Skip to content

Commit c0ff93f

Browse files
stevenbalstevenbal
committed
tmp
1 parent 4459145 commit c0ff93f

File tree

4 files changed

+437
-0
lines changed

4 files changed

+437
-0
lines changed

‎src/open_inwoner/conf/app/setup_configuration.py

+34
Original file line numberDiff line numberDiff line change
@@ -203,3 +203,37 @@
203203
ADMIN_OIDC_OIDC_STATE_SIZE = config("ADMIN_OIDC_OIDC_STATE_SIZE", None)
204204
ADMIN_OIDC_OIDC_EXEMPT_URLS = config("ADMIN_OIDC_OIDC_EXEMPT_URLS", None)
205205
ADMIN_OIDC_USERINFO_CLAIMS_SOURCE = config("ADMIN_OIDC_USERINFO_CLAIMS_SOURCE", None)
206+
207+
DIGID_ENABLE = config("DIGID_ENABLE", default=True)
208+
DIGID_CERTIFICATE_LABEL = config("DIGID_CERTIFICATE_LABEL", None)
209+
DIGID_CERTIFICATE_TYPE = config("DIGID_CERTIFICATE_TYPE", None)
210+
DIGID_CERTIFICATE_PUBLIC_CERTIFICATE = config(
211+
"DIGID_CERTIFICATE_PUBLIC_CERTIFICATE", None
212+
)
213+
DIGID_CERTIFICATE_PRIVATE_KEY = config("DIGID_CERTIFICATE_PRIVATE_KEY", None)
214+
DIGID_METADATA_FILE_SOURCE = config("DIGID_METADATA_FILE_SOURCE", None)
215+
DIGID_WANT_ASSERTIONS_SIGNED = config("DIGID_WANT_ASSERTIONS_SIGNED", None)
216+
DIGID_WANT_ASSERTIONS_ENCRYPTED = config("DIGID_WANT_ASSERTIONS_ENCRYPTED", None)
217+
DIGID_ARTIFACT_RESOLVE_CONTENT_TYPE = config(
218+
"DIGID_ARTIFACT_RESOLVE_CONTENT_TYPE", None
219+
)
220+
DIGID_KEY_PASSPHRASE = config("DIGID_KEY_PASSPHRASE", None)
221+
DIGID_SIGNATURE_ALGORITHM = config("DIGID_SIGNATURE_ALGORITHM", None)
222+
DIGID_DIGEST_ALGORITHM = config("DIGID_DIGEST_ALGORITHM", None)
223+
DIGID_ENTITY_ID = config("DIGID_ENTITY_ID", None)
224+
DIGID_BASE_URL = config("DIGID_BASE_URL", None)
225+
DIGID_SERVICE_NAME = config("DIGID_SERVICE_NAME", None)
226+
DIGID_SERVICE_DESCRIPTION = config("DIGID_SERVICE_DESCRIPTION", None)
227+
DIGID_TECHNICAL_CONTACT_PERSON_TELEPHONE = config(
228+
"DIGID_TECHNICAL_CONTACT_PERSON_TELEPHONE", None
229+
)
230+
DIGID_TECHNICAL_CONTACT_PERSON_EMAIL = config(
231+
"DIGID_TECHNICAL_CONTACT_PERSON_EMAIL", None
232+
)
233+
DIGID_ORGANIZATION_URL = config("DIGID_ORGANIZATION_URL", None)
234+
DIGID_ORGANIZATION_NAME = config("DIGID_ORGANIZATION_NAME", None)
235+
DIGID_ATTRIBUTE_CONSUMING_SERVICE_INDEX = config(
236+
"DIGID_ATTRIBUTE_CONSUMING_SERVICE_INDEX", None
237+
)
238+
DIGID_REQUESTED_ATTRIBUTES = config("DIGID_REQUESTED_ATTRIBUTES", None)
239+
DIGID_SLO = config("DIGID_SLO", None)

‎src/open_inwoner/configurations/bootstrap/auth.py

+99
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
from django.conf import settings
2+
from django.contrib.admin.sites import AdminSite
23
from django.contrib.auth.models import Group
4+
from django.test import RequestFactory
35

6+
from digid_eherkenning.admin import DigidConfigurationAdmin
7+
from digid_eherkenning.models import DigidConfiguration
48
from django_setup_configuration.configuration import BaseConfigurationStep
59
from django_setup_configuration.exceptions import ConfigurationRunFailed
610
from mozilla_django_oidc_db.forms import OpenIDConnectConfigForm
711
from mozilla_django_oidc_db.models import OpenIDConnectConfig
12+
from simple_certmanager.models import Certificate
813

914
from digid_eherkenning_oidc_generics.admin import (
1015
OpenIDConnectDigiDConfigForm,
@@ -239,3 +244,97 @@ def test_configuration(self):
239244
TODO not sure if it is feasible (because there are different possible IdPs),
240245
but it would be nice if we could test the login from automatically
241246
"""
247+
248+
249+
class DigiDConfigurationStep(BaseConfigurationStep):
250+
"""
251+
Configure DigiD via SAML
252+
"""
253+
254+
verbose_name = "Configuration for DigiD via SAML"
255+
required_settings = [
256+
"DIGID_CERTIFICATE_LABEL",
257+
"DIGID_CERTIFICATE_TYPE",
258+
"DIGID_CERTIFICATE_PUBLIC_CERTIFICATE",
259+
"DIGID_CERTIFICATE_PRIVATE_KEY",
260+
"DIGID_METADATA_FILE_SOURCE",
261+
"DIGID_ENTITY_ID",
262+
"DIGID_BASE_URL",
263+
"DIGID_SERVICE_NAME",
264+
"DIGID_SERVICE_DESCRIPTION",
265+
]
266+
all_settings = required_settings + [
267+
"DIGID_WANT_ASSERTIONS_SIGNED",
268+
"DIGID_WANT_ASSERTIONS_ENCRYPTED",
269+
"DIGID_ARTIFACT_RESOLVE_CONTENT_TYPE",
270+
"DIGID_KEY_PASSPHRASE",
271+
"DIGID_SIGNATURE_ALGORITHM",
272+
"DIGID_DIGEST_ALGORITHM",
273+
"DIGID_TECHNICAL_CONTACT_PERSON_TELEPHONE",
274+
"DIGID_TECHNICAL_CONTACT_PERSON_EMAIL",
275+
"DIGID_ORGANIZATION_URL",
276+
"DIGID_ORGANIZATION_NAME",
277+
"DIGID_ATTRIBUTE_CONSUMING_SERVICE_INDEX",
278+
"DIGID_REQUESTED_ATTRIBUTES",
279+
"DIGID_SLO",
280+
]
281+
enable_setting = "DIGID_ENABLE"
282+
283+
def is_configured(self) -> bool:
284+
config = DigidConfiguration.get_solo()
285+
return bool(
286+
config.certificate
287+
and config.metadata_file_source
288+
and config.entity_id
289+
and config.base_url
290+
and config.service_name
291+
and config.service_description
292+
)
293+
294+
def configure(self):
295+
config = DigidConfiguration.get_solo()
296+
297+
# Use the model defaults
298+
form_data = {
299+
field.name: getattr(config, field.name)
300+
for field in DigidConfiguration._meta.fields
301+
}
302+
303+
# Only override field values with settings if they are defined
304+
for setting in self.all_settings:
305+
value = getattr(settings, setting, None)
306+
if value is not None:
307+
model_field_name = setting.split("DIGID_")[1].lower()
308+
if model_field_name.startswith("certificate"):
309+
continue
310+
311+
form_data[model_field_name] = value
312+
313+
certificate, _ = Certificate.objects.get_or_create(
314+
label=settings.DIGID_CERTIFICATE_LABEL,
315+
defaults={
316+
"type": settings.DIGID_CERTIFICATE_TYPE,
317+
"public_certificate": settings.DIGID_CERTIFICATE_PUBLIC_CERTIFICATE,
318+
"private_key": settings.DIGID_CERTIFICATE_PRIVATE_KEY,
319+
},
320+
)
321+
322+
form_data["certificate"] = certificate
323+
324+
request = RequestFactory().get("/")
325+
digid_admin = DigidConfigurationAdmin(DigidConfiguration, AdminSite())
326+
form_class = digid_admin.get_form(request)
327+
328+
form = form_class(data=form_data)
329+
if not form.is_valid():
330+
raise ConfigurationRunFailed(
331+
f"Something went wrong while saving configuration: {form.errors}"
332+
)
333+
334+
form.save()
335+
336+
def test_configuration(self):
337+
"""
338+
TODO not sure if it is feasible (because there are different possible IdPs),
339+
but it would be nice if we could test the login from automatically
340+
"""

‎src/open_inwoner/configurations/tests/bootstrap/files/digid-metadata.xml

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" ID="_8aeffce5e70efe56f47d80f1f0322e9a5dbf6bf0" entityID="https://was-preprod1.digid.nl/saml/idp/metadata"><ds:Signature><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#_8aeffce5e70efe56f47d80f1f0322e9a5dbf6bf0"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces PrefixList="ds saml samlp xs"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>NoOIwQlJT+i8sPfoZAqpxlGTh7hqWVGeVHcu9vhQ+xA=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>ixScWp/yrGs4LRQHqnF9Zr/Jn1MOIS5TwiWwiUc3d5sv+jMbVFGSw4fHE0Yu6yp5kOajK3wCY8TbfcIb++na5XWlHDfMD3MhiNBTdr2vIw6tdqetSCng02r5BQN1wug1qH1RY8FRH39X0opOVbs/V9HsCoquRvVRxjidz9L5Q3PNx/VPGHWkW4iclJKsJT4UPqTR6ZQww3Krd7XzUA3pnTx97WxJegfwmg70H/WQiasV1eI4tWm3PFHhhS2TuVshxoWxa2Qzz6HHYsOX+jWVnL9M3YF/RXuoMdt3cOtde7/EX6Cw2r50hAODnClQgRoxuPMBhdTXAyq6NirmPR9dKg==</ds:SignatureValue><ds:KeyInfo><ds:KeyName>7593b799e735055fcd479caa35d44d455576cefc</ds:KeyName></ds:KeyInfo></ds:Signature><md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:KeyDescriptor use="signing"><ds:KeyInfo><ds:KeyName>7593b799e735055fcd479caa35d44d455576cefc</ds:KeyName><ds:X509Data><ds:X509Certificate>MIIG+zCCBOOgAwIBAgIUJmQio80TiqOX3LMrbzeG1dh0ngEwDQYJKoZIhvcN
3+
AQELBQAwgYAxCzAJBgNVBAYTAk5MMSAwHgYDVQQKDBdRdW9WYWRpcyBUcnVz
4+
dGxpbmsgQi5WLjEXMBUGA1UEYQwOTlRSTkwtMzAyMzc0NTkxNjA0BgNVBAMM
5+
LVF1b1ZhZGlzIFBLSW92ZXJoZWlkIFByaXZhdGUgU2VydmljZXMgQ0EgLSBH
6+
MTAeFw0yMzA5MjExOTEyNTlaFw0yNjA5MjExOTA3MDBaMF4xCzAJBgNVBAYT
7+
Ak5MMQ8wDQYDVQQKDAZMb2dpdXMxHTAbBgNVBAUTFDAwMDAwMDA0MTY2OTA5
8+
OTEzMDAwMR8wHQYDVQQDDBZzYW1sLXNpZ24ucHAxLmRpZ2lkLm5sMIIBIjAN
9+
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5r8GtcRfX3UN3f7I8Iobhy/N
10+
U0Y+MV6DEXTmDRvRDZjwjr6ammB/cd1fsDz7D5CU+eax205aDRH69mMZk11x
11+
cIKDjISvtBFLQVxwWXgTGpUSBogFHfp70/yfvcC7vq8gE7zjRN9gNzZCC0Ak
12+
D7ZwAfFBbwI9nBSiMby9MY41MjS/W10uik1I6s5Ok2u/WfUe6FjcnaoU1O7O
13+
tpJGAkW/yDC5HWypqeTG1fSPee/0GjvU8FH+Bu73fAFHa86KSO15eaCUR6Ea
14+
7qCjpLsfPizweP9Adehlal1blfxsfJdFunq/jnO8NhYnQ7DC0aBd6ET8Wo/O
15+
1ZacGsYmJWq9dqeleQIDAQABo4ICjDCCAogwHwYDVR0jBBgwFoAUuWymE7q7
16+
LzRjgzEu+X5JHd8A9WMwfQYIKwYBBQUHAQEEcTBvMD4GCCsGAQUFBzAChjJo
17+
dHRwOi8vdHJ1c3QucXVvdmFkaXNnbG9iYWwuY29tL3BraW9wcml2c2Vydmcx
18+
LmNydDAtBggrBgEFBQcwAYYhaHR0cDovL3NsLm9jc3AucXVvdmFkaXNnbG9i
19+
YWwuY29tMCEGA1UdEQQaMBiCFnNhbWwtc2lnbi5wcDEuZGlnaWQubmwwggEw
20+
BgNVHSAEggEnMIIBIzCCAR8GCmCEEAGHawECCAYwggEPMDQGCCsGAQUFBwIB
21+
FihodHRwOi8vd3d3LnF1b3ZhZGlzZ2xvYmFsLmNvbS9yZXBvc2l0b3J5MIHW
22+
BggrBgEFBQcCAjCByQyBxlJlbGlhbmNlIG9uIHRoaXMgY2VydGlmaWNhdGUg
23+
YnkgYW55IHBhcnR5IGFzc3VtZXMgYWNjZXB0YW5jZSBvZiB0aGUgcmVsZXZh
24+
bnQgUXVvVmFkaXMgQ2VydGlmaWNhdGlvbiBQcmFjdGljZSBTdGF0ZW1lbnQg
25+
YW5kIG90aGVyIGRvY3VtZW50cyBpbiB0aGUgUXVvVmFkaXMgcmVwb3NpdG9y
26+
eSAoaHR0cDovL3d3dy5xdW92YWRpc2dsb2JhbC5jb20pLjAdBgNVHSUEFjAU
27+
BggrBgEFBQcDAgYIKwYBBQUHAwEwQQYDVR0fBDowODA2oDSgMoYwaHR0cDov
28+
L2NybC5xdW92YWRpc2dsb2JhbC5jb20vcGtpb3ByaXZzZXJ2ZzEuY3JsMB0G
29+
A1UdDgQWBBRZAjjqOD74qry7CXrnZUyjOI33CzAOBgNVHQ8BAf8EBAMCBaAw
30+
DQYJKoZIhvcNAQELBQADggIBABiPLzZxV8YAFV0OIvK35Qh11zDZYPEp09RN
31+
9NDsb+kOvShIBQirgejYA1SVZ73vMzFUmVNW/LyKoflH/N3ziU5NoMHK/31G
32+
yP3W5Ffeezo42wLqqv1Ttfod3Tg56LC/jZb0a7R4LoosfFuEvHwWM8vJO8oy
33+
IFuNSclSXOR0UArdeUl6fXsYExFOkdKgsrjcDBH+DOs/LlDPwL9qL3aK6vOG
34+
WMXlfaFfRVhmcqs1ZVXLc+ylyT2DKf96oQSXE/pIB/yCcl3MuG3Xb0mp4MEq
35+
AcAvEa4bIW0c1ULmlmxfw7F8rR2pVWN3wl8fqsxYxg6SNp3+ZKjOvX5GVGz+
36+
2nGWC+W2szqpRL/uvNWquSZaFHRiFkbJLtZNMy9HF7F0P62ler7BuZ4resb1
37+
l5d+rRRUocPwBv6GrBv6WE6QXpKkYZyuElkl7u3W+/L5UGaz+rAaMYJ1DdQL
38+
XgAdq4KIuh9VR/YsFpttXUz2ieRBm1s2t0otk/sr0zFT23mt22lVVSaHmfCB
39+
X8xCL9z8Y+XlbhPWhoXf8hvKI9KLcpf+e9OiS84+MYq4xJxoESNoq31oYirM
40+
I1g9TNGKXAKrXIv9laeinsIJnn7zhSFu0LWz8XuvjuxPXtPzi9mOh98wIp6H
41+
+AbyNMBwYTQKpOAd8jsD6+2d1gK5WHtwce5cWxgVdo1czCvY
42+
</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:KeyDescriptor use="encryption"><ds:KeyInfo><ds:KeyName>7593b799e735055fcd479caa35d44d455576cefc</ds:KeyName><ds:X509Data><ds:X509Certificate>MIIG+zCCBOOgAwIBAgIUJmQio80TiqOX3LMrbzeG1dh0ngEwDQYJKoZIhvcN
43+
AQELBQAwgYAxCzAJBgNVBAYTAk5MMSAwHgYDVQQKDBdRdW9WYWRpcyBUcnVz
44+
dGxpbmsgQi5WLjEXMBUGA1UEYQwOTlRSTkwtMzAyMzc0NTkxNjA0BgNVBAMM
45+
LVF1b1ZhZGlzIFBLSW92ZXJoZWlkIFByaXZhdGUgU2VydmljZXMgQ0EgLSBH
46+
MTAeFw0yMzA5MjExOTEyNTlaFw0yNjA5MjExOTA3MDBaMF4xCzAJBgNVBAYT
47+
Ak5MMQ8wDQYDVQQKDAZMb2dpdXMxHTAbBgNVBAUTFDAwMDAwMDA0MTY2OTA5
48+
OTEzMDAwMR8wHQYDVQQDDBZzYW1sLXNpZ24ucHAxLmRpZ2lkLm5sMIIBIjAN
49+
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5r8GtcRfX3UN3f7I8Iobhy/N
50+
U0Y+MV6DEXTmDRvRDZjwjr6ammB/cd1fsDz7D5CU+eax205aDRH69mMZk11x
51+
cIKDjISvtBFLQVxwWXgTGpUSBogFHfp70/yfvcC7vq8gE7zjRN9gNzZCC0Ak
52+
D7ZwAfFBbwI9nBSiMby9MY41MjS/W10uik1I6s5Ok2u/WfUe6FjcnaoU1O7O
53+
tpJGAkW/yDC5HWypqeTG1fSPee/0GjvU8FH+Bu73fAFHa86KSO15eaCUR6Ea
54+
7qCjpLsfPizweP9Adehlal1blfxsfJdFunq/jnO8NhYnQ7DC0aBd6ET8Wo/O
55+
1ZacGsYmJWq9dqeleQIDAQABo4ICjDCCAogwHwYDVR0jBBgwFoAUuWymE7q7
56+
LzRjgzEu+X5JHd8A9WMwfQYIKwYBBQUHAQEEcTBvMD4GCCsGAQUFBzAChjJo
57+
dHRwOi8vdHJ1c3QucXVvdmFkaXNnbG9iYWwuY29tL3BraW9wcml2c2Vydmcx
58+
LmNydDAtBggrBgEFBQcwAYYhaHR0cDovL3NsLm9jc3AucXVvdmFkaXNnbG9i
59+
YWwuY29tMCEGA1UdEQQaMBiCFnNhbWwtc2lnbi5wcDEuZGlnaWQubmwwggEw
60+
BgNVHSAEggEnMIIBIzCCAR8GCmCEEAGHawECCAYwggEPMDQGCCsGAQUFBwIB
61+
FihodHRwOi8vd3d3LnF1b3ZhZGlzZ2xvYmFsLmNvbS9yZXBvc2l0b3J5MIHW
62+
BggrBgEFBQcCAjCByQyBxlJlbGlhbmNlIG9uIHRoaXMgY2VydGlmaWNhdGUg
63+
YnkgYW55IHBhcnR5IGFzc3VtZXMgYWNjZXB0YW5jZSBvZiB0aGUgcmVsZXZh
64+
bnQgUXVvVmFkaXMgQ2VydGlmaWNhdGlvbiBQcmFjdGljZSBTdGF0ZW1lbnQg
65+
YW5kIG90aGVyIGRvY3VtZW50cyBpbiB0aGUgUXVvVmFkaXMgcmVwb3NpdG9y
66+
eSAoaHR0cDovL3d3dy5xdW92YWRpc2dsb2JhbC5jb20pLjAdBgNVHSUEFjAU
67+
BggrBgEFBQcDAgYIKwYBBQUHAwEwQQYDVR0fBDowODA2oDSgMoYwaHR0cDov
68+
L2NybC5xdW92YWRpc2dsb2JhbC5jb20vcGtpb3ByaXZzZXJ2ZzEuY3JsMB0G
69+
A1UdDgQWBBRZAjjqOD74qry7CXrnZUyjOI33CzAOBgNVHQ8BAf8EBAMCBaAw
70+
DQYJKoZIhvcNAQELBQADggIBABiPLzZxV8YAFV0OIvK35Qh11zDZYPEp09RN
71+
9NDsb+kOvShIBQirgejYA1SVZ73vMzFUmVNW/LyKoflH/N3ziU5NoMHK/31G
72+
yP3W5Ffeezo42wLqqv1Ttfod3Tg56LC/jZb0a7R4LoosfFuEvHwWM8vJO8oy
73+
IFuNSclSXOR0UArdeUl6fXsYExFOkdKgsrjcDBH+DOs/LlDPwL9qL3aK6vOG
74+
WMXlfaFfRVhmcqs1ZVXLc+ylyT2DKf96oQSXE/pIB/yCcl3MuG3Xb0mp4MEq
75+
AcAvEa4bIW0c1ULmlmxfw7F8rR2pVWN3wl8fqsxYxg6SNp3+ZKjOvX5GVGz+
76+
2nGWC+W2szqpRL/uvNWquSZaFHRiFkbJLtZNMy9HF7F0P62ler7BuZ4resb1
77+
l5d+rRRUocPwBv6GrBv6WE6QXpKkYZyuElkl7u3W+/L5UGaz+rAaMYJ1DdQL
78+
XgAdq4KIuh9VR/YsFpttXUz2ieRBm1s2t0otk/sr0zFT23mt22lVVSaHmfCB
79+
X8xCL9z8Y+XlbhPWhoXf8hvKI9KLcpf+e9OiS84+MYq4xJxoESNoq31oYirM
80+
I1g9TNGKXAKrXIv9laeinsIJnn7zhSFu0LWz8XuvjuxPXtPzi9mOh98wIp6H
81+
+AbyNMBwYTQKpOAd8jsD6+2d1gK5WHtwce5cWxgVdo1czCvY
82+
</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://was-preprod1.digid.nl/saml/idp/resolve_artifact" index="0"/><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://preprod1.digid.nl/saml/idp/request_logout"/><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://preprod1.digid.nl/saml/idp/request_authentication"/><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://preprod1.digid.nl/saml/idp/request_authentication"/></md:IDPSSODescriptor></md:EntityDescriptor>

0 commit comments

Comments
 (0)