authentik.providers.saml.models

  1"""authentik SAML Provider Models"""
  2
  3from uuid import uuid4
  4
  5from django.db import models
  6from django.templatetags.static import static
  7from django.urls import reverse
  8from django.utils.translation import gettext_lazy as _
  9from rest_framework.serializers import Serializer
 10from structlog.stdlib import get_logger
 11
 12from authentik.common.saml.constants import (
 13    DSA_SHA1,
 14    ECDSA_SHA1,
 15    ECDSA_SHA256,
 16    ECDSA_SHA384,
 17    ECDSA_SHA512,
 18    RSA_SHA1,
 19    RSA_SHA256,
 20    RSA_SHA384,
 21    RSA_SHA512,
 22    SHA1,
 23    SHA256,
 24    SHA384,
 25    SHA512,
 26)
 27from authentik.core.api.object_types import CreatableType
 28from authentik.core.models import (
 29    AuthenticatedSession,
 30    ExpiringModel,
 31    PropertyMapping,
 32    Provider,
 33    User,
 34)
 35from authentik.crypto.models import CertificateKeyPair
 36from authentik.lib.models import DomainlessURLValidator, InternallyManagedMixin, SerializerModel
 37from authentik.lib.utils.time import timedelta_string_validator
 38from authentik.sources.saml.models import SAMLNameIDPolicy
 39
 40LOGGER = get_logger()
 41
 42
 43class SAMLBindings(models.TextChoices):
 44    """SAML Bindings supported by authentik"""
 45
 46    REDIRECT = "redirect"
 47    POST = "post"
 48
 49
 50class SAMLLogoutMethods(models.TextChoices):
 51    """SAML Logout methods supported by authentik"""
 52
 53    FRONTCHANNEL_IFRAME = "frontchannel_iframe"
 54    FRONTCHANNEL_NATIVE = "frontchannel_native"
 55    BACKCHANNEL = "backchannel"
 56
 57
 58class SAMLProvider(Provider):
 59    """SAML 2.0 Endpoint for applications which support SAML."""
 60
 61    acs_url = models.TextField(
 62        validators=[DomainlessURLValidator(schemes=("http", "https"))], verbose_name=_("ACS URL")
 63    )
 64    sp_binding = models.TextField(
 65        choices=SAMLBindings.choices,
 66        default=SAMLBindings.REDIRECT,
 67        verbose_name=_("Service Provider Binding"),
 68        help_text=_(
 69            "This determines how authentik sends the response back to the Service Provider."
 70        ),
 71    )
 72    audience = models.TextField(
 73        default="",
 74        blank=True,
 75        help_text=_(
 76            "Value of the audience restriction field of the assertion. When left empty, "
 77            "no audience restriction will be added."
 78        ),
 79    )
 80    issuer = models.TextField(help_text=_("Also known as EntityID"), default="authentik")
 81    sls_url = models.TextField(
 82        blank=True,
 83        validators=[DomainlessURLValidator(schemes=("http", "https"))],
 84        verbose_name=_("SLS URL"),
 85        help_text=_("Single Logout Service URL where the logout response should be sent."),
 86    )
 87    sls_binding = models.TextField(
 88        choices=SAMLBindings.choices,
 89        default=SAMLBindings.REDIRECT,
 90        verbose_name=_("SLS Binding"),
 91        help_text=_(
 92            "This determines how authentik sends the logout response back to the Service Provider."
 93        ),
 94    )
 95    logout_method = models.TextField(
 96        choices=SAMLLogoutMethods.choices,
 97        default=SAMLLogoutMethods.FRONTCHANNEL_IFRAME,
 98        help_text=_(
 99            "Method to use for logout. Front-channel iframe loads all logout URLs simultaneously "
100            "in hidden iframes. Front-channel native uses your active browser tab to send post "
101            "requests and redirect to providers. "
102            "Back-channel sends logout requests directly from the server without "
103            "user interaction (requires POST SLS binding)."
104        ),
105    )
106    name_id_mapping = models.ForeignKey(
107        "SAMLPropertyMapping",
108        default=None,
109        blank=True,
110        null=True,
111        on_delete=models.SET_DEFAULT,
112        verbose_name=_("NameID Property Mapping"),
113        help_text=_(
114            "Configure how the NameID value will be created. When left empty, "
115            "the NameIDPolicy of the incoming request will be considered"
116        ),
117    )
118    authn_context_class_ref_mapping = models.ForeignKey(
119        "SAMLPropertyMapping",
120        default=None,
121        blank=True,
122        null=True,
123        on_delete=models.SET_DEFAULT,
124        verbose_name=_("AuthnContextClassRef Property Mapping"),
125        related_name="+",
126        help_text=_(
127            "Configure how the AuthnContextClassRef value will be created. When left empty, "
128            "the AuthnContextClassRef will be set based on which authentication methods the user "
129            "used to authenticate."
130        ),
131    )
132
133    assertion_valid_not_before = models.TextField(
134        default="minutes=-5",
135        validators=[timedelta_string_validator],
136        help_text=_(
137            "Assertion valid not before current time + this value "
138            "(Format: hours=-1;minutes=-2;seconds=-3)."
139        ),
140    )
141    assertion_valid_not_on_or_after = models.TextField(
142        default="minutes=5",
143        validators=[timedelta_string_validator],
144        help_text=_(
145            "Assertion not valid on or after current time + this value "
146            "(Format: hours=1;minutes=2;seconds=3)."
147        ),
148    )
149
150    session_valid_not_on_or_after = models.TextField(
151        default="minutes=86400",
152        validators=[timedelta_string_validator],
153        help_text=_(
154            "Session not valid on or after current time + this value "
155            "(Format: hours=1;minutes=2;seconds=3)."
156        ),
157    )
158
159    digest_algorithm = models.TextField(
160        choices=(
161            (SHA1, _("SHA1")),
162            (SHA256, _("SHA256")),
163            (SHA384, _("SHA384")),
164            (SHA512, _("SHA512")),
165        ),
166        default=SHA256,
167    )
168    signature_algorithm = models.TextField(
169        choices=(
170            (RSA_SHA1, _("RSA-SHA1")),
171            (RSA_SHA256, _("RSA-SHA256")),
172            (RSA_SHA384, _("RSA-SHA384")),
173            (RSA_SHA512, _("RSA-SHA512")),
174            (ECDSA_SHA1, _("ECDSA-SHA1")),
175            (ECDSA_SHA256, _("ECDSA-SHA256")),
176            (ECDSA_SHA384, _("ECDSA-SHA384")),
177            (ECDSA_SHA512, _("ECDSA-SHA512")),
178            (DSA_SHA1, _("DSA-SHA1")),
179        ),
180        default=RSA_SHA256,
181    )
182
183    verification_kp = models.ForeignKey(
184        CertificateKeyPair,
185        default=None,
186        null=True,
187        blank=True,
188        help_text=_(
189            "When selected, incoming assertion's Signatures will be validated against this "
190            "certificate. To allow unsigned Requests, leave on default."
191        ),
192        on_delete=models.SET_NULL,
193        verbose_name=_("Verification Certificate"),
194        related_name="+",
195    )
196    signing_kp = models.ForeignKey(
197        CertificateKeyPair,
198        default=None,
199        null=True,
200        blank=True,
201        help_text=_("Keypair used to sign outgoing Responses going to the Service Provider."),
202        on_delete=models.SET_NULL,
203        verbose_name=_("Signing Keypair"),
204    )
205    encryption_kp = models.ForeignKey(
206        CertificateKeyPair,
207        default=None,
208        null=True,
209        blank=True,
210        help_text=_(
211            "When selected, incoming assertions are encrypted by the IdP using the public "
212            "key of the encryption keypair. The assertion is decrypted by the SP using the "
213            "the private key."
214        ),
215        on_delete=models.SET_NULL,
216        verbose_name=_("Encryption Keypair"),
217        related_name="+",
218    )
219
220    default_relay_state = models.TextField(
221        default="", blank=True, help_text=_("Default relay_state value for IDP-initiated logins")
222    )
223    default_name_id_policy = models.TextField(
224        choices=SAMLNameIDPolicy.choices, default=SAMLNameIDPolicy.UNSPECIFIED
225    )
226
227    sign_assertion = models.BooleanField(default=True)
228    sign_response = models.BooleanField(default=False)
229    sign_logout_request = models.BooleanField(default=False)
230    sign_logout_response = models.BooleanField(default=False)
231
232    @property
233    def launch_url(self) -> str | None:
234        """Use IDP-Initiated SAML flow as launch URL"""
235        try:
236            return reverse(
237                "authentik_providers_saml:sso-init",
238                kwargs={"application_slug": self.application.slug},
239            )
240        except Provider.application.RelatedObjectDoesNotExist:
241            return None
242
243    @property
244    def icon_url(self) -> str | None:
245        return static("authentik/sources/saml.png")
246
247    @property
248    def serializer(self) -> type[Serializer]:
249        from authentik.providers.saml.api.providers import SAMLProviderSerializer
250
251        return SAMLProviderSerializer
252
253    @property
254    def component(self) -> str:
255        return "ak-provider-saml-form"
256
257    def __str__(self):
258        return f"SAML Provider {self.name}"
259
260    class Meta:
261        verbose_name = _("SAML Provider")
262        verbose_name_plural = _("SAML Providers")
263
264
265class SAMLPropertyMapping(PropertyMapping):
266    """Map User/Group attribute to SAML Attribute, which can be used by the Service Provider"""
267
268    saml_name = models.TextField(verbose_name="SAML Name")
269    friendly_name = models.TextField(default=None, blank=True, null=True)
270
271    @property
272    def component(self) -> str:
273        return "ak-property-mapping-provider-saml-form"
274
275    @property
276    def serializer(self) -> type[Serializer]:
277        from authentik.providers.saml.api.property_mappings import SAMLPropertyMappingSerializer
278
279        return SAMLPropertyMappingSerializer
280
281    def __str__(self):
282        name = self.friendly_name if self.friendly_name != "" else self.saml_name
283        return f"{self.name} ({name})"
284
285    class Meta:
286        verbose_name = _("SAML Provider Property Mapping")
287        verbose_name_plural = _("SAML Provider Property Mappings")
288
289
290class SAMLProviderImportModel(CreatableType, Provider):
291    """Create a SAML Provider by importing its Metadata."""
292
293    @property
294    def component(self):
295        return "ak-provider-saml-import-form"
296
297    @property
298    def icon_url(self) -> str | None:
299        return static("authentik/sources/saml.png")
300
301    class Meta:
302        abstract = True
303        verbose_name = _("SAML Provider from Metadata")
304        verbose_name_plural = _("SAML Providers from Metadata")
305
306
307class SAMLSession(InternallyManagedMixin, SerializerModel, ExpiringModel):
308    """Track active SAML sessions for Single Logout support"""
309
310    saml_session_id = models.UUIDField(default=uuid4, primary_key=True)
311    provider = models.ForeignKey(SAMLProvider, on_delete=models.CASCADE)
312    user = models.ForeignKey(User, verbose_name=_("User"), on_delete=models.CASCADE)
313    session = models.ForeignKey(
314        AuthenticatedSession,
315        on_delete=models.CASCADE,
316        help_text=_("Link to the user's authenticated session"),
317    )
318    session_index = models.TextField(help_text=_("SAML SessionIndex for this session"))
319    name_id = models.TextField(help_text=_("SAML NameID value for this session"))
320    name_id_format = models.TextField(default="", blank=True, help_text=_("SAML NameID format"))
321    created = models.DateTimeField(auto_now_add=True)
322
323    @property
324    def serializer(self) -> type[Serializer]:
325        from authentik.providers.saml.api.sessions import SAMLSessionSerializer
326
327        return SAMLSessionSerializer
328
329    def __str__(self):
330        return f"SAML Session for provider {self.provider_id} and user {self.user_id}"
331
332    class Meta:
333        verbose_name = _("SAML Session")
334        verbose_name_plural = _("SAML Sessions")
335        unique_together = [("session_index", "provider")]
336        indexes = [
337            models.Index(fields=["session_index"]),
338            models.Index(fields=["provider", "user"]),
339            models.Index(fields=["session"]),
340        ]