diff --git a/modules/weko-accounts/weko_accounts/config.py b/modules/weko-accounts/weko_accounts/config.py index 2ef0e50c68..5d96ed331f 100644 --- a/modules/weko-accounts/weko_accounts/config.py +++ b/modules/weko-accounts/weko_accounts/config.py @@ -58,7 +58,7 @@ WEKO_ACCOUNTS_SHIB_LOGIN_CACHE_TTL = 180 """Cache default timeout 3 minute""" -WEKO_ACCOUNTS_SHIB_IDP_LOGIN_URL = '{}secure/login.php' +WEKO_ACCOUNTS_SHIB_IDP_LOGIN_URL = '{}secure/login.py' """Login proxy URL.""" WEKO_ACCOUNTS_SSO_ATTRIBUTE_MAP = { diff --git a/nginx/Dockerfile b/nginx/Dockerfile index fc3ff8faa3..df3710443e 100644 --- a/nginx/Dockerfile +++ b/nginx/Dockerfile @@ -37,7 +37,7 @@ RUN cd nginx-1.20.1 && dpkg-buildpackage -b FROM ubuntu:focal AS nginx-stage_1 ENV DEBIAN_FRONTEND=noninteractive -RUN apt-get update && apt-get install -y openssl wget curl unzip supervisor shibboleth-sp-common shibboleth-sp-utils php-fpm php-curl +RUN apt-get update && apt-get install -y openssl wget curl unzip supervisor shibboleth-sp-common shibboleth-sp-utils fcgiwrap python3-requests WORKDIR /tmp #COPY --from=nginx-with-shib /tmp/nginx_1.18.0-2~focal_amd64.deb . @@ -52,8 +52,6 @@ ADD supervisord.conf /etc/supervisor/supervisord.conf ADD shibboleth2.xml /etc/shibboleth/shibboleth2.xml ADD attribute-map.xml /etc/shibboleth/attribute-map.xml ADD attribute-policy.xml /etc/shibboleth/attribute-policy.xml -RUN sed -i 's/\/run\/php/\/tmp/g' /etc/php/7.4/fpm/php-fpm.conf -RUN sed -i 's/\/run\/php/\/tmp/g' /etc/php/7.4/fpm/pool.d/www.conf ADD ./keys/server.crt /etc/shibboleth/server.crt ADD ./keys/server.key /etc/shibboleth/server.key @@ -75,7 +73,8 @@ RUN chmod 400 /etc/nginx/server.key RUN mkdir /usr/share/nginx/html/secure #ADD ./phpinfo.php /usr/share/nginx/html/secure/phpinfo.php #ADD ./index.php /usr/share/nginx/html/secure/index.php -ADD ./login.php /usr/share/nginx/html/secure/login.php +ADD ./login.py /usr/share/nginx/html/secure/login.py +RUN chmod 755 /usr/share/nginx/html/secure/login.py ADD ./shib_clear_headers /etc/nginx/shib_clear_headers ADD ./shib_fastcgi_params /etc/nginx/shib_fastcgi_params diff --git a/nginx/login.php b/nginx/login.php deleted file mode 100644 index 1a7e15d48f..0000000000 --- a/nginx/login.php +++ /dev/null @@ -1,50 +0,0 @@ - - window.alert('Permission is invalid'); - window.location.href='".$base."';"; - //header("HTTP/1.1 403 Forbidden"); - //header("Location: ".$base); -}else{ - $url = $base."/weko/shib/login?next=%2F"; - $curl = curl_init(); - $post_args=[]; - $post_args['SHIB_ATTR_USER_NAME']=$_SERVER['HTTP_WEKOID']; - $post_args["SHIB_ATTR_EPPN"]=$_SERVER['Remote-User']; - $post_args["SHIB_ATTR_MAIL"]=$_SERVER['mail']; - $post_args["SHIB_ATTR_SESSION_ID"]=$_SERVER['Shib-Session-ID']; - $post_args["SHIB_ATTR_ROLE_AUTHORITY_NAME"]=$_SERVER['HTTP_WEKOSOCIETYAFFILIATION']; - $options = array( - //Method - CURLOPT_POST => true,//POST - //body - CURLOPT_POSTFIELDS => http_build_query($post_args), - ); - $cookie=tempnam(sys_get_temp_dir(),'cookie_'); - //set options - curl_setopt($curl,CURLOPT_URL,$url); - curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); - curl_setopt($curl,CURLOPT_SSL_VERIFYPEER, false); - curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0); - curl_setopt($curl, CURLOPT_COOKIESESSION, true); - curl_setopt_array($curl, $options); - curl_setopt($curl,CURLOPT_COOKIEJAR,$cookie); - curl_setopt($curl,CURLOPT_COOKIEFILE,$cookie); - // request - $result = curl_exec($curl); - $info = curl_getinfo($curl); - $errno = curl_errno($curl); - $error = curl_error($curl); - curl_close($curl); - if (CURLE_OK !== $errno) { - throw new RuntimeException($error, $errno); - } - header("HTTP/1.1 302 Found"); - header("Location: ".$base.$result); - //var_dump($app_cookies[0]['value']); -} -?> diff --git a/nginx/login.py b/nginx/login.py new file mode 100644 index 0000000000..ba02d8acb3 --- /dev/null +++ b/nginx/login.py @@ -0,0 +1,54 @@ +#!/usr/bin/python3 +import json +import os +from urllib import parse + +import requests +import urllib3 +from urllib3.exceptions import InsecureRequestWarning +urllib3.disable_warnings(InsecureRequestWarning) + +# Set the base URL +base_url = os.environ.get('REQUEST_SCHEME', 'https') + '://' \ + + os.environ.get('SERVER_NAME', '') +if not os.environ.get('HTTP_WEKOSOCIETYAFFILIATION') \ + and os.environ.get('NO_CHECK_WEKOSOCIETYAFFILIATION') != 'TRUE': + # Alert and redirect to the base URL if the permission is invalid + print('Content-Type: text/html; charset=utf-8') + print('') + print(''.format(json.dumps(base_url))) +else: + # Get the next URL + qs = parse.parse_qs(os.environ.get('QUERY_STRING', '')) + next_url = qs['next'][0] if 'next' in qs else '/' + url = base_url + '/weko/shib/login?next=' + parse.quote(next_url, safe='') + + # Create the form data in the same format as login.php + data = { + 'SHIB_ATTR_USER_NAME': os.environ.get('HTTP_WEKOID', ''), + 'SHIB_ATTR_EPPN': os.environ.get('Remote-User', ''), + 'SHIB_ATTR_MAIL': os.environ.get('mail', ''), + 'SHIB_ATTR_SESSION_ID': os.environ.get('Shib-Session-ID', ''), + 'SHIB_ATTR_ROLE_AUTHORITY_NAME': + os.environ.get('HTTP_WEKOSOCIETYAFFILIATION', ''), + } + + # Request to the Shibboleth login + response = requests.post(url, data=data, verify=False) + response.raise_for_status() + redirect = response.text + + if redirect.startswith('/'): + # Redirect to the Shibboleth login + print('Status: 302 Found') + print('Content-Type: text/html') + print('Location: ' + base_url + redirect) + print('') + else: + # Display the login page or the page before login processing + print('Status: 200 OK') + print('Content-Type: text/html; charset=utf-8') + print('') + print(redirect) diff --git a/nginx/supervisord.conf b/nginx/supervisord.conf index 2773a36c85..1b604e07d2 100644 --- a/nginx/supervisord.conf +++ b/nginx/supervisord.conf @@ -30,15 +30,18 @@ socket_mode=0777 redirect_stderr=true priority=2 -[program:php-fpm] -command =/usr/sbin/php-fpm7.4 -F -autostart=true -autorestart=true +[fcgi-program:fcgiwrap] +command=/usr/sbin/fcgiwrap -f +user=www-data +socket=unix:///tmp/fcgiwrap.sock +socket_owner=www-data:www-data +socket_mode=0777 stdout_logfile=/dev/stdout stdout_logfile_maxbytes=0 stderr_logfile=/dev/stderr stderr_logfile_maxbytes=0 -socket_mode=0777 +autorestart=true +autostart=true [fcgi-program:shibauthorizer] command=/usr/lib/x86_64-linux-gnu/shibboleth/shibauthorizer diff --git a/nginx/weko.conf b/nginx/weko.conf index 2b746e455a..283551d966 100644 --- a/nginx/weko.conf +++ b/nginx/weko.conf @@ -105,8 +105,8 @@ server { more_clear_input_headers 'EPPN' 'DisplayName' 'Email' 'Persistent-Id'; - fastcgi_pass unix:/tmp/php7.4-fpm.sock; - fastcgi_index index.php; + fastcgi_split_path_info ^(.+\.py)(.*)$; + fastcgi_pass unix:/tmp/fcgiwrap.sock; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; root /usr/share/nginx/html; diff --git a/scripts/instance.cfg b/scripts/instance.cfg index e5e5ef0286..8d4d7d0e72 100644 --- a/scripts/instance.cfg +++ b/scripts/instance.cfg @@ -388,7 +388,7 @@ WEKO_RECORDS_UI_LICENSE_DICT = [ WEKO_ACCOUNTS_SHIB_LOGIN_ENABLED = True # Login proxy URL -WEKO_ACCOUNTS_SHIB_IDP_LOGIN_URL = '{}secure/login.php' +WEKO_ACCOUNTS_SHIB_IDP_LOGIN_URL = '{}secure/login.py' # IdP attribute map WEKO_ACCOUNTS_SSO_ATTRIBUTE_MAP = {