lp:canonical-identity-provider

Created by Danny Tamez on 2010-04-21 and last modified on 2019-07-05
Get this branch:
bzr branch lp:canonical-identity-provider
Members of Ubuntu One PQM Team can upload to this branch. Log in for directions.

Branch merges

Related bugs

Related blueprints

Branch information

Owner:
Ubuntu One PQM Team
Project:
Canonical SSO provider
Review team:
Ubuntu One hackers
Status:
Development

Recent revisions

1693. By Matias Bordese on 2019-06-25

Updated invalid username error message in account registration/edit form.

Merged from https://code.launchpad.net/~matiasb/canonical-identity-provider/updated-username-error-msg/+merge/369005

1692. By Daniel Manrique on 2019-06-11

Allow generation of gdpr report from the email changelist.

Previously, this was only doable from the account changelist, but the main
search criteria for gdpr requests is email address; so it's cumbersome to first
search for an email address, grab e.g. the openid to do a search in the account
changelist, and then build the gdpr report there.

The tests try not to duplicate things that are already tested in the account
gdpr report tests.

Merged from https://code.launchpad.net/~roadmr/canonical-identity-provider/gdpr-report-from-email/+merge/368565

1689. By Daniel Manrique on 2019-05-10

Show friendly help if we can't find the openid session token from a validation link

The most common reason for that is initiating a login on a third-party site,
creating the account in sso as part of the flow, then clicking on the
activation link on another device or browser.

SO instead of sending people to a terse 404 page which causes them to fume and
come file bugs which end up as dupes of https://pad.lv/1693375, the new (still
a 404-code) page explains what to do and provides a link where they can
validate their e-mail address out of the third-party login flow (which is the
workaround we recommend anyway, after painful back and forth checking the
format of the link they clicked on and referring to the cited bug)

Merged from https://code.launchpad.net/~roadmr/canonical-identity-provider/better-evil-token-instructions/+merge/367285

1687. By Po-Hsu Lin on 2019-05-08

Enable the zh-tw language support for Ubuntu One web UI.

Merged from https://code.launchpad.net/~cypressyew/canonical-identity-provider/canonical-identity-provider/+merge/366307

1686. By Celso Providelo on 2019-04-12

New privileged API for checking username availability.

Merged from https://code.launchpad.net/~cprov/canonical-identity-provider/usernames-api/+merge/365688

1685. By Daniel Manrique on 2019-04-10

SAML: Ensure all dicts used to build assertions contain only utf-8-encoded data.

The SAML library we use assumes use only of ascii inputs and parameters and Python 2 str <-> unicode implicit conversion intricacies. Some of those assumptions are broken by SSO's use of the library and particularly the CanonicalProcessor, which gets a lot of those assertion parameters and attributes from the database; SP config parameters, custom attributes come from Django ORM and are thus unicode, and since the SAML library doesn't do explicit unicode data encoding, it barfs when implicit conversions for unicode data that contains non-ascii characters are attempted, particularly when using the python string.Template classes and base64-encoding the final assertion;these behave predictably badly when given a str template and fed unicode substitution values.

Since the output is expected to be utf8-encoded XML, this MP just ensures all the pieces used by the library to assemble, sign and encode the assertion are sent as utf8-encoded strs rather than unicodes.

This problem was only exposed when we added a new "full name" substitution for SAML attributes: up until now, by some fluke, all the date we fed to the SAML library was ascii-only and so even when we were sending mixed strs and unicodes back and forth, implicit conversion of unicode to str worked fine and the problem went undetected. However, fullnames, unlike URLs and other identifiers, usernames and OpenIDs, understandably can contain non-ascii characters.

Merged from https://code.launchpad.net/~roadmr/canonical-identity-provider/saml-unicode/+merge/365615

Branch metadata

Branch format:
Branch format 7
Repository format:
Bazaar repository format 2a (needs bzr 1.16 or later)
This branch contains Public information 
Everyone can see this information.