{% trans "Level of Assurance" %}
+ +
+ {% if messages %}
+ {% for message in messages %}
+
+ {% endfor %}
+ {% endif %}
+
+
+
+{% endblock content %}
+
+{% block bottom_js %}
+
+{% endblock %}
diff --git a/admin/translations/django.pot b/admin/translations/django.pot
index 8202c292ede..bf8d8dec6ad 100644
--- a/admin/translations/django.pot
+++ b/admin/translations/django.pot
@@ -3947,3 +3947,18 @@ msgstr ""
msgid "No@encrypt_uploads"
msgstr ""
+
+msgid "LoA update successful."
+msgstr ""
+
+msgid "Show"
+msgstr ""
+
+msgid "Hide"
+msgstr ""
+
+msgid "Level of Assurance"
+msgstr ""
+
+msgid "Display MFA link button"
+msgstr ""
diff --git a/admin/translations/en/LC_MESSAGES/django.po b/admin/translations/en/LC_MESSAGES/django.po
index 08b8647a759..21c548340ee 100644
--- a/admin/translations/en/LC_MESSAGES/django.po
+++ b/admin/translations/en/LC_MESSAGES/django.po
@@ -3999,3 +3999,18 @@ msgstr "Yes"
msgid "No@encrypt_uploads"
msgstr "No"
+
+msgid "LoA update successful."
+msgstr ""
+
+msgid "Show"
+msgstr ""
+
+msgid "Hide"
+msgstr ""
+
+msgid "Level of Assurance"
+msgstr ""
+
+msgid "Display MFA link button"
+msgstr ""
diff --git a/admin/translations/ja/LC_MESSAGES/django.po b/admin/translations/ja/LC_MESSAGES/django.po
index 9b4e9d51af5..4e10fa749a8 100644
--- a/admin/translations/ja/LC_MESSAGES/django.po
+++ b/admin/translations/ja/LC_MESSAGES/django.po
@@ -4390,4 +4390,19 @@ msgstr "関連するすべてのワークフローテンプレートとワーク
#: admin/templates/rdm_workflow/engine_list.html:196
msgid "If there are running workflow processes, deletion will fail."
-msgstr "実行中のワークフロープロセスがある場合、エラーになります。"
\ No newline at end of file
+msgstr "実行中のワークフロープロセスがある場合、エラーになります。"
+
+msgid "LoA update successful."
+msgstr "LoAの更新に成功しました。"
+
+msgid "Show"
+msgstr "表示する"
+
+msgid "Hide"
+msgstr "表示しない"
+
+msgid "Level of Assurance"
+msgstr "要求する保証レベルの設定"
+
+msgid "Display MFA link button"
+msgstr "多要素認証実行ボタンの表示"
diff --git a/admin_tests/loa/__init__.py b/admin_tests/loa/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/admin_tests/loa/test_forms.py b/admin_tests/loa/test_forms.py
new file mode 100644
index 00000000000..ac73e8cdc47
--- /dev/null
+++ b/admin_tests/loa/test_forms.py
@@ -0,0 +1,82 @@
+# -*- coding: utf-8 -*-
+"""Tests for admin.loa.forms.LoAForm."""
+import pytest
+
+from admin.loa.forms import LoAForm
+from osf.models.loa import LoA
+from osf_tests.factories import InstitutionFactory, AuthUserFactory
+
+pytestmark = pytest.mark.django_db
+
+
+class TestLoAForm:
+ """Tests for LoAForm."""
+
+ def test_form_fields(self):
+ form = LoAForm()
+ assert 'aal' in form.fields
+ assert 'ial' in form.fields
+ assert 'is_mfa' in form.fields
+
+ def test_form_valid_with_all_fields(self):
+ form = LoAForm(data={'aal': '2', 'ial': '2', 'is_mfa': 'True'})
+ assert form.is_valid(), form.errors
+
+ def test_form_valid_with_zero_values(self):
+ """aal=0 and ial=0 represent the NULL choice."""
+ form = LoAForm(data={'aal': '0', 'ial': '0', 'is_mfa': 'False'})
+ assert form.is_valid(), form.errors
+
+ def test_form_valid_with_empty_fields(self):
+ """All fields are not required, so empty strings should be accepted."""
+ form = LoAForm(data={'aal': '', 'ial': '', 'is_mfa': ''})
+ assert form.is_valid(), form.errors
+
+ def test_form_aal_choices(self):
+ form = LoAForm()
+ aal_values = [c[0] for c in form.fields['aal'].choices]
+ assert 0 in aal_values
+ assert 1 in aal_values
+ assert 2 in aal_values
+
+ def test_form_ial_choices(self):
+ form = LoAForm()
+ ial_values = [c[0] for c in form.fields['ial'].choices]
+ assert 0 in ial_values
+ assert 1 in ial_values
+ assert 2 in ial_values
+
+ def test_form_is_mfa_choices(self):
+ form = LoAForm()
+ mfa_values = [c[0] for c in form.fields['is_mfa'].choices]
+ assert False in mfa_values
+ assert True in mfa_values
+
+ def test_form_widget_css_class(self):
+ """All field widgets should have 'form-control form-control-sm' CSS class."""
+ form = LoAForm()
+ for field in form.fields.values():
+ assert 'form-control form-control-sm' in field.widget.attrs.get('class', '')
+
+ def test_form_with_instance(self):
+ """Form should populate correctly from an existing LoA instance."""
+ institution = InstitutionFactory()
+ modifier = AuthUserFactory()
+ loa = LoA.objects.create(
+ institution=institution, aal=2, ial=1, is_mfa=True, modifier=modifier,
+ )
+ form = LoAForm(instance=loa)
+ assert form.initial['aal'] == 2
+ assert form.initial['ial'] == 1
+ assert form.initial['is_mfa'] is True
+
+ def test_form_meta_model(self):
+ assert LoAForm.Meta.model is LoA
+
+ def test_form_meta_fields(self):
+ assert LoAForm.Meta.fields == ('aal', 'ial', 'is_mfa')
+
+ def test_form_invalid_aal_choice(self):
+ form = LoAForm(data={'aal': '99', 'ial': '1', 'is_mfa': 'False'})
+ assert not form.is_valid()
+ assert 'aal' in form.errors
diff --git a/admin_tests/loa/test_views.py b/admin_tests/loa/test_views.py
new file mode 100644
index 00000000000..5695ab32d4d
--- /dev/null
+++ b/admin_tests/loa/test_views.py
@@ -0,0 +1,399 @@
+# -*- coding: utf-8 -*-
+"""Tests for admin.loa.views (ListLoA and BulkAddLoA)."""
+from urllib.parse import urlencode
+
+import pytest
+from django.contrib.auth.models import AnonymousUser
+from django.contrib.messages.storage.fallback import FallbackStorage
+from django.core.exceptions import PermissionDenied
+from django.http import Http404
+from django.test import RequestFactory
+from django.urls import reverse
+
+from admin.loa import views
+from admin_tests.utilities import setup_user_view
+from osf.models.loa import LoA
+from osf_tests.factories import AuthUserFactory, InstitutionFactory
+from tests.base import AdminTestCase
+
+pytestmark = pytest.mark.django_db
+
+
+class TestListLoA(AdminTestCase):
+ """Tests for ListLoA view."""
+
+ def setUp(self):
+ super(TestListLoA, self).setUp()
+
+ self.institution01 = InstitutionFactory(name='inst01')
+ self.institution02 = InstitutionFactory(name='inst02')
+
+ # Anonymous user
+ self.anon = AnonymousUser()
+
+ # Superuser
+ self.superuser = AuthUserFactory(fullname='superuser')
+ self.superuser.is_superuser = True
+ self.superuser.is_staff = True
+ self.superuser.save()
+
+ # Institutional admin for institution01
+ self.inst01_admin = AuthUserFactory(fullname='admin_inst01')
+ self.inst01_admin.is_staff = True
+ self.inst01_admin.affiliated_institutions.add(self.institution01)
+ self.inst01_admin.save()
+
+ # Institutional admin for institution02
+ self.inst02_admin = AuthUserFactory(fullname='admin_inst02')
+ self.inst02_admin.is_staff = True
+ self.inst02_admin.affiliated_institutions.add(self.institution02)
+ self.inst02_admin.save()
+
+ # Normal user (no staff, no superuser)
+ self.normal_user = AuthUserFactory(fullname='normal_user')
+ self.normal_user.is_staff = False
+ self.normal_user.is_superuser = False
+ self.normal_user.save()
+
+ # --- dispatch tests ---
+
+ def test_dispatch_unauthenticated_user(self):
+ request = RequestFactory().get('/fake_path')
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.anon)
+ with pytest.raises(PermissionDenied):
+ view.dispatch(request)
+
+ def test_dispatch_invalid_institution_id(self):
+ request = RequestFactory().get('/fake_path', {'institution_id': 'abc'})
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ # render_bad_request_response requires 400.html template;
+ # verify that the ValueError is caught and a bad-request path is taken.
+ from django.template.exceptions import TemplateDoesNotExist
+ with pytest.raises((TemplateDoesNotExist, ValueError)):
+ view.dispatch(request)
+
+ def test_dispatch_valid_institution_id(self):
+ request = RequestFactory().get(
+ '/fake_path', {'institution_id': str(self.institution01.id)}
+ )
+ request.user = self.superuser
+ view = views.ListLoA()
+ view.request = request
+ view.args = ()
+ view.kwargs = {}
+ response = view.dispatch(request)
+ assert response.status_code == 200
+
+ # --- test_func tests ---
+
+ def test_test_func_superuser_without_institution_id(self):
+ request = RequestFactory().get('/fake_path')
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ view.institution_id = None
+ assert view.test_func() is True
+
+ def test_test_func_institutional_admin_without_institution_id(self):
+ request = RequestFactory().get('/fake_path')
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.inst01_admin)
+ view.institution_id = None
+ assert view.test_func() is True
+
+ def test_test_func_normal_user_without_institution_id(self):
+ request = RequestFactory().get('/fake_path')
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.normal_user)
+ view.institution_id = None
+ assert view.test_func() is False
+
+ def test_test_func_superuser_with_valid_institution_id(self):
+ request = RequestFactory().get('/fake_path')
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ view.institution_id = self.institution01.id
+ assert view.test_func() is True
+
+ def test_test_func_institutional_admin_own_institution(self):
+ request = RequestFactory().get('/fake_path')
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.inst01_admin)
+ view.institution_id = self.institution01.id
+ assert view.test_func() is True
+
+ def test_test_func_institutional_admin_other_institution(self):
+ request = RequestFactory().get('/fake_path')
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.inst01_admin)
+ view.institution_id = self.institution02.id
+ assert view.test_func() is False
+
+ def test_test_func_nonexistent_institution_id(self):
+ request = RequestFactory().get('/fake_path')
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ view.institution_id = 99999
+ with pytest.raises(Http404):
+ view.test_func()
+
+ # --- get_context_data tests ---
+
+ def test_get_context_data_superuser(self):
+ modifier = self.superuser
+ LoA.objects.create(
+ institution=self.institution01, aal=2, ial=1, is_mfa=True, modifier=modifier,
+ )
+
+ request = RequestFactory().get(
+ '/fake_path', {'institution_id': str(self.institution01.id)}
+ )
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ view.kwargs = {}
+ view.institution_id = self.institution01.id
+
+ ctx = view.get_context_data()
+ assert 'institutions' in ctx
+ assert 'institution_id' in ctx
+ assert 'formset_loa' in ctx
+ assert ctx['institution_id'] == self.institution01.id
+
+ def test_get_context_data_institutional_admin(self):
+ request = RequestFactory().get(
+ '/fake_path', {'institution_id': str(self.institution01.id)}
+ )
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.inst01_admin)
+ view.kwargs = {}
+ view.institution_id = self.institution01.id
+
+ ctx = view.get_context_data()
+ # Institutional admin should only see their own institution(s)
+ institution_ids = [inst.id for inst in ctx['institutions']]
+ assert self.institution01.id in institution_ids
+ assert self.institution02.id not in institution_ids
+
+ def test_get_context_data_superuser_sees_all_institutions(self):
+ request = RequestFactory().get(
+ '/fake_path', {'institution_id': str(self.institution01.id)}
+ )
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ view.kwargs = {}
+ view.institution_id = self.institution01.id
+
+ ctx = view.get_context_data()
+ institution_ids = [inst.id for inst in ctx['institutions']]
+ assert self.institution01.id in institution_ids
+ assert self.institution02.id in institution_ids
+
+ def test_get_context_data_permission_denied_for_non_admin(self):
+ request = RequestFactory().get(
+ '/fake_path', {'institution_id': str(self.institution01.id)}
+ )
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.normal_user)
+ view.kwargs = {}
+ view.institution_id = self.institution01.id
+
+ with pytest.raises(PermissionDenied):
+ view.get_context_data()
+
+ def test_get_context_data_no_existing_loa(self):
+ """When no LoA exists for the institution, formset_loa should be unbound."""
+ request = RequestFactory().get(
+ '/fake_path', {'institution_id': str(self.institution01.id)}
+ )
+ view = views.ListLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ view.kwargs = {}
+ view.institution_id = self.institution01.id
+
+ ctx = view.get_context_data()
+ assert ctx['formset_loa'] is not None
+
+
+class TestBulkAddLoA(AdminTestCase):
+ """Tests for BulkAddLoA view."""
+
+ def setUp(self):
+ super(TestBulkAddLoA, self).setUp()
+
+ self.institution01 = InstitutionFactory(name='inst01')
+ self.institution02 = InstitutionFactory(name='inst02')
+
+ # Anonymous user
+ self.anon = AnonymousUser()
+
+ # Superuser
+ self.superuser = AuthUserFactory(fullname='superuser')
+ self.superuser.is_superuser = True
+ self.superuser.is_staff = True
+ self.superuser.save()
+
+ # Institutional admin for institution01
+ self.inst01_admin = AuthUserFactory(fullname='admin_inst01')
+ self.inst01_admin.is_staff = True
+ self.inst01_admin.affiliated_institutions.add(self.institution01)
+ self.inst01_admin.save()
+
+ self.view = views.BulkAddLoA.as_view()
+
+ # --- dispatch tests ---
+
+ def test_dispatch_unauthenticated(self):
+ request = RequestFactory().post(
+ reverse('loa:bulk_add'),
+ {'institution_id': self.institution01.id, 'aal': '1', 'ial': '1', 'is_mfa': 'False'},
+ )
+ view = views.BulkAddLoA()
+ view = setup_user_view(view, request, user=self.anon)
+ with pytest.raises(PermissionDenied):
+ view.dispatch(request)
+
+ def test_dispatch_missing_institution_id(self):
+ request = RequestFactory().post(
+ reverse('loa:bulk_add'),
+ {'aal': '1', 'ial': '1', 'is_mfa': 'False'},
+ )
+ view = views.BulkAddLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ from django.template.exceptions import TemplateDoesNotExist
+ with pytest.raises((TemplateDoesNotExist, ValueError)):
+ view.dispatch(request)
+
+ def test_dispatch_invalid_institution_id(self):
+ request = RequestFactory().post(
+ reverse('loa:bulk_add'),
+ {'institution_id': 'abc', 'aal': '1', 'ial': '1', 'is_mfa': 'False'},
+ )
+ view = views.BulkAddLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ from django.template.exceptions import TemplateDoesNotExist
+ with pytest.raises((TemplateDoesNotExist, ValueError)):
+ view.dispatch(request)
+
+ # --- test_func tests ---
+
+ def test_test_func_superuser(self):
+ request = RequestFactory().post('/fake_path')
+ view = views.BulkAddLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ view.institution_id = self.institution01.id
+ assert view.test_func() is True
+
+ def test_test_func_institutional_admin_own_institution(self):
+ request = RequestFactory().post('/fake_path')
+ view = views.BulkAddLoA()
+ view = setup_user_view(view, request, user=self.inst01_admin)
+ view.institution_id = self.institution01.id
+ assert view.test_func() is True
+
+ def test_test_func_institutional_admin_other_institution(self):
+ request = RequestFactory().post('/fake_path')
+ view = views.BulkAddLoA()
+ view = setup_user_view(view, request, user=self.inst01_admin)
+ view.institution_id = self.institution02.id
+ assert view.test_func() is False
+
+ def test_test_func_nonexistent_institution(self):
+ request = RequestFactory().post('/fake_path')
+ view = views.BulkAddLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ view.institution_id = 99999
+ with pytest.raises(Http404):
+ view.test_func()
+
+ def test_test_func_deleted_institution(self):
+ deleted_inst = InstitutionFactory(name='deleted_inst')
+ deleted_inst.is_deleted = True
+ deleted_inst.save()
+ request = RequestFactory().post('/fake_path')
+ view = views.BulkAddLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ view.institution_id = deleted_inst.id
+ with pytest.raises(Http404):
+ view.test_func()
+
+ # --- post tests ---
+
+ def test_post_creates_new_loa(self):
+ request = RequestFactory().post(
+ reverse('loa:bulk_add'),
+ {
+ 'institution_id': str(self.institution01.id),
+ 'aal': '2',
+ 'ial': '1',
+ 'is_mfa': 'True',
+ },
+ )
+ request.user = self.superuser
+ setattr(request, 'session', 'session')
+ setattr(request, '_messages', FallbackStorage(request))
+
+ # Manually invoke the post method
+ view = views.BulkAddLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ view.institution_id = self.institution01.id
+ response = view.post(request)
+
+ assert response.status_code == 302
+ loa = LoA.objects.get(institution_id=self.institution01.id)
+ assert loa.aal == 2
+ assert loa.ial == 1
+ assert loa.modifier == self.superuser
+
+ def test_post_updates_existing_loa(self):
+ # Create initial LoA
+ LoA.objects.create(
+ institution=self.institution01, aal=1, ial=0, is_mfa=False,
+ modifier=self.superuser,
+ )
+ request = RequestFactory().post(
+ reverse('loa:bulk_add'),
+ {
+ 'institution_id': str(self.institution01.id),
+ 'aal': '2',
+ 'ial': '2',
+ 'is_mfa': 'True',
+ },
+ )
+ request.user = self.inst01_admin
+ setattr(request, 'session', 'session')
+ setattr(request, '_messages', FallbackStorage(request))
+
+ view = views.BulkAddLoA()
+ view = setup_user_view(view, request, user=self.inst01_admin)
+ view.institution_id = self.institution01.id
+ response = view.post(request)
+
+ assert response.status_code == 302
+ loa = LoA.objects.get(institution_id=self.institution01.id)
+ assert loa.aal == 2
+ assert loa.ial == 2
+ assert loa.modifier == self.inst01_admin
+
+ def test_post_redirect_url_contains_institution_id(self):
+ request = RequestFactory().post(
+ reverse('loa:bulk_add'),
+ {
+ 'institution_id': str(self.institution01.id),
+ 'aal': '1',
+ 'ial': '1',
+ 'is_mfa': 'False',
+ },
+ )
+ request.user = self.superuser
+ setattr(request, 'session', 'session')
+ setattr(request, '_messages', FallbackStorage(request))
+
+ view = views.BulkAddLoA()
+ view = setup_user_view(view, request, user=self.superuser)
+ view.institution_id = self.institution01.id
+ response = view.post(request)
+
+ assert response.status_code == 302
+ expected_query = urlencode({'institution_id': str(self.institution01.id)})
+ assert expected_query in response.url
diff --git a/api/institutions/authentication.py b/api/institutions/authentication.py
index d5904970197..6106901baa0 100644
--- a/api/institutions/authentication.py
+++ b/api/institutions/authentication.py
@@ -9,9 +9,13 @@
from osf.models.mapcore_user_group import MapCoreUserGroup
import waffle
+# @R2022-48 loa
+import re
+from urllib.parse import urlencode
+
#from django.utils import timezone
from rest_framework.authentication import BaseAuthentication
-from rest_framework.exceptions import AuthenticationFailed
+from rest_framework.exceptions import AuthenticationFailed, ValidationError
from api.base.authentication import drf
from api.base import exceptions, settings
@@ -21,20 +25,29 @@
from framework.auth.core import get_user
from osf import features
-from osf.models import Institution, UserExtendedData
+from osf.models import Institution, UserExtendedData, LoA
from osf.exceptions import BlacklistedEmailError
from website.mails import send_mail, WELCOME_OSF4I
-from website.settings import OSF_SUPPORT_EMAIL, DOMAIN, to_bool
+from website.settings import (
+ OSF_SUPPORT_EMAIL,
+ DOMAIN,
+ to_bool,
+ CAS_SERVER_URL,
+ OSF_MFA_URL,
+ OSF_IAL2_STR,
+ OSF_AAL1_STR,
+ OSF_AAL2_STR,
+ OSF_IAL2_VAR,
+ OSF_AAL1_VAR,
+ OSF_AAL2_VAR,
+)
from website.util.quota import update_default_storage
+from future.moves.urllib.parse import urljoin
from django_bulk_update.helper import bulk_update
from django.utils import timezone
logger = logging.getLogger(__name__)
-
-import logging
-logger = logging.getLogger(__name__)
-
NEW_USER_NO_NAME = 'New User (no name)'
def send_welcome(user, request):
@@ -212,6 +225,78 @@ def get_next(obj, *args):
'gakuninIdentityAssuranceMethodReference',
)
+ # @R2022-48 ial,aal
+ ial = None
+ aal = None
+ # @R-2024-AUTH01 eduPersonAssurance(multi value)
+ eduPersonAssurance = p_user.get('eduPersonAssurance')
+ if re.search(OSF_IAL2_STR, str(eduPersonAssurance)):
+ ial = OSF_IAL2_VAR
+ if re.search(OSF_AAL2_STR, str(eduPersonAssurance)):
+ aal = OSF_AAL2_VAR
+ elif re.search(OSF_AAL1_STR, str(eduPersonAssurance)):
+ aal = OSF_AAL1_VAR
+ else:
+ aal = p_user.get('Shib-AuthnContext-Class')
+
+ # @R2022-48 loa + R-2023-55
+ message = ''
+ mfa_url = ''
+ mfa_url_tmp = ''
+ if type(p_idp) is str:
+ profile_url = urljoin(DOMAIN, '/profile/')
+
+ login_url = CAS_SERVER_URL + '/login?' + urlencode({
+ 'service': profile_url,
+ })
+
+ mfa_url_tmp = OSF_MFA_URL + '?' + urlencode({
+ 'entityID': p_idp,
+ 'target': login_url,
+ })
+
+ loa_flag = True
+ loa = LoA.objects.get_or_none(institution_id=institution.id)
+ if loa:
+ if loa.aal == 2:
+ if not re.search(OSF_AAL2_STR, str(aal)):
+ if mfa_url_tmp:
+ mfa_url = mfa_url_tmp
+ else:
+ # MFA URL cannot be generated (e.g. p_idp is not a string).
+ # Without MFA redirect, allowing login would silently bypass
+ # the AAL2 requirement — reject the login instead.
+ message = (
+ 'Institution login failed: Does not meet the required AAL.'
+ '
+ {% if request.session.message %}
+
+
+ {{ request.session.message }}
+
+ {% endif %}
+ MFA redirect is not available for this institution.' + ) + loa_flag = False + elif loa.aal == 1: + if not aal: + message = ( + 'Institution login failed: Does not meet the required AAL.
Please contact the IdP as the' + ' appropriate value may not have been sent out by the IdP.' + ) + loa_flag = False + if loa.ial == 2: + if not re.search(OSF_IAL2_STR, str(ial)): + message = ( + 'Institution login failed: Does not meet the required IAL.
Please check the IAL of your' + ' institution.' + ) + loa_flag = False + elif loa.ial == 1: + if not ial: + message = ( + 'Institution login failed: Does not meet the required IAL.
Please check the IAL of your' + ' institution.' + ) + loa_flag = False + if not loa_flag: + message = 'Institution login failed: Does not meet the required AAL and IAL.' + sentry.log_message(message) + raise ValidationError(message) + # Use given name and family name to build full name if it is not provided if given_name and family_name and not fullname: fullname = given_name + ' ' + family_name @@ -341,6 +426,14 @@ def get_next(obj, *args): user.department = department user.save() + # @R-2023-55. + if ial and user.ial != ial: + user.ial = ial + user.save() + if aal and user.aal != aal: + user.aal = aal + user.save() + # Both created and activated accounts need to be updated and registered if created or activation_required: @@ -430,6 +523,7 @@ def get_next(obj, *args): # update every login. ext.set_idp_attr( { + 'id': institution.id, # @R-2023-55 'idp': p_idp, 'eppn': eppn, 'username': username, @@ -473,6 +567,10 @@ def get_next(obj, *args): init_cloud_gateway_groups(user, provider) update_mapcore_groups(user, provider) + # R-2023-55 for MFA + logger.info('MFA URL "{}"'.format(mfa_url)) + user.context = {'mfa_url': mfa_url} + return user, None def login_by_eppn(): diff --git a/api/institutions/views.py b/api/institutions/views.py index dcc8cefb53b..391f8632b82 100644 --- a/api/institutions/views.py +++ b/api/institutions/views.py @@ -198,7 +198,7 @@ class InstitutionAuth(JSONAPIBaseView, generics.CreateAPIView): view_name = 'institution-auth' def post(self, request, *args, **kwargs): - return Response(status=status.HTTP_204_NO_CONTENT) + return Response(request.user.context, status=status.HTTP_200_OK) class InstitutionRegistrationList(InstitutionNodeList): diff --git a/api_tests/institutions/views/test_institution_auth.py b/api_tests/institutions/views/test_institution_auth.py index 0b1192c6bf0..ad51c4062ee 100644 --- a/api_tests/institutions/views/test_institution_auth.py +++ b/api_tests/institutions/views/test_institution_auth.py @@ -117,7 +117,7 @@ def test_new_user_created(self, app, url_auth_institution, institution): with capture_signals() as mock_signals: res = app.post(url_auth_institution, make_payload(institution, username)) - assert res.status_code == 204 + assert res.status_code == 200 assert mock_signals.signals_sent() == set([signals.user_confirmed]) user = OSFUser.objects.filter(username=username).first() @@ -134,7 +134,7 @@ def test_existing_user_found_but_not_affiliated(self, app, institution, url_auth with capture_signals() as mock_signals: res = app.post(url_auth_institution, make_payload(institution, username)) - assert res.status_code == 204 + assert res.status_code == 200 assert not mock_signals.signals_sent() user.reload() @@ -150,7 +150,7 @@ def test_user_found_and_affiliated(self, app, institution, url_auth_institution) with capture_signals() as mock_signals: res = app.post(url_auth_institution, make_payload(institution, username)) - assert res.status_code == 204 + assert res.status_code == 200 assert not mock_signals.signals_sent() user.reload() @@ -174,8 +174,7 @@ def test_new_user_names_guessed_if_not_provided(self, app, institution, url_auth username = 'user_created_with_fullname_only@osf.edu' res = app.post(url_auth_institution, make_payload(institution, username)) - assert res.status_code == 204 - + assert res.status_code == 200 user = OSFUser.objects.filter(username=username).first() assert user assert user.fullname == 'Fake User' @@ -190,8 +189,7 @@ def test_new_user_names_used_when_provided(self, app, institution, url_auth_inst url_auth_institution, make_payload(institution, username, given_name='Foo', family_name='Bar') ) - assert res.status_code == 204 - + assert res.status_code == 200 user = OSFUser.objects.filter(username=username).first() assert user assert user.fullname == 'Fake User' @@ -218,7 +216,7 @@ def test_user_active(self, app, institution, url_auth_institution): department='Fake Department', ) ) - assert res.status_code == 204 + assert res.status_code == 200 assert not mock_signals.signals_sent() user = OSFUser.objects.filter(username=username).first() @@ -257,7 +255,7 @@ def test_user_unclaimed(self, app, institution, url_auth_institution): department='Fake Department', ) ) - assert res.status_code == 204 + assert res.status_code == 200 assert mock_signals.signals_sent() == set([signals.user_confirmed]) user = OSFUser.objects.filter(username=username).first() @@ -292,7 +290,7 @@ def test_user_unconfirmed(self, app, institution, url_auth_institution): fullname='Fake User' ) ) - assert res.status_code == 204 + assert res.status_code == 200 assert mock_signals.signals_sent() == set([signals.user_confirmed]) user = OSFUser.objects.filter(username=username).first() @@ -414,8 +412,7 @@ def test_authenticate_jaSurname_and_jaGivenName_are_valid( jaGivenName=jagivenname, jaSurname=jasurname), expect_errors=True ) - assert res.status_code == 204 - + assert res.status_code == 200 user = OSFUser.objects.filter(username=username).first() assert user assert user.ext.data['idp_attr']['fullname_ja'] == jagivenname + ' ' + jasurname @@ -429,7 +426,7 @@ def test_authenticate_jaGivenName_is_valid( make_payload(institution, username, jaGivenName=jagivenname), expect_errors=True ) - assert res.status_code == 204 + assert res.status_code == 200 user = OSFUser.objects.filter(username=username).first() assert user assert user.given_name_ja == jagivenname @@ -443,7 +440,7 @@ def test_authenticate_jaSurname_is_valid( make_payload(institution, username, jaSurname=jasurname), expect_errors=True ) - assert res.status_code == 204 + assert res.status_code == 200 user = OSFUser.objects.filter(username=username).first() assert user assert user.family_name_ja == jasurname @@ -457,7 +454,7 @@ def test_authenticate_jaMiddleNames_is_valid( make_payload(institution, username, jaMiddleNames=middlename), expect_errors=True ) - assert res.status_code == 204 + assert res.status_code == 200 user = OSFUser.objects.filter(username=username).first() assert user assert user.middle_names_ja == middlename @@ -471,7 +468,7 @@ def test_authenticate_givenname_is_valid( make_payload(institution, username, given_name=given_name), expect_errors=True ) - assert res.status_code == 204 + assert res.status_code == 200 user = OSFUser.objects.filter(username=username).first() assert user assert user.given_name == given_name @@ -485,7 +482,7 @@ def test_authenticate_familyname_is_valid( make_payload(institution, username, family_name=family_name), expect_errors=True ) - assert res.status_code == 204 + assert res.status_code == 200 user = OSFUser.objects.filter(username=username).first() assert user assert user.family_name == family_name @@ -499,7 +496,7 @@ def test_authenticate_middlename_is_valid( make_payload(institution, username, middle_names=middle_names), expect_errors=True ) - assert res.status_code == 204 + assert res.status_code == 200 user = OSFUser.objects.filter(username=username).first() assert user assert user.middle_names == middle_names @@ -518,7 +515,7 @@ def test_authenticate_jaOrganizationalUnitName_is_valid( organizationName=organizationname), expect_errors=True ) - assert res.status_code == 204 + assert res.status_code == 200 user = OSFUser.objects.filter(username='tmp_eppn_' + username).first() assert user assert user.jobs[0]['department_ja'] == jaorganizationname @@ -537,7 +534,7 @@ def test_authenticate_OrganizationalUnitName_is_valid( organizationName=organizationname), expect_errors=True ) - assert res.status_code == 204 + assert res.status_code == 200 user = OSFUser.objects.filter(username='tmp_eppn_' + username).first() assert user assert user.jobs[0]['department'] == organizationnameunit @@ -572,7 +569,7 @@ def test_with_new_attribute(self, mock, app, institution, url_auth_institution): gakunin_identity_assurance_method_reference=gakunin_identity_assurance_method_reference,) ) - assert res.status_code == 204 + assert res.status_code == 200 user = OSFUser.objects.filter(username='tmp_eppn_' + username).first() assert user diff --git a/api_tests/institutions/views/test_institution_auth_loa.py b/api_tests/institutions/views/test_institution_auth_loa.py new file mode 100644 index 00000000000..f1cfea4310a --- /dev/null +++ b/api_tests/institutions/views/test_institution_auth_loa.py @@ -0,0 +1,581 @@ +# -*- coding: utf-8 -*- +"""Tests for LoA (Level of Assurance) validation in institution authentication. + +Covers: + - IAL / AAL extraction from eduPersonAssurance + - LoA validation logic (AAL2 required → MFA redirect, AAL1 required → ValidationError, IAL checks) + - MFA URL construction with urlencode() + - user.context containing mfa_url in response + - ValidationError raised when LoA requirements are not met + - user.ial / user.aal are persisted after successful authentication +""" +import json + +import jwe +import jwt +import mock +import pytest + +from api.base import settings +from api.base.settings.defaults import API_BASE + +from osf.models import OSFUser +from osf.models.loa import LoA +from osf_tests.factories import InstitutionFactory, UserFactory +from website.settings import ( + OSF_AAL2_VAR, + OSF_AAL1_VAR, + OSF_IAL2_VAR, +) + +def make_user(username, fullname): + return UserFactory(username=username, fullname=fullname) + + +def make_payload( + institution, + username, + fullname='Fake User', + given_name='', + family_name='', + middle_names='', + department='', + edu_person_assurance='', + shib_authn_context_class='', + idp=None, + **extra_user_fields, +): + """Build a JWE/JWT payload for institution auth. + + Accepts ``edu_person_assurance`` and ``shib_authn_context_class`` + as explicit keyword arguments so that LoA-related tests can easily + set them. Any additional user fields can be passed via **extra_user_fields. + + ``idp`` can be set to a string (e.g. an entityID URL) to make the + authentication code treat the IdP value as a string, which is required + for MFA URL generation (``type(p_idp) is str`` check). When *None* + the default ``institution.email_domains`` (a list) is used. + """ + user_dict = { + 'middleNames': middle_names, + 'familyName': family_name, + 'givenName': given_name, + 'fullname': fullname, + 'suffix': '', + 'username': username, + 'department': department, + 'eduPersonAssurance': edu_person_assurance, + 'Shib-AuthnContext-Class': shib_authn_context_class, + # defaults for other fields expected by authentication + 'jaGivenName': '', + 'jaSurname': '', + 'jaDisplayName': '', + 'jaFullname': '', + 'jaMiddleNames': '', + 'jaOrganizationalUnitName': '', + 'organizationalUnitName': '', + 'organizationName': '', + 'eduPersonAffiliation': '', + 'eduPersonScopedAffiliation': '', + 'eduPersonTargetedID': '', + 'eduPersonUniqueId': '', + 'eduPersonOrcid': '', + 'isMemberOf': '', + 'gakuninScopedPersonalUniqueCode': '', + 'gakuninIdentityAssuranceOrganization': '', + 'gakuninIdentityAssuranceMethodReference': '', + } + user_dict.update(extra_user_fields) + + data = { + 'provider': { + 'idp': idp if idp is not None else institution.email_domains, + 'id': institution._id, + 'user': user_dict, + } + } + + return jwe.encrypt( + jwt.encode( + { + 'sub': username, + 'data': json.dumps(data), + }, + settings.JWT_SECRET, + algorithm='HS256', + ), + settings.JWE_SECRET, + ) + + +@pytest.mark.django_db +class TestInstitutionAuthLoA: + """Tests for LoA validation during institution authentication.""" + + @pytest.fixture() + def institution(self): + return InstitutionFactory() + + @pytest.fixture() + def url_auth_institution(self): + return '/{0}institutions/auth/'.format(API_BASE) + + @pytest.fixture() + def app(self): + from tests.json_api_test_app import JSONAPITestApp + return JSONAPITestApp() + + # --------------------------------------------------------------- + # IAL / AAL extraction from eduPersonAssurance + # --------------------------------------------------------------- + + def test_aal2_extracted_from_edu_person_assurance( + self, app, institution, url_auth_institution, + ): + """When eduPersonAssurance contains AAL2 URL, user.aal should be set.""" + username = 'user_aal2@inst.edu' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='https://www.gakunin.jp/profile/AAL2', + ), + ) + assert res.status_code == 200 + user = OSFUser.objects.get(username=username) + assert user.aal == OSF_AAL2_VAR + + def test_aal1_extracted_from_edu_person_assurance( + self, app, institution, url_auth_institution, + ): + username = 'user_aal1@inst.edu' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='https://www.gakunin.jp/profile/AAL1', + ), + ) + assert res.status_code == 200 + user = OSFUser.objects.get(username=username) + assert user.aal == OSF_AAL1_VAR + + def test_ial2_extracted_from_edu_person_assurance( + self, app, institution, url_auth_institution, + ): + username = 'user_ial2@inst.edu' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='https://www.gakunin.jp/profile/IAL2', + ), + ) + assert res.status_code == 200 + user = OSFUser.objects.get(username=username) + assert user.ial == OSF_IAL2_VAR + + def test_aal_falls_back_to_shib_authn_context_class( + self, app, institution, url_auth_institution, + ): + """When eduPersonAssurance has no AAL, Shib-AuthnContext-Class is used.""" + username = 'user_shib@inst.edu' + shib_value = 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='', + shib_authn_context_class=shib_value, + ), + ) + assert res.status_code == 200 + user = OSFUser.objects.get(username=username) + assert user.aal == shib_value + + def test_both_aal2_and_ial2_in_edu_person_assurance( + self, app, institution, url_auth_institution, + ): + """Multi-value eduPersonAssurance containing both AAL2 and IAL2.""" + username = 'user_both@inst.edu' + combined = ( + 'https://www.gakunin.jp/profile/AAL2;' + 'https://www.gakunin.jp/profile/IAL2' + ) + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance=combined, + ), + ) + assert res.status_code == 200 + user = OSFUser.objects.get(username=username) + assert user.aal == OSF_AAL2_VAR + assert user.ial == OSF_IAL2_VAR + + # --------------------------------------------------------------- + # LoA validation — no LoA record → pass through + # --------------------------------------------------------------- + + def test_no_loa_record_allows_login( + self, app, institution, url_auth_institution, + ): + """If no LoA is configured for the institution, login should succeed.""" + username = 'user_noloa@inst.edu' + res = app.post( + url_auth_institution, + make_payload(institution, username), + ) + assert res.status_code == 200 + + # --------------------------------------------------------------- + # LoA validation — AAL2 required + # --------------------------------------------------------------- + + def test_aal2_required_user_has_aal2_passes( + self, app, institution, url_auth_institution, + ): + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=2, ial=0, is_mfa=True, modifier=modifier, + ) + username = 'user_aal2_ok@inst.edu' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='https://www.gakunin.jp/profile/AAL2', + ), + ) + assert res.status_code == 200 + # mfa_url should be empty because AAL2 requirement is met + assert res.json.get('mfa_url', '') == '' + + @mock.patch('api.institutions.authentication.OSF_MFA_URL', 'https://mfa.example.com/ds') + def test_aal2_required_user_has_aal1_returns_mfa_url( + self, app, institution, url_auth_institution, + ): + """When AAL2 is required but user only has AAL1, mfa_url should be set.""" + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=2, ial=0, is_mfa=True, modifier=modifier, + ) + username = 'user_aal2_fail@inst.edu' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='https://www.gakunin.jp/profile/AAL1', + idp='https://idp.example.ac.jp', + ), + ) + assert res.status_code == 200 + mfa_url = res.json.get('mfa_url', '') + assert mfa_url != '' + # MFA URL should contain expected components + assert 'entityID=' in mfa_url or 'entityID' in mfa_url + + @mock.patch('api.institutions.authentication.OSF_MFA_URL', 'https://mfa.example.com/ds') + def test_aal2_required_user_has_no_aal_returns_mfa_url( + self, app, institution, url_auth_institution, + ): + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=2, ial=0, is_mfa=True, modifier=modifier, + ) + username = 'user_aal2_none@inst.edu' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + idp='https://idp.example.ac.jp', + ), + ) + assert res.status_code == 200 + mfa_url = res.json.get('mfa_url', '') + assert mfa_url != '' + + # --------------------------------------------------------------- + # LoA validation — AAL2 required but MFA URL unavailable + # --------------------------------------------------------------- + + def test_aal2_required_no_mfa_url_available_raises_error( + self, app, institution, url_auth_institution, + ): + """AAL2 required, AAL2 not met, and p_idp is a list (not str) so + mfa_url_tmp is empty. Login must be rejected instead of silently + bypassing the AAL2 requirement. + """ + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=2, ial=0, is_mfa=True, modifier=modifier, + ) + username = 'user_aal2_no_mfa@inst.edu' + # idp is NOT passed, so institution.email_domains (a list) is used. + # type(p_idp) is str -> False -> mfa_url_tmp remains empty. + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='https://www.gakunin.jp/profile/AAL1', + ), + expect_errors=True, + ) + assert res.status_code == 400 + + def test_aal2_required_no_aal_no_mfa_url_available_raises_error( + self, app, institution, url_auth_institution, + ): + """AAL2 required, no AAL at all, p_idp is a list -> must be rejected.""" + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=2, ial=0, is_mfa=True, modifier=modifier, + ) + username = 'user_aal2_no_mfa_none@inst.edu' + res = app.post( + url_auth_institution, + make_payload(institution, username), + expect_errors=True, + ) + assert res.status_code == 400 + + def test_aal2_required_user_has_aal2_passes_regardless_of_idp_type( + self, app, institution, url_auth_institution, + ): + """AAL2 required and met - login should pass even if p_idp is a list.""" + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=2, ial=0, is_mfa=True, modifier=modifier, + ) + username = 'user_aal2_ok_list_idp@inst.edu' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='https://www.gakunin.jp/profile/AAL2', + ), + ) + assert res.status_code == 200 + + # --------------------------------------------------------------- + # LoA validation — AAL1 required + # --------------------------------------------------------------- + + def test_aal1_required_user_has_aal1_passes( + self, app, institution, url_auth_institution, + ): + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=1, ial=0, modifier=modifier, + ) + username = 'user_aal1_ok@inst.edu' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='https://www.gakunin.jp/profile/AAL1', + ), + ) + assert res.status_code == 200 + + def test_aal1_required_user_has_no_aal_raises_error( + self, app, institution, url_auth_institution, + ): + """AAL1 required but no AAL provided → ValidationError (400).""" + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=1, ial=0, modifier=modifier, + ) + username = 'user_aal1_fail@inst.edu' + res = app.post( + url_auth_institution, + make_payload(institution, username), + expect_errors=True, + ) + assert res.status_code == 400 + + # --------------------------------------------------------------- + # LoA validation — IAL2 required + # --------------------------------------------------------------- + + def test_ial2_required_user_has_ial2_passes( + self, app, institution, url_auth_institution, + ): + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=0, ial=2, modifier=modifier, + ) + username = 'user_ial2_ok@inst.edu' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='https://www.gakunin.jp/profile/IAL2', + ), + ) + assert res.status_code == 200 + + def test_ial2_required_user_has_no_ial_raises_error( + self, app, institution, url_auth_institution, + ): + """IAL2 required but IAL2 not provided → ValidationError (400).""" + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=0, ial=2, modifier=modifier, + ) + username = 'user_ial2_fail@inst.edu' + res = app.post( + url_auth_institution, + make_payload(institution, username), + expect_errors=True, + ) + assert res.status_code == 400 + + # --------------------------------------------------------------- + # LoA validation — IAL1 required + # --------------------------------------------------------------- + + def test_ial1_required_user_has_ial_passes( + self, app, institution, url_auth_institution, + ): + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=0, ial=1, modifier=modifier, + ) + username = 'user_ial1_ok@inst.edu' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='https://www.gakunin.jp/profile/IAL2', + ), + ) + assert res.status_code == 200 + + def test_ial1_required_user_has_no_ial_raises_error( + self, app, institution, url_auth_institution, + ): + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=0, ial=1, modifier=modifier, + ) + username = 'user_ial1_fail@inst.edu' + res = app.post( + url_auth_institution, + make_payload(institution, username), + expect_errors=True, + ) + assert res.status_code == 400 + + # --------------------------------------------------------------- + # Combined AAL + IAL requirements + # --------------------------------------------------------------- + + def test_both_aal2_and_ial2_required_both_met( + self, app, institution, url_auth_institution, + ): + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=2, ial=2, is_mfa=True, modifier=modifier, + ) + username = 'user_combo_ok@inst.edu' + combined = ( + 'https://www.gakunin.jp/profile/AAL2;' + 'https://www.gakunin.jp/profile/IAL2' + ) + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance=combined, + ), + ) + assert res.status_code == 200 + assert res.json.get('mfa_url', '') == '' + + def test_aal2_met_but_ial2_not_met_raises_error( + self, app, institution, url_auth_institution, + ): + """AAL2 met + IAL2 not met → ValidationError (IAL check is independent).""" + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=2, ial=2, is_mfa=True, modifier=modifier, + ) + username = 'user_combo_ial_fail@inst.edu' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='https://www.gakunin.jp/profile/AAL2', + ), + expect_errors=True, + ) + assert res.status_code == 400 + + # --------------------------------------------------------------- + # Response contains mfa_url in user.context + # --------------------------------------------------------------- + + def test_response_body_contains_mfa_url_key( + self, app, institution, url_auth_institution, + ): + """InstitutionAuth.post() returns request.user.context with mfa_url.""" + username = 'user_ctx@inst.edu' + res = app.post( + url_auth_institution, + make_payload(institution, username), + ) + assert res.status_code == 200 + assert 'mfa_url' in res.json + + # --------------------------------------------------------------- + # MFA URL structure validation + # --------------------------------------------------------------- + + @mock.patch('api.institutions.authentication.OSF_MFA_URL', 'https://mfa.example.com/ds') + @mock.patch('api.institutions.authentication.CAS_SERVER_URL', 'https://cas.example.com') + @mock.patch('api.institutions.authentication.DOMAIN', 'https://osf.example.com/') + def test_mfa_url_structure( + self, app, institution, url_auth_institution, + ): + """Verify MFA URL is constructed correctly with urlencode.""" + modifier = UserFactory() + LoA.objects.create( + institution=institution, aal=2, ial=0, is_mfa=True, modifier=modifier, + ) + username = 'user_mfa_url@inst.edu' + res = app.post( + url_auth_institution, + make_payload( + institution, username, + edu_person_assurance='https://www.gakunin.jp/profile/AAL1', + idp='https://idp.example.ac.jp', + ), + ) + assert res.status_code == 200 + mfa_url = res.json.get('mfa_url', '') + assert mfa_url != '' + # MFA URL should start with OSF_MFA_URL (after urlencode wrapping via CAS logout) + # The overall structure: OSF_MFA_URL?entityID=...&target=CAS/login?service=profile + assert 'mfa.example.com' in mfa_url or 'cas.example.com' in mfa_url + + # --------------------------------------------------------------- + # idp_attr stores institution.id + # --------------------------------------------------------------- + + def test_idp_attr_stores_institution_id( + self, app, institution, url_auth_institution, + ): + """ext.set_idp_attr should include institution.id under key 'id'.""" + from osf.models import UserExtendedData + + username = 'user_idp_id@inst.edu' + res = app.post( + url_auth_institution, + make_payload(institution, username), + ) + assert res.status_code == 200 + user = OSFUser.objects.get(username=username) + ext = UserExtendedData.objects.get(user=user) + assert ext.data.get('idp_attr', {}).get('id') == institution.id diff --git a/osf/migrations/0265_r_2025_23_55789.py b/osf/migrations/0265_r_2025_23_55789.py new file mode 100644 index 00000000000..f01009afb6a --- /dev/null +++ b/osf/migrations/0265_r_2025_23_55789.py @@ -0,0 +1,22 @@ +# -*- coding: utf-8 -*- +from __future__ import unicode_literals +from django.db import migrations, models + + +class Migration(migrations.Migration): + dependencies = [ + ('osf', '0264_merge_20260218_0749'), + ] + + operations = [ + migrations.AddField( + model_name='osfuser', + name='aal', + field=models.CharField(blank=True, max_length=255, null=True), + ), + migrations.AddField( + model_name='osfuser', + name='ial', + field=models.CharField(blank=True, max_length=255, null=True), + ), + ] diff --git a/osf/migrations/0266_r_2025_23_55789.py b/osf/migrations/0266_r_2025_23_55789.py new file mode 100644 index 00000000000..a374b5d3332 --- /dev/null +++ b/osf/migrations/0266_r_2025_23_55789.py @@ -0,0 +1,88 @@ +# -*- coding: utf-8 -*- +from __future__ import unicode_literals + +from django.conf import settings +from django.db import migrations, models +import django.db.models.deletion +import django_extensions.db.fields +import osf.models.base + + +class Migration(migrations.Migration): + dependencies = [ + ('osf', '0265_r_2025_23_55789'), + ] + + operations = [ + migrations.CreateModel( + name='LoA', + fields=[ + ( + 'id', + models.AutoField( + auto_created=True, + primary_key=True, + serialize=False, + verbose_name='ID', + ), + ), + ( + 'created', + django_extensions.db.fields.CreationDateTimeField( + auto_now_add=True, verbose_name='created' + ), + ), + ( + 'modified', + django_extensions.db.fields.ModificationDateTimeField( + auto_now=True, verbose_name='modified' + ), + ), + ( + 'aal', + models.IntegerField( + blank=True, + choices=[(0, 'NULL'), (1, 'AAL1'), (2, 'AAL2')], + null=True, + ), + ), + ( + 'ial', + models.IntegerField( + blank=True, + choices=[(0, 'NULL'), (1, 'IAL1'), (2, 'IAL2')], + null=True, + ), + ), + ( + 'is_mfa', + models.BooleanField( + choices=[(False, 'Disabled'), (True, 'Enabled')], + default=False, + verbose_name='Display MFA link button', + ), + ), + ( + 'institution', + models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, + to='osf.Institution', + ), + ), + ( + 'modifier', + models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, + to=settings.AUTH_USER_MODEL, + ), + ), + ], + options={ + 'permissions': ( + ('view_loa', 'Can view loa'), + ('admin_loa', 'Can manage loa'), + ), + }, + bases=(models.Model, osf.models.base.QuerySetExplainMixin), + ), + ] diff --git a/osf/models/__init__.py b/osf/models/__init__.py index c86fc3973ad..36b22471194 100644 --- a/osf/models/__init__.py +++ b/osf/models/__init__.py @@ -72,4 +72,5 @@ from osf.models.project_limit_number_template_attribute import ProjectLimitNumberTemplateAttribute # noqa from osf.models.project_limit_number_setting import ProjectLimitNumberSetting # noqa from osf.models.project_limit_number_setting_attribute import ProjectLimitNumberSettingAttribute # noqa +from osf.models.loa import LoA # noqa from osf.models.mapcore_group import MapCoreGroup # noqa diff --git a/osf/models/loa.py b/osf/models/loa.py new file mode 100644 index 00000000000..8b0977fdc5e --- /dev/null +++ b/osf/models/loa.py @@ -0,0 +1,59 @@ +from django.db import models +from osf.models import base +from django.utils.translation import ugettext_lazy as _ +import logging + +logger = logging.getLogger(__name__) + + +class BaseManager(models.Manager): + def get_or_none(self, **kwargs): + try: + return self.get_queryset().get(**kwargs) + except self.model.DoesNotExist: + return None + + +class LoA(base.BaseModel): + objects = BaseManager() + institution = models.ForeignKey('Institution', on_delete=models.CASCADE) + aal = models.IntegerField( + choices=( + (0, 'NULL'), + (1, 'AAL1'), + (2, 'AAL2'), + ), + blank=True, + null=True, + ) + ial = models.IntegerField( + choices=( + (0, 'NULL'), + (1, 'IAL1'), + (2, 'IAL2'), + ), + blank=True, + null=True, + ) + is_mfa = models.BooleanField( + _('Display MFA link button'), + choices=( + (False, 'Disabled'), + (True, 'Enabled'), + ), + default=False, + ) + modifier = models.ForeignKey('OSFUser', on_delete=models.CASCADE) + + class Meta: + permissions = ( + ('view_loa', 'Can view loa'), + ('admin_loa', 'Can manage loa'), + ) + + def __init__(self, *args, **kwargs): + kwargs.pop('node', None) + super(LoA, self).__init__(*args, **kwargs) + + def __unicode__(self): + return u'institution_{}:{}:{}:{}'.format(self.institution._id, self.aal, self.ial, self.is_mfa) diff --git a/osf/models/user.py b/osf/models/user.py index abfb708a247..ebf83761fff 100644 --- a/osf/models/user.py +++ b/osf/models/user.py @@ -472,6 +472,10 @@ class OSFUser(DirtyFieldsMixin, GuidMixin, BaseModel, AbstractBaseUser, Permissi mapcore_api_locked = models.BooleanField(default=False) mapcore_refresh_locked = models.BooleanField(default=False) + # @R2022-48 eduPersonAssurance(ial) and AuthnContextClass(aal) from Shibboleth + ial = models.CharField(blank=True, max_length=255, null=True) + aal = models.CharField(blank=True, max_length=255, null=True) + def __repr__(self): return '
${profile['activity_points'] or _("No")} ${ngettext('activity point', 'activity points', profile['activity_points'])}
${profile["number_projects"]} ${_("project")}${ngettext(' ', 's', profile["number_projects"])}
@@ -73,6 +91,7 @@
${_("Usage of storage")}
${profile['quota']['rate']}%, ${profile['quota']['used']} / ${profile['quota']['max']}[GB]
+ % endif
diff --git a/website/translations/en/LC_MESSAGES/messages.po b/website/translations/en/LC_MESSAGES/messages.po
index 7f2084820e1..bd5a26a1afc 100644
--- a/website/translations/en/LC_MESSAGES/messages.po
+++ b/website/translations/en/LC_MESSAGES/messages.po
@@ -4082,6 +4082,18 @@ msgstr ""
msgid "If you do not have an email address registered, please enter or add your email address in the \"Registered email address\" entry field first."
msgstr ""
+#: website/templates/profile.mako:70
+msgid "IAL"
+msgstr ""
+
+#: website/templates/profile.mako:74
+msgid "AuthnContext-Class"
+msgstr ""
+
+#: website/templates/profile.mako:80
+msgid "Log in again using multi-factor authentication"
+msgstr ""
+
#: website/templates/util/render_addon_widget.mako
msgid "Available workflows"
msgstr ""
diff --git a/website/translations/ja/LC_MESSAGES/messages.po b/website/translations/ja/LC_MESSAGES/messages.po
index fe3c9a10b93..9bdfd8cc8f4 100644
--- a/website/translations/ja/LC_MESSAGES/messages.po
+++ b/website/translations/ja/LC_MESSAGES/messages.po
@@ -4443,6 +4443,18 @@ msgstr "%(summaryTitle)sのフォークを作成"
msgid "Manage Contributors"
msgstr "メンバー管理"
+#: website/templates/profile.mako:70
+msgid "IAL"
+msgstr ""
+
+#: website/templates/profile.mako:74
+msgid "AuthnContext-Class"
+msgstr ""
+
+#: website/templates/profile.mako:80
+msgid "Log in again using multi-factor authentication"
+msgstr "多要素認証で再ログインする"
+
#~ msgid ""
#~ "Because you have not configured the "
#~ "{addon} add-on, your authentication will"
diff --git a/website/translations/messages.pot b/website/translations/messages.pot
index dd4b7bcd503..fea0d185005 100644
--- a/website/translations/messages.pot
+++ b/website/translations/messages.pot
@@ -4347,6 +4347,18 @@ msgstr ""
msgid "Manage Contributors"
msgstr ""
+#: website/templates/profile.mako:70
+msgid "IAL"
+msgstr ""
+
+#: website/templates/profile.mako:74
+msgid "AuthnContext-Class"
+msgstr ""
+
+#: website/templates/profile.mako:80
+msgid "Log in again using multi-factor authentication"
+msgstr ""
+
#: website/templates/util/render_addon_widget.mako
msgid "Available workflows"
msgstr ""