Merge lp:~roadmr/canonical-identity-provider/saml-extra-attribute-substitutions into lp:canonical-identity-provider/release

[Daniel Manrique]

Add two new substitutions to be used in SAML attribute values.

"displayname" is normally the users' Full Name in SSO.
"email" is the e-mail address.

These enable reporting richer SAML attributes to SPs who can then create nicer-looking
local identities.

Additionally, the existence of the e-mail attribute/substitution might allow
for full compliance with the SAML 8.3 "persistent" policy, though this would
require additional implementation work.

Add two new substitutions to be used in SAML attribute values.

These were requested by Canonical's support group because they need a presentable "full name" to create end-user-visible accounts (and their rationale is that e.g. showing "John Peterson" to a user is fine, but "lordofallthatisunholyandfun" might not be - and the latter is the best we can do currently, since we only support substitutions for "subject" (which is usually the e-mail) and "personname" (which is the username)).

The new substitutions:

"displayname" is the users' Full Name in SSO.
"email" is the e-mail address.

These enable reporting richer SAML attributes to SPs who can then create nicer-looking
local identities.

Additionally, the existence of the e-mail attribute/substitution might allow
for full compliance with the SAML 8.3 "persistent" policy, though this would
require additional implementation work. With a separate substitution for e-mail, we could send a truly persistent identifier as the SAML subject's NameID, like the OpenID; and then, send the e-mail as a custom attribute.

[Maximiliano Bertacchini (maxiberta)]

Looks good to me. +1

review: Approve

=== modified file 'src/ubuntu_sso_saml/processors.py'
--- src/ubuntu_sso_saml/processors.py	2019-01-18 17:46:34 +0000
+++ src/ubuntu_sso_saml/processors.py	2019-01-25 21:10:18 +0000
@@ -461,4 +461,12 @@
                 request = self._django_request
                 attributes[key] = request.build_absolute_uri(
                     request.user.get_absolute_url())
+            elif value == '{{displayname}}':
+                displayname = self._django_request.user.displayname
+                if displayname:
+                    attributes[key] = displayname
+            elif value == '{{email}}':
+                email = self._subject
+                if email:
+                    attributes[key] = email
         return attributes

=== modified file 'src/ubuntu_sso_saml/tests/test_processors.py'
--- src/ubuntu_sso_saml/tests/test_processors.py	2019-01-18 17:46:34 +0000
+++ src/ubuntu_sso_saml/tests/test_processors.py	2019-01-25 21:10:18 +0000
@@ -1799,3 +1799,29 @@
                     '{}</saml:AttributeValue></saml:Attribute>'.format(
                         openid_url))
         self.assertIn(expected, samlresponse)
+
+    def test_email_as_attribute(self):
+        self.setup_saml_sp(attributes=json.dumps({
+            'email-from-attrib': '{{email}}',
+        }))
+        email = self.setup_saml_emails()
+
+        samlresponse = self.do_saml_request()
+        expected = ('<saml:Attribute Name="email-from-attrib">'
+                    '<saml:AttributeValue>'
+                    '{}</saml:AttributeValue></saml:Attribute>'.format(
+                        email))
+        self.assertIn(expected, samlresponse)
+
+    def test_displayname_as_attribute(self):
+        self.setup_saml_sp(attributes=json.dumps({
+            'fullname': '{{displayname}}',
+        }))
+        displayname = self.account.displayname
+
+        samlresponse = self.do_saml_request()
+        expected = ('<saml:Attribute Name="fullname">'
+                    '<saml:AttributeValue>'
+                    '{}</saml:AttributeValue></saml:Attribute>'.format(
+                        displayname))
+        self.assertIn(expected, samlresponse)