Many improvements

hkijwt/migrations/0001_initial.py

@@ -0,0 +1,23 @@
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from django.db import models, migrations
+from django.conf import settings
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        migrations.swappable_dependency(settings.OAUTH2_PROVIDER_APPLICATION_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='AppToAppPermission',
+            fields=[
+                ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)),
+                ('requester', models.ForeignKey(related_name='+', to=settings.OAUTH2_PROVIDER_APPLICATION_MODEL)),
+                ('target', models.ForeignKey(related_name='+', to=settings.OAUTH2_PROVIDER_APPLICATION_MODEL)),
+            ],
+        ),
+    ]

hkijwt/models.py

@@ -0,0 +1,7 @@
+from django.db import models
+from oauth2_provider.models import Application
+
+
+class AppToAppPermission(models.Model):
+    requester = models.ForeignKey(Application, db_index=True, related_name='+')
+    target = models.ForeignKey(Application, db_index=True, related_name='+')

hkisaml/api.py

@@ -1,9 +1,16 @@
+import logging
 import jwt
+import datetime
 
 from django.contrib.auth import get_user_model
 from rest_framework import permissions, serializers, generics, mixins, views
 from rest_framework.response import Response
+from rest_framework.exceptions import PermissionDenied
 from oauth2_provider.ext.rest_framework import TokenHasReadWriteScope
+from oauth2_provider.models import get_application_model
+from hkijwt.models import AppToAppPermission
+
+logger = logging.getLogger(__name__)
 
 
 class UserSerializer(serializers.ModelSerializer):
@@ -46,11 +53,35 @@ def get_object(self):
 
 
 class GetJWTView(views.APIView):
-    # permission_classes = [permissions.IsAuthenticated, TokenHasReadWriteScope]
+    permission_classes = [permissions.IsAuthenticated, TokenHasReadWriteScope]
+
     def get(self, request, format=None):
-        secret = '12345'
-        user = get_user_model().objects.first()
+        requester_app = request.auth.application
+        target_app = request.QUERY_PARAMS.get('target_app', '').strip()
+        if target_app:
+            qs = get_application_model().objects.all()
+            target_app = generics.get_object_or_404(qs, client_id=target_app)
+            try:
+                perm = AppToAppPermission.objects.get(requester=requester_app,
+                                                      target=target_app)
+            except AppToAppPermission.DoesNotExist:
+                raise PermissionDenied()
+        else:
+            target_app = requester_app
+
+        secret = target_app.client_secret
+        user = request.user
+
         payload = UserSerializer(user).data
+        delete_fields = ['last_login', 'date_joined', 'uuid']
+        for field in delete_fields:
+            if field in payload:
+                del payload[field]
+
+        payload['iss'] = 'https://api.hel.fi/sso'  # FIXME: Make configurable
+        payload['sub'] = str(user.uuid)
+        payload['aud'] = target_app.client_id
+        payload['exp'] = datetime.datetime.utcnow() + datetime.timedelta(minutes=60)
         encoded = jwt.encode(payload, secret, algorithm='HS256')
         return Response({'token': encoded})
 

hkisaml/settings.py

@@ -35,10 +35,15 @@
     'django.contrib.sessions',
     'django.contrib.messages',
     'django.contrib.staticfiles',
+    'rest_framework',
     'djangosaml2',
     'oauth2_provider',
     'corsheaders',
-    'hkiprofile',
+
+    'helusers',
+
+    'hkijwt',
+    'users',
 )
 
 MIDDLEWARE_CLASSES = (
@@ -87,7 +92,7 @@
 
 LOGIN_URL = '/sso/saml2/login/'
 SESSION_EXPIRE_AT_BROWSER_CLOSE = True
-AUTH_USER_MODEL = 'hkiprofile.User'
+AUTH_USER_MODEL = 'users.User'
 
 # Static files (CSS, JavaScript, Images)
 # https://docs.djangoproject.com/en/1.7/howto/static-files/
@@ -187,9 +192,9 @@
         'contact_type': 'technical'
     }],
     # you can set multilanguage information here
-    #'organization': {
+    # 'organization': {
     #    'name': [('City of Helsinki', 'en'), ('Helsingin kaupunki', 'fi')],
-    #},
+    # },
     'valid_for': 24,  # how long is our metadata valid
 }
 
@@ -210,12 +215,12 @@
             'level': 'DEBUG',
             'class': 'django.utils.log.NullHandler',
         },
-        'console':{
+        'console': {
             'level': 'DEBUG',
             'class': 'logging.StreamHandler',
             'formatter': 'simple'
         },
-    },   
+    },
     'loggers': {
         'django': {
             'handlers': ['console'],
@@ -249,6 +254,11 @@
 
 CORS_ORIGIN_ALLOW_ALL = True
 
+OAUTH2_PROVIDER_APPLICATION_MODEL = 'oauth2_provider.Application'
+OAUTH2_PROVIDER = {
+    'CLIENT_SECRET_GENERATOR_LENGTH': 96,
+}
+
 REST_FRAMEWORK = {
     'DEFAULT_AUTHENTICATION_CLASSES': (
         'oauth2_provider.ext.rest_framework.OAuth2Authentication',

requirements.txt

@@ -4,3 +4,4 @@ django-oauth-toolkit
 django-cors-headers
 djangorestframework
 pyjwt
+git+https://github.com/City-of-Helsinki/django-helusers.git#egg=django-helusers

users/admin.py

@@ -0,0 +1,3 @@
+from django.contrib import admin
+
+# Register your models here.

hkiprofile/migrations/0001_initial.py → users/migrations/0001_initial.py

@@ -35,8 +35,6 @@ class Migration(migrations.Migration):
             ],
             options={
                 'abstract': False,
-                'verbose_name': 'user',
-                'verbose_name_plural': 'users',
             },
             managers=[
                 ('objects', django.contrib.auth.models.UserManager()),

users/models.py

@@ -0,0 +1,12 @@
+import uuid
+from django.db import models
+from helusers.models import AbstractUser
+
+
+class User(AbstractUser):
+    primary_sid = models.CharField(max_length=100, unique=True)
+
+    def save(self, *args, **kwargs):
+        if not self.primary_sid:
+            self.primary_sid = uuid.uuid4()
+        return super(User, self).save(*args, **kwargs)

users/tests.py

@@ -0,0 +1,3 @@
+from django.test import TestCase
+
+# Create your tests here.

users/views.py

@@ -0,0 +1,3 @@
+from django.shortcuts import render
+
+# Create your views here.