source: TI05-delivery/ows_framework/trunk/ows_server/ows_server/controllers/logout.py @ 2880

from ows_server.lib.base import *
from ows_server.lib.security_util import SecuritySession
import logging
log = logging.getLogger(__name__)

from paste.request import parse_querystring
import sys # include in case tracefile is set to sys.stderr 
import base64 # decode the return to address

from ndg.security.common.SessionMgr import SessionMgrClient


class LogoutController(BaseController):
    ''' Provides the pylons controller for logging out and killing the cookies '''
    
    def __setup(self):
        #where are we going back to?
        self.inputs=dict(parse_querystring(request.environ))
        if 'r' in self.inputs:
            c.returnTo=self.inputs['r']
        else:
            c.returnTo=''

        self.__securitySetup()
        
        
    def __securitySetup(self):
        '''PKI settings for Session Manager'''
        
        self.ndgCfg = request.environ['ndgConfig']

        tracefileExpr = self.ndgCfg.get('NDG_SECURITY', 'tracefile')
        if tracefileExpr:
            self.tracefile = eval(tracefileExpr)
        
        # ... for SSL connections to security web services
        try:
            self.sslCACertFilePathList = \
            self.ndgCfg.get('NDG_SECURITY', 'sslCACertFilePathList').split()
                
        except AttributeError:
            raise OwsError, 'No "sslCACertFilePathList" security setting'

        self.sslPeerCertCN = self.ndgCfg.get('NDG_SECURITY', 'sslPeerCertCN')

        # ...and for WS-Security digital signature
        self.wssCertFilePath = self.ndgCfg.get('NDG_SECURITY', 
                                               'wssCertFilePath')
        self.wssPriKeyFilePath = self.ndgCfg.get('NDG_SECURITY', 
                                                 'wssKeyFilePath')
        self.wssPriKeyPwd = self.ndgCfg.get('NDG_SECURITY', 'wssKeyPwd')

        try:
            self.wssCACertFilePathList = \
            self.ndgCfg.get('NDG_SECURITY', 'wssCACertFilePathList').split()
                
        except AttributeError:
            raise OwsError, 'No "wssCACertFilePathList" security setting'

    
    def index(self):
        ''' Ok, you really want to logout here '''
        self.__setup()

        if 'ndgSec' not in session:
            # There's no handle to a security session
            log.error("logout called but no 'ndgSec' key in session object")
            return self.__redirect()
        
        # Look into the session and go kill the wallet
        smURI = self.ndgCfg.get('NDG_SECURITY', 'sessionMgrURI')

        # May be better as a 'g' global set-up at start-up?
        #
        # tracefile could be removed for production use
        try:
            smClnt = SessionMgrClient(uri=smURI,
                            sslCACertFilePathList=self.sslCACertFilePathList,
                            sslPeerCertCN=self.sslPeerCertCN,
                            signingCertFilePath=self.wssCertFilePath,
                            signingPriKeyFilePath=self.wssPriKeyFilePath,
                            signingPriKeyPwd=self.wssPriKeyPwd,
                            caCertFilePathList=self.wssCACertFilePathList,
                            tracefile=self.tracefile)       
        except Exception, e:
            log.error("logout - creating Session Manager client: %s" % e)
            return self.__redirect()  
        
        # Disconnect from Session Manager
        log.info('Calling Session Manager "%s" disconnect for logout...' % \
                 smURI)
        try:
            smClnt.disconnect(sessID=session['ndgSec']['sid'])
        except Exception, e:
            log.error("Error with Session Manager logout: %s" % e)
            self.__redirect()
            
        try:
            # easy to kill our cookie
            SecuritySession.delete()
            if 'ndgCleared' in session: del session['ndgCleared']
            session.save()
            
        except Exception, e:   
            log.error("logout - clearing security session: %s" % e)

        return self.__redirect()
    
    
    def __redirect(self):
        """Handle redirect back to previous page"""
        if c.returnTo:
            # Decode the return to address
            try:
                b64decReturnTo = base64.urlsafe_b64decode(c.returnTo)
            except Exception, e:
                log.error("logout - decoding return URL: %s" % e) 
                return render_response('content')
            
            # and now go back to whence we had come
            h.redirect_to(b64decReturnTo)
        else:
            return render_response('content')