feat: RBAC + SAML support

saml_auth/models.py

@@ -0,0 +1,72 @@
+from allauth.socialaccount.models import SocialApp
+from django.core.exceptions import ValidationError
+from django.db import models
+
+
+class SAMLConfiguration(models.Model):
+    social_app = models.ForeignKey(SocialApp, on_delete=models.CASCADE, related_name='saml_configurations')
+
+    # URLs
+    sso_url = models.URLField(help_text='Sign-in URL')
+    slo_url = models.URLField(help_text='Sign-out URL')
+    sp_metadata_url = models.URLField(help_text='https://host/saml/metadata')
+    idp_id = models.URLField(help_text='Identity Provider ID')
+
+    # Certificates
+    idp_cert = models.TextField(help_text='x509cert')
+
+    # Attribute Mapping Fields
+    uid = models.CharField(max_length=100, help_text='eg eduPersonPrincipalName')
+    name = models.CharField(max_length=100, blank=True, null=True, help_text='eg displayName')
+    email = models.CharField(max_length=100, blank=True, null=True, help_text='eg mail')
+    groups = models.CharField(max_length=100, blank=True, null=True, help_text='eg isMemberOf')
+    first_name = models.CharField(max_length=100, blank=True, null=True, help_text='eg gn')
+    last_name = models.CharField(max_length=100, blank=True, null=True, help_text='eg sn')
+    user_logo = models.CharField(max_length=100, blank=True, null=True, help_text='eg jpegPhoto')
+    role = models.CharField(max_length=100, blank=True, null=True, help_text='eduPersonPrimaryAffiliation')
+
+    verified_email = models.BooleanField(default=False, help_text='Mark email as verified')
+
+    email_authentication = models.BooleanField(default=False, help_text='Use email authentication too')
+
+    remove_from_groups = models.BooleanField(default=False, help_text='Automatically remove from groups')
+    save_saml_response_logs = models.BooleanField(default=True)
+
+    class Meta:
+        verbose_name = 'SAML Configuration'
+        verbose_name_plural = 'SAML Configurations'
+        unique_together = ['social_app', 'idp_id']
+
+    def __str__(self):
+        return f'SAML Config for {self.social_app.name} - {self.idp_id}'
+
+    def clean(self):
+        existing_conf = SAMLConfiguration.objects.filter(social_app=self.social_app)
+
+        if self.pk:
+            existing_conf = existing_conf.exclude(pk=self.pk)
+
+        if existing_conf.exists():
+            raise ValidationError({'social_app': 'Cannot create configuration for the same social app because one configuration already exists.'})
+
+        super().clean()
+
+    @property
+    def saml_provider_settings(self):
+        # provide settings in a way for Social App SAML provider
+        provider_settings = {}
+        provider_settings["sp"] = {"entity_id": self.sp_metadata_url}
+        provider_settings["idp"] = {"slo_url": self.slo_url, "sso_url": self.sso_url, "x509cert": self.idp_cert, "entity_id": self.idp_id}
+
+        provider_settings["attribute_mapping"] = {
+            "uid": self.uid,
+            "name": self.name,
+            "role": self.role,
+            "email": self.email,
+            "groups": self.groups,
+            "first_name": self.first_name,
+            "last_name": self.last_name,
+        }
+        provider_settings["email_verified"] = self.verified_email
+        provider_settings["email_authentication"] = self.email_authentication
+        return provider_settings