Skip to content

feat: Shibbolethログイン用スクリプトをlogin.phpからlogin.pyに置き換え #1944

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mhaya wants to merge 1 commit into
base: fix/63224
Choose a base branch
from
Open

feat: Shibbolethログイン用スクリプトをlogin.phpからlogin.pyに置き換え #1944

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion modules/weko-accounts/weko_accounts/config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@
WEKO_ACCOUNTS_SHIB_LOGIN_CACHE_TTL = 180
"""Cache default timeout 3 minute"""

WEKO_ACCOUNTS_SHIB_IDP_LOGIN_URL = '{}secure/login.php'
WEKO_ACCOUNTS_SHIB_IDP_LOGIN_URL = '{}secure/login.py'
"""Login proxy URL."""

WEKO_ACCOUNTS_SSO_ATTRIBUTE_MAP = {
Expand Down
7 changes: 3 additions & 4 deletions nginx/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ RUN cd nginx-1.20.1 && dpkg-buildpackage -b
FROM ubuntu:focal AS nginx-stage_1

ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y openssl wget curl unzip supervisor shibboleth-sp-common shibboleth-sp-utils php-fpm php-curl
RUN apt-get update && apt-get install -y openssl wget curl unzip supervisor shibboleth-sp-common shibboleth-sp-utils fcgiwrap python3-requests

WORKDIR /tmp
#COPY --from=nginx-with-shib /tmp/nginx_1.18.0-2~focal_amd64.deb .
Expand All @@ -52,8 +52,6 @@ ADD supervisord.conf /etc/supervisor/supervisord.conf
ADD shibboleth2.xml /etc/shibboleth/shibboleth2.xml
ADD attribute-map.xml /etc/shibboleth/attribute-map.xml
ADD attribute-policy.xml /etc/shibboleth/attribute-policy.xml
RUN sed -i 's/\/run\/php/\/tmp/g' /etc/php/7.4/fpm/php-fpm.conf
RUN sed -i 's/\/run\/php/\/tmp/g' /etc/php/7.4/fpm/pool.d/www.conf

ADD ./keys/server.crt /etc/shibboleth/server.crt
ADD ./keys/server.key /etc/shibboleth/server.key
Expand All @@ -75,7 +73,8 @@ RUN chmod 400 /etc/nginx/server.key
RUN mkdir /usr/share/nginx/html/secure
#ADD ./phpinfo.php /usr/share/nginx/html/secure/phpinfo.php
#ADD ./index.php /usr/share/nginx/html/secure/index.php
ADD ./login.php /usr/share/nginx/html/secure/login.php
ADD ./login.py /usr/share/nginx/html/secure/login.py
RUN chmod 755 /usr/share/nginx/html/secure/login.py

ADD ./shib_clear_headers /etc/nginx/shib_clear_headers
ADD ./shib_fastcgi_params /etc/nginx/shib_fastcgi_params
Expand Down
50 changes: 0 additions & 50 deletions nginx/login.php
View file
Open in desktop

This file was deleted.

54 changes: 54 additions & 0 deletions nginx/login.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
#!/usr/bin/python3
import json
import os
from urllib import parse

import requests
import urllib3
from urllib3.exceptions import InsecureRequestWarning
urllib3.disable_warnings(InsecureRequestWarning)

# Set the base URL
base_url = os.environ.get('REQUEST_SCHEME', 'https') + '://' \
+ os.environ.get('SERVER_NAME', '')
if not os.environ.get('HTTP_WEKOSOCIETYAFFILIATION') \
and os.environ.get('NO_CHECK_WEKOSOCIETYAFFILIATION') != 'TRUE':
# Alert and redirect to the base URL if the permission is invalid
print('Content-Type: text/html; charset=utf-8')
print('')
print('<script type="text/javascript">'
'window.alert("Permission is invalid");'
'window.location.href={};</script>'.format(json.dumps(base_url)))
else:
# Get the next URL
qs = parse.parse_qs(os.environ.get('QUERY_STRING', ''))
next_url = qs['next'][0] if 'next' in qs else '/'
url = base_url + '/weko/shib/login?next=' + parse.quote(next_url, safe='')

# Create the form data in the same format as login.php
data = {
'SHIB_ATTR_USER_NAME': os.environ.get('HTTP_WEKOID', ''),
'SHIB_ATTR_EPPN': os.environ.get('Remote-User', ''),
'SHIB_ATTR_MAIL': os.environ.get('mail', ''),
'SHIB_ATTR_SESSION_ID': os.environ.get('Shib-Session-ID', ''),
'SHIB_ATTR_ROLE_AUTHORITY_NAME':
os.environ.get('HTTP_WEKOSOCIETYAFFILIATION', ''),
}

# Request to the Shibboleth login
response = requests.post(url, data=data, verify=False)

@sourcery-ai sourcery-ai Bot Oct 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 High · Backend TLS can be impersonated

When traffic between nginx and the backend is intercepted, requests.post(..., verify=False) accepts an untrusted certificate, letting the interceptor read or alter the identity attributes and session ID and affect the login response; users can be impersonated or receive attacker-controlled content.

Enable certificate verification and configure the trusted CA for the backend.

Prompt for AI agents 
In `nginx/login.py` at line 39:

**Backend TLS can be impersonated**

When traffic between nginx and the backend is intercepted, `requests.post(..., verify=False)` accepts an untrusted certificate, letting the interceptor read or alter the identity attributes and session ID and affect the login response; users can be impersonated or receive attacker-controlled content.

Enable certificate verification and configure the trusted CA for the backend.

@sourcery-ai sourcery-ai Bot Oct 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (python.requests.security.disabled-cert-validation): Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.

Source: opengrep

response.raise_for_status()
redirect = response.text

if redirect.startswith('/'):
# Redirect to the Shibboleth login
print('Status: 302 Found')
print('Content-Type: text/html')
print('Location: ' + base_url + redirect)
print('')
else:
# Display the login page or the page before login processing
print('Status: 200 OK')
print('Content-Type: text/html; charset=utf-8')
print('')
print(redirect)
13 changes: 8 additions & 5 deletions nginx/supervisord.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,15 +30,18 @@ socket_mode=0777
redirect_stderr=true
priority=2

[program:php-fpm]
command =/usr/sbin/php-fpm7.4 -F
autostart=true
autorestart=true
[fcgi-program:fcgiwrap]
command=/usr/sbin/fcgiwrap -f
user=www-data
socket=unix:///tmp/fcgiwrap.sock
socket_owner=www-data:www-data
socket_mode=0777
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
socket_mode=0777
autorestart=true
autostart=true

[fcgi-program:shibauthorizer]
command=/usr/lib/x86_64-linux-gnu/shibboleth/shibauthorizer
Expand Down
4 changes: 2 additions & 2 deletions nginx/weko.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,8 +105,8 @@ server {

more_clear_input_headers 'EPPN' 'DisplayName' 'Email' 'Persistent-Id';

fastcgi_pass unix:/tmp/php7.4-fpm.sock;
fastcgi_index index.php;
fastcgi_split_path_info ^(.+\.py)(.*)$;
fastcgi_pass unix:/tmp/fcgiwrap.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
root /usr/share/nginx/html;
Expand Down
2 changes: 1 addition & 1 deletion scripts/instance.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -388,7 +388,7 @@ WEKO_RECORDS_UI_LICENSE_DICT = [
WEKO_ACCOUNTS_SHIB_LOGIN_ENABLED = True

# Login proxy URL
WEKO_ACCOUNTS_SHIB_IDP_LOGIN_URL = '{}secure/login.php'
WEKO_ACCOUNTS_SHIB_IDP_LOGIN_URL = '{}secure/login.py'

# IdP attribute map
WEKO_ACCOUNTS_SSO_ATTRIBUTE_MAP = {
Expand Down
Loading