inveniosoftware / flask-sso

Flask Single-Sign-On Extension

Flask-SSO

About

Flask-SSO is a Flask extension permitting to set up Shibboleth Single-Sign-On authentication in Flask based web applications.

Installation

Flask-SSO is on PyPI so all you need is: :

pip install Flask-SSO

Documentation

Documentation is readable at http://flask-sso.readthedocs.io or can be built using Sphinx: :

python setup.py build_sphinx

Testing

Running the test suite is as simple as: :

python setup.py test

or, to also test documentation and packaging: :

./run-tests.sh

flask-sso's Issues

Docs need more work

Not to be critical, but I've been trying to get this module to work with my app and my orgs SSO. The docs in here are very minimal and a bit confusing. It would be nice to see an example laid out more thoroughly.

Release version on PyPI

• clean-up documentation
• check AUTHORS list
• update release notes

inveniosoftware/invenio#1797 depends on it

Wrong Doku (typo)?

Hi, when i try to follow the example on http://flask-sso.readthedocs.io/en/latest/#a-minimal-example I get the following error:

@sso.login_handler
NameError: name 'sso' is not defined

As described in the docs i defined

app = Flask(__name__)
...
ext = SSO(app=app)

Shouldn't it be
sso = SSO(app=app)
or
@ext.login_handler

flask_sso.SSOAttributeError

Whenever I run my code the code from the Docs it gives me this:

flask_sso.SSOAttributeError

My code is

from flask import Flask, session, redirect
from flask_sso import SSO
app = Flask(__name__)
sso = SSO(app=app)
SSO_ATTRIBUTE_MAP = {
    'ADFS_AUTHLEVEL': (False, 'authlevel'),
    'ADFS_GROUP': (True, 'group'),
    'ADFS_LOGIN': (True, 'nickname'),
    'ADFS_ROLE': (False, 'role'),
    'ADFS_EMAIL': (True, 'email'),
    'ADFS_IDENTITYCLASS': (False, 'external'),
    'HTTP_SHIB_AUTHENTICATION_METHOD': (False, 'authmethod'),
}

app.config['SSO_ATTRIBUTE_MAP'] = SSO_ATTRIBUTE_MAP
@sso.login_handler
def login_callback(user_info):
    """Store information in session."""
    session['user'] = user_info
@app.route('/')
def index():
    """Display user information or force login."""
    if 'user' in session:
        return 'Welcome {name}'.format(name=session['user']['nickname'])
    return redirect(app.config['SSO_LOGIN_URL'])
app.run(host='0.0.0.0')

Can anyone help?
Thanks in advance.

Docs: Fork me on Github link broken

The 'Fork me on Github' link at http://flask-sso.readthedocs.org/en/latest/ points to http://github.com/%27%27, instead of https://github.com/inveniosoftware/flask-sso. I've just pasted the patch below, but I can make a PR if you would prefer.

diff --git a/docs/conf.py b/docs/conf.py
index 6dadf4b..29a3b2d 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -112,7 +112,8 @@ html_theme = 'flask_small'
 # documentation.
 html_theme_options = {
     'index_logo': False,
-    'index_logo_height': '40px;'
+    'index_logo_height': '40px;',
+       'github_fork': 'inveniosoftware/flask-sso',
 }

 # Add any paths that contain custom themes here, relative to this directory.

flask app running on one server and Identity service running on a different server

I was reading the
http://flask-sso.readthedocs.org/en/latest/#a-minimal-example
and I was wondering if I can use the flask-sso library to restrict access to my own app.

Basically I want to have a login button on my flask app which when clicked redirects the user to a third-party server where the actual username and password is entered then the user is allowed to browse restricted content in the flask app.

login_callback should return and why not add a decorator to the doc

Hi,

in the actual documentation the login_callback does not return, and that seems to cause a lot of problems. While it is ok to just render a template (login_ok) or redirect to '/', a simple decorator could be included in the doc to have a more general case, like:

@sso.login_handler
def login_callback(user_info):
    """Store login information in session."""
    session['user'] = user_info
    return redirect(request.args.get('next_url'))

def sso_required(f):
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if 'user' not in session:
            return redirect(url_for('sso_login', next_url=request.url))
        return f(*args, **kwargs)
    return decorated_function

then you can decorate whatever view function that requires authentication with some added value:

• you do not have to actually check for user auth each time
• you can use session['user'] being certain that it will be available
• you'll be redirected to the url you actually asked for

Example:

@app.route('/secure_location')
@sso_required
def secure_location():
    return render_template('secure_location.html', user=session['user'])

Flask-SSO + LDAP

Is possible to use this extension with LDAP? If yes, there are any docs? Thank you

docs: refresh documentation

The documentation can be refreshed, e.g. there are still CHANGEME parts:

$ git grep -Hni CHANGEME
docs/_templates/sidebarintro.html:3:  <strong>Flask-SSO</strong> is an extension for Flask that CHANGEME
docs/quickstart.rst:24:Flask-SSO also has support for CHANGEME

tests: safer comparison

See Travis CI build failure:

tests/test_ext.py:152: in run
    '{0}'.format(expected_data))
E   AssertionError: "{'baa': None, 'bar': 'foo'}" != "{'bar': 'foo', 'baa': None}"
E   - {'baa': None, 'bar': 'foo'}
E   + {'bar': 'foo', 'baa': None}

https://travis-ci.org/inveniosoftware/flask-sso/jobs/161349044