Merge lp:~canonical-isd-hackers/canonical-identity-provider/auto_authorize_teams into lp:~canonical-isd-hackers/canonical-identity-provider/stable

[Anthony Lenton]

Make server report team membership to RPs that have auto_authorize=True, when the user signs in as part of the OpenID dance.

SSO was failing to report team membership to RPs that have auto_authorize=True, if the user signs in as part of the OpenID dance.

This branch fixes the issue in two lines, and adds a unittest and functional test to keep it from breaking again.

[Ricardo Kirkner (ricardokirkner)]

LGTM

review: Approve

=== added file 'identityprovider/tests/functional/openid_/per_version/test_openid_teams_auto_authorize.py'
--- identityprovider/tests/functional/openid_/per_version/test_openid_teams_auto_authorize.py	1970-01-01 00:00:00 +0000
+++ identityprovider/tests/functional/openid_/per_version/test_openid_teams_auto_authorize.py	2011-07-22 20:53:26 +0000
@@ -0,0 +1,58 @@
+from openid.consumer.consumer import Consumer
+from openid.store.memstore import MemoryStore
+from openid.consumer.discover import OPENID_2_0_TYPE as PROTOCOL_URI
+
+from identityprovider.const import LAUNCHPAD_TEAMS_NS
+from identityprovider.models import OpenIDRPConfig
+
+from ...openidhelpers import complete_from_browser, make_endpoint
+from ...helpers import FunctionalTestCase
+
+
+class OpenIDTeamsAutoAuthorizeTestCase(FunctionalTestCase):
+
+    def test(self):
+        # = Interaction of Launchpad OpenID Teams with Auto-Authorize =
+        # Check that teams work well when requested by an auto-authorized RP.
+        OpenIDRPConfig.objects.all().delete()
+        rpconfig = self.create_openid_rp_config(
+            trust_root='http://launchpad.dev/',
+            displayname='Test RP', description='A test RP',
+            auto_authorize=True, can_query_any_team=True)
+
+        # First we'll set up the OpenID consumer:
+        openid_store = MemoryStore()
+        consumer = Consumer(session={}, store=openid_store)
+
+        # Now perform an OpenID authentication request, querying membership in
+        # four team names:
+        #  * one that the user is a member of and is public
+        #  * one that the user is a member of, but is private
+        #  * one that does not exist
+        #  * one that does exist but the user is not a member of
+
+        endpoint = make_endpoint(
+            PROTOCOL_URI, 'http://openid.launchpad.dev/+id/cCGE3LA')
+        request = consumer.beginWithoutDiscovery(endpoint)
+
+        request.message.namespaces.addAlias(LAUNCHPAD_TEAMS_NS, 'lp')
+        request.addExtensionArg(
+            LAUNCHPAD_TEAMS_NS, 'query_membership',
+            'ubuntu-team,no-such-team,launchpad-beta-testers,myteam')
+
+        self.browser.open(request.redirectURL(
+            'http://launchpad.dev/', 'http://launchpad.dev/+openid-consumer'))
+        self.browser.getControl(name='email').value = '[e-mail]'
+        self.browser.getControl(name='password').value = 'test'
+        self.browser.getControl(name='continue').click()
+
+        self.assertUrl('http://launchpad.dev/\+openid-consumer\?.*?')
+
+        info = complete_from_browser(consumer, self.browser)
+
+        self.assertEquals(info.status, 'success')
+        self.assertEquals(info.getSigned(LAUNCHPAD_TEAMS_NS, 'is_member'),
+                          'ubuntu-team,myteam')
+
+        # The response reveals that the user is a member of the ubuntu-team,
+        # and myteam as it's allowed to query private teams too.

=== modified file 'identityprovider/tests/test_views_server.py'
--- identityprovider/tests/test_views_server.py	2011-07-19 14:33:08 +0000
+++ identityprovider/tests/test_views_server.py	2011-07-22 20:53:26 +0000
@@ -390,6 +390,25 @@
         self.assertEqual(r.status_code, 200)
         self.assertTemplateUsed(r, 'decide.html')
 
+    def test_decide_team_membership_with_auto_authorize(self):
+        # make sure rpconfig is set to auto authorize
+        self.client.login(username='[e-mail]',
+                          password='test')
+
+        rpconfig = OpenIDRPConfig(trust_root='http://localhost/',
+                                  auto_authorize=True)
+        rpconfig.save()
+
+        param_overrides = {
+            'openid.lp.query_membership': 'ubuntu-team',
+        }
+        self._prepare_openid_token(param_overrides=param_overrides)
+        r = self.client.post("/%s/+decide" % self.token)
+        query = self.get_query(r)
+        self.assertEqual(r.status_code, 302)
+        self.assertEqual(query['openid.mode'], 'id_res')
+        self.assertEqual(query['openid.lp.is_member'], 'ubuntu-team')
+
     def test_check_team_membership_multiple_openidrpsummary(self):
         # create multiple matching OpenIDRPSummary objects
         account = Account.objects.get_by_email(self.login_email)

=== modified file 'identityprovider/views/server.py'
--- identityprovider/views/server.py	2011-07-19 14:33:08 +0000
+++ identityprovider/views/server.py	2011-07-22 20:53:26 +0000
@@ -151,7 +151,8 @@
             else:
                 oresponse = orequest.answer(True)
             _add_sreg(request, orequest, oresponse)
-            _check_team_membership(request, orequest, oresponse)
+            _check_team_membership(request, orequest, oresponse,
+                immediate=True)
             response = _django_response(request, oresponse, True)
         else:
             oresponse = orequest.answer(False)
@@ -171,7 +172,7 @@
         else:
             oresponse = orequest.answer(True)
         _add_sreg(request, orequest, oresponse)
-        _check_team_membership(request, orequest, oresponse)
+        _check_team_membership(request, orequest, oresponse, immediate=True)
         response = _django_response(request, oresponse, True)
     elif (request.user.is_authenticated() and not
           _is_identity_owner(request.user, orequest)):
@@ -226,7 +227,7 @@
     if request.user.is_authenticated():
         if 'yes' in request.POST or (rpconfig is not None
             and rpconfig.auto_authorize):
-            return _process_decide(request, orequest, True)
+            return _process_decide(request, orequest, decision=True)
         else:
             sreg_request = SRegRequest.fromOpenIDRequest(orequest)
             teams_request = TeamsRequest.fromOpenIDRequest(orequest)
@@ -348,7 +349,7 @@
     except:
         return HttpResponse("Invalid OpenID transaction")
     if request.user.is_authenticated():
-        return _process_decide(request, orequest, False)
+        return _process_decide(request, orequest, decision=False)
     else:
         oresponse = orequest.answer(False, settings.SSO_PROVIDER_URL)
         response = _django_response(request, oresponse)
@@ -552,7 +553,11 @@
             datetime.now(),
             request.session.session_key)
         _add_sreg(request, orequest, oresponse)
-        _check_team_membership(request, orequest, oresponse, False)
+        # if there's no submitted POST data, this is an auto-authorized
+        # (immediate) request
+        immediate = not request.POST
+        _check_team_membership(request, orequest, oresponse,
+            immediate=immediate)
     r = _django_response(request, oresponse, decision, orequest)
     if r.content:
         # Only user-visible content is generated from this view.  Wrap