>`_
diff --git a/README.rst b/README.rst
@@ -123,11 +123,13 @@ How to use?
     .. code-block:: python
 
         SAML2_AUTH = {
-            # Required setting
+            # Metadata is required, choose either remote url or local file path
             'METADATA_AUTO_CONF_URL': '[The auto(dynamic) metadata configuration URL of SAML2]',
+            'METADATA_LOCAL_FILE_PATH': '[The metadata configuration file path]',
 
             # Optional settings below
             'DEFAULT_NEXT_URL': '/admin',  # Custom target redirect URL after the user get logged in. Default to /admin if not set. This setting will be overwritten if you have parameter ?next= specificed in the login URL.
+            'CREATE_USER': 'TRUE', # Create a new Django user when a new user logs in. Defaults to True.
             'NEW_USER_PROFILE': {
                 'USER_GROUPS': [],  # The default group name when a new user logs in
                 'ACTIVE_STATUS': True,  # The default active status for new users
@@ -160,6 +162,10 @@ Explanation
 
 **METADATA_AUTO_CONF_URL** Auto SAML2 metadata configuration URL
 
+**METADATA_LOCAL_FILE_PATH** SAML2 metadata configuration file path
+
+**CREATE_USER** Determines if a new Django user should be created for new users.
+
 **NEW_USER_PROFILE** Default settings for newly created users
 
 **ATTRIBUTES_MAP** Mapping of Django user attributes to SAML2 user attributes

diff --git a/django_saml2_auth/views.py b/django_saml2_auth/views.py
@@ -67,17 +67,27 @@ def get_reverse(objs):
     raise Exception('We got a URL reverse issue: %s. This is a known issue but please still submit a ticket at https://github.com/fangli/django-saml2-auth/issues/new' % str(objs))
 
 
-def _get_saml_client(domain):
-    acs_url = domain + get_reverse([acs, 'acs', 'django_saml2_auth:acs'])
-
-    saml_settings = {
-        'metadata': {
+def _get_metadata():
+    if 'METADATA_LOCAL_FILE_PATH' in settings.SAML2_AUTH:
+        return {
+            'local': [settings.SAML2_AUTH['METADATA_LOCAL_FILE_PATH']]
+        }
+    else:
+        return {
             'remote': [
                 {
                     "url": settings.SAML2_AUTH['METADATA_AUTO_CONF_URL'],
                 },
-            ],
-        },
+            ]
+        }
+
+
+def _get_saml_client(domain):
+    acs_url = domain + get_reverse([acs, 'acs', 'django_saml2_auth:acs'])
+    metadata = _get_metadata()
+
+    saml_settings = {
+        'metadata': metadata,
         'service': {
             'sp': {
                 'endpoints': {
@@ -167,10 +177,14 @@ def acs(r):
         if settings.SAML2_AUTH.get('TRIGGER', {}).get('BEFORE_LOGIN', None):
             import_string(settings.SAML2_AUTH['TRIGGER']['BEFORE_LOGIN'])(user_identity)
     except User.DoesNotExist:
-        target_user = _create_new_user(user_name, user_email, user_first_name, user_last_name)
-        if settings.SAML2_AUTH.get('TRIGGER', {}).get('CREATE_USER', None):
-            import_string(settings.SAML2_AUTH['TRIGGER']['CREATE_USER'])(user_identity)
-        is_new_user = True
+        new_user_should_be_created = settings.SAML2_AUTH.get('CREATE_USER', True)
+        if new_user_should_be_created: 
+            target_user = _create_new_user(user_name, user_email, user_first_name, user_last_name)
+            if settings.SAML2_AUTH.get('TRIGGER', {}).get('CREATE_USER', None):
+                import_string(settings.SAML2_AUTH['TRIGGER']['CREATE_USER'])(user_identity)
+            is_new_user = True
+        else:
+            return HttpResponseRedirect(get_reverse([denied, 'denied', 'django_saml2_auth:denied']))
 
     r.session.flush()