common: hash too long SAML usernames

circle/circle/settings/test.py

@@ -71,3 +71,5 @@ STORE_URL = ""
 
 
 # buildbot doesn't love pipeline
 # buildbot doesn't love pipeline
 STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.StaticFilesStorage'
 STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.StaticFilesStorage'
+
+SAML_MAIN_ATTRIBUTE_MAX_LENGTH=0  # doctest on SAML2 backend runs either way

circle/common/backends.py

@@ -18,6 +18,7 @@
 
 
 import re
 import re
 import logging
 import logging
+import sha
 
 
 from django.conf import settings
 from django.conf import settings
 from djangosaml2.backends import Saml2Backend as Saml2BackendBase
 from djangosaml2.backends import Saml2Backend as Saml2BackendBase
@@ -48,14 +49,15 @@ class Saml2Backend(Saml2BackendBase):
         attr = re.sub(r'[^\w.@-]', replace, main_attribute)
         attr = re.sub(r'[^\w.@-]', replace, main_attribute)
         max_length = settings.SAML_MAIN_ATTRIBUTE_MAX_LENGTH
         max_length = settings.SAML_MAIN_ATTRIBUTE_MAX_LENGTH
         if max_length > 0 and len(attr) > max_length:
         if max_length > 0 and len(attr) > max_length:
-            logger.info("Trimming main attribute: %s" % attr)
+            logger.info("Main attribute '%s' is too long." % attr)
+            hashed = sha.new(attr).hexdigest()
             if "@" in attr:
             if "@" in attr:
-                parts = attr.split("@")
-                attr = "%s@%s" % (parts[0][:max_length-1-len(parts[1])],
-                                  parts[1])
+                domain = attr.rsplit("@", 1)[1]
+                attr = "%s@%s" % (hashed[:max_length-1-len(domain)],
+                                  domain)
             else:
             else:
-                attr = attr[:max_length]
-            logger.info("Trimmed main attribute: %s" % attr)
+                attr = hashed[:max_length]
+            logger.info("New main attribute: %s" % attr)
         return attr
         return attr
 
 
     def _set_attribute(self, obj, attr, value):
     def _set_attribute(self, obj, attr, value):