source: TI05-delivery/ows_framework/trunk/ows_server/ows_server/controllers/logout.py @ 2959

from ows_server.lib.base import *
from ows_server.lib.security_util import SecuritySession
import logging
log = logging.getLogger(__name__)

from paste.request import parse_querystring
import sys # include in case tracefile is set to sys.stderr 
import base64 # decode the return to address
from urlparse import urlsplit, urlunsplit

from ndg.security.common.SessionMgr import SessionMgrClient


class LogoutController(BaseController):
    '''Provides the pylons controller for logging out and killing the cookies
    '''
    
    def __before__(self):
        """Get return to URL"""
        c.returnTo = request.params.get('r', '')
        
        # Check return to address - getCredentials should NOT be returned to
        # with its query args intact
        b64decReturnTo = base64.urlsafe_b64decode(c.returnTo)
        scheme, netloc, pathInfo, query, frag = urlsplit(b64decReturnTo)
        if 'getCredentials' in pathInfo:
            # Swap to discovery and remove sensitive creds query args
            #
            # TODO: re-write to be more robust and modular.  Nb. 
            # BaseController.__call__ should filter out 'getCredentials'
            # calls from c.requestURL so this code should never need to be 
            # executed.
            filteredReturnTo = urlunsplit((scheme,netloc,'/discovery','',''))
            c.returnTo = base64.urlsafe_b64encode(filteredReturnTo)

    
    def index(self):
        ''' Ok, you really want to logout here '''

        if 'ndgSec' not in session:
            # There's no handle to a security session
            log.error("logout called but no 'ndgSec' key in session object")
            return self.__redirect()
        
        try:
            smClnt = SessionMgrClient(uri=g.securityCfg.smURI,
                    sslCACertFilePathList=g.securityCfg.sslCACertFilePathList,
                    sslPeerCertCN=g.securityCfg.sslPeerCertCN,
                    signingCertFilePath=g.securityCfg.wssCertFilePath,
                    signingPriKeyFilePath=g.securityCfg.wssPriKeyFilePath,
                    signingPriKeyPwd=g.securityCfg.wssPriKeyPwd,
                    caCertFilePathList=g.securityCfg.wssCACertFilePathList,
                    tracefile=g.securityCfg.tracefile)       
        except Exception, e:
            log.error("logout - creating Session Manager client: %s" % e)
            return self.__redirect()  
        
        # Disconnect from Session Manager
        log.info('Calling Session Manager "%s" disconnect for logout...' % \
                 g.securityCfg.smURI)
        try:
            smClnt.disconnect(sessID=session['ndgSec']['sid'])
        except Exception, e:
            log.error("Error with Session Manager logout: %s" % e)
            self.__redirect()
            
        try:
            # easy to kill our cookie
            SecuritySession.delete()
            if 'ndgCleared' in session: del session['ndgCleared']
            session.save()
            
        except Exception, e:   
            log.error("logout - clearing security session: %s" % e)

        return self.__redirect()
    
    
    def __redirect(self):
        """Handle redirect back to previous page"""
        if c.returnTo:
            # Decode the return to address
            try:
                b64decReturnTo = base64.urlsafe_b64decode(c.returnTo)
            except Exception, e:
                log.error("logout - decoding return URL: %s" % e) 
                return render_response('content')
            
            # and now go back to whence we had come
            h.redirect_to(b64decReturnTo)
        else:
            return render_response('content')