Support multiple certificates for DigiD/eHerkenning

CHANGELOG.rst

@@ -2,6 +2,19 @@
 Changelog
 =========
 
+0.17.0 (DEVELOPMENT)
+====================
+
+**💥⚠️ Breaking changes**
+
+* Removed the ``generate_digid_metadata``, ``generate_eherkenning_metadata`` and
+  ``generate_eherkenning_dienstcatalogus`` management commands. This metadata is
+  available through the admin interface and existing URLs/views.
+
+**Features**
+
+...
+
 0.16.0 (2024-07-02)
 ===================
 

digid_eherkenning/admin.py

@@ -1,11 +1,16 @@
+from datetime import datetime
+
 from django.contrib import admin
+from django.urls import reverse
+from django.utils.html import format_html
 from django.utils.translation import gettext_lazy as _
 
 from privates.admin import PrivateMediaMixin
 from privates.widgets import PrivateFileWidget
 from solo.admin import SingletonModelAdmin
 
-from .models import DigidConfiguration, EherkenningConfiguration
+from .models import ConfigCertificate, DigidConfiguration, EherkenningConfiguration
+from .models.base import BaseConfiguration
 
 
 class CustomPrivateFileWidget(PrivateFileWidget):
@@ -16,14 +21,39 @@ class CustomPrivateMediaMixin(PrivateMediaMixin):
     private_media_file_widget = CustomPrivateFileWidget
 
 
-@admin.register(DigidConfiguration)
-class DigidConfigurationAdmin(CustomPrivateMediaMixin, SingletonModelAdmin):
-    readonly_fields = ("idp_service_entity_id",)
-    fieldsets = (
+class BaseAdmin(CustomPrivateMediaMixin, SingletonModelAdmin):
+    readonly_fields = (
+        "link_to_certificates",
+        "idp_service_entity_id",
+    )
+    private_media_fields = ("idp_metadata_file",)
+
+    @admin.display(description=_("certificates"))
+    def link_to_certificates(self, obj: BaseConfiguration) -> str:
+        path = reverse(
+            "admin:digid_eherkenning_configcertificate_changelist",
+            current_app=self.admin_site.name,
+        )
+        config_type = obj._as_config_type()
+        qs = ConfigCertificate.objects.filter(config_type=config_type)
+        url = f"{path}?config_type__exact={config_type}"
+        return format_html(
+            '<a href="{url}" target="_blank">{label}</a>',
+            url=url,
+            config_type=config_type.value,
+            label=_("Manage ({count})").format(count=qs.count()),
+        )
+
+
+def _fieldset_factory(middle):
+    """
+    Output custom fieldsets (model-specific) between fixed shared field(set)s.
+    """
+    head = [
         (
             _("X.509 Certificate"),
             {
-                "fields": ("certificate",),
+                "fields": ("link_to_certificates",),
             },
         ),
         (
@@ -50,18 +80,8 @@ class DigidConfigurationAdmin(CustomPrivateMediaMixin, SingletonModelAdmin):
                 ),
             },
         ),
-        (
-            _("Service details"),
-            {
-                "fields": (
-                    "service_name",
-                    "service_description",
-                    "requested_attributes",
-                    "attribute_consuming_service_index",
-                    "slo",
-                ),
-            },
-        ),
+    ]
+    tail = [
         (
             _("Organization details"),
             {
@@ -73,96 +93,103 @@ class DigidConfigurationAdmin(CustomPrivateMediaMixin, SingletonModelAdmin):
                 ),
             },
         ),
+    ]
+
+    return tuple(head + list(middle) + tail)
+
+
+@admin.register(DigidConfiguration)
+class DigidConfigurationAdmin(BaseAdmin):
+    fieldsets = _fieldset_factory(
+        [
+            (
+                _("Service details"),
+                {
+                    "fields": (
+                        "service_name",
+                        "service_description",
+                        "requested_attributes",
+                        "attribute_consuming_service_index",
+                        "slo",
+                    ),
+                },
+            ),
+        ]
     )
     change_form_template = "admin/digid_eherkenning/digidconfiguration/change_form.html"
-    private_media_fields = ("idp_metadata_file",)
 
 
 @admin.register(EherkenningConfiguration)
-class EherkenningConfigurationAdmin(CustomPrivateMediaMixin, SingletonModelAdmin):
-    readonly_fields = ("idp_service_entity_id",)
-    fieldsets = (
-        (
-            _("X.509 Certificate"),
-            {
-                "fields": ("certificate",),
-            },
-        ),
-        (
-            _("Identity provider"),
-            {
-                "fields": (
-                    "metadata_file_source",
-                    "idp_service_entity_id",
-                    "idp_metadata_file",
-                ),
-            },
-        ),
-        (
-            _("SAML configuration"),
-            {
-                "fields": (
-                    "entity_id",
-                    "base_url",
-                    "artifact_resolve_content_type",
-                    "want_assertions_signed",
-                    "want_assertions_encrypted",
-                    "signature_algorithm",
-                    "digest_algorithm",
-                ),
-            },
-        ),
-        (
-            _("Service details"),
-            {
-                "fields": (
-                    "service_name",
-                    "service_description",
-                    "oin",
-                    "makelaar_id",
-                    "privacy_policy",
-                    "service_language",
-                ),
-            },
-        ),
-        (
-            _("eHerkenning"),
-            {
-                "fields": (
-                    "eh_requested_attributes",
-                    "eh_attribute_consuming_service_index",
-                    "eh_service_uuid",
-                    "eh_service_instance_uuid",
-                    "eh_loa",
-                ),
-            },
-        ),
-        (
-            _("eIDAS"),
-            {
-                "fields": (
-                    "no_eidas",
-                    "eidas_requested_attributes",
-                    "eidas_attribute_consuming_service_index",
-                    "eidas_service_uuid",
-                    "eidas_service_instance_uuid",
-                    "eidas_loa",
-                ),
-            },
-        ),
-        (
-            _("Organization details"),
-            {
-                "fields": (
-                    "technical_contact_person_telephone",
-                    "technical_contact_person_email",
-                    "organization_url",
-                    "organization_name",
-                ),
-            },
-        ),
+class EherkenningConfigurationAdmin(BaseAdmin):
+    fieldsets = _fieldset_factory(
+        [
+            (
+                _("Service details"),
+                {
+                    "fields": (
+                        "service_name",
+                        "service_description",
+                        "oin",
+                        "makelaar_id",
+                        "privacy_policy",
+                        "service_language",
+                    ),
+                },
+            ),
+            (
+                _("eHerkenning"),
+                {
+                    "fields": (
+                        "eh_requested_attributes",
+                        "eh_attribute_consuming_service_index",
+                        "eh_service_uuid",
+                        "eh_service_instance_uuid",
+                        "eh_loa",
+                    ),
+                },
+            ),
+            (
+                _("eIDAS"),
+                {
+                    "fields": (
+                        "no_eidas",
+                        "eidas_requested_attributes",
+                        "eidas_attribute_consuming_service_index",
+                        "eidas_service_uuid",
+                        "eidas_service_instance_uuid",
+                        "eidas_loa",
+                    ),
+                },
+            ),
+        ]
     )
+
     change_form_template = (
         "admin/digid_eherkenning/eherkenningconfiguration/change_form.html"
     )
-    private_media_fields = ("idp_metadata_file",)
+
+
+@admin.register(ConfigCertificate)
+class ConfigCertificateAdmin(admin.ModelAdmin):
+    list_display = (
+        "config_type",
+        "certificate",
+        "valid_from",
+        "expiry_date",
+        "is_ready",
+    )
+    list_filter = ("config_type",)
+    search_fields = ("certificate__label",)
+    raw_id_fields = ("certificate",)
+
+    @admin.display(description=_("valid from"))
+    def valid_from(self, obj: ConfigCertificate) -> datetime:
+        return obj.certificate.valid_from
+
+    @admin.display(description=_("expires on"))
+    def expiry_date(self, obj: ConfigCertificate) -> datetime:
+        return obj.certificate.expiry_date
+
+    @admin.display(description=_("valid candidate?"), boolean=True)
+    def is_ready(self, obj: ConfigCertificate) -> bool:
+        return obj.is_ready_for_authn_requests

digid_eherkenning/choices.py

@@ -4,6 +4,15 @@
 from onelogin.saml2.constants import OneLogin_Saml2_Constants
 
 
+class ConfigTypes(models.TextChoices):
+    """
+    Maps a config type enum to a configuration model.
+    """
+
+    digid = "digid_eherkenning.DigidConfiguration", _("DigiD")
+    eherkenning = "digid_eherkenning.EherkenningConfiguration", _("eHerkenning")
+
+
 class SectorType(models.TextChoices):
     bsn = "s00000000", "BSN"
     sofi = "s00000001", "SOFI"

digid_eherkenning/exceptions.py

@@ -8,3 +8,9 @@ class eHerkenningError(SAML2Error):
 
 class eHerkenningNoRSINError(eHerkenningError):
     pass
+
+
+class CertificateProblem(Exception):
+    def __init__(self, msg: str, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.message = msg