source: TI12-security/trunk/NDGSecurity/python/ndg_security_server/ndg/security/server/wsgi/authzservice.py @ 6593

"""Authorization service with SAML 2.0 authorisation decision query interface

NERC DataGrid Project
"""
__author__ = "P J Kershaw"
__date__ = "17/02/10"
__copyright__ = "(C) 2010 Science and Technology Facilities Council"
__license__ = "BSD - see LICENSE file in top-level directory"
__contact__ = "Philip.Kershaw@stfc.ac.uk"
__revision__ = '$Id: $'
import logging
log = logging.getLogger(__name__)

from ndg.security.common.utils.factory import importModuleObject
from ndg.security.common.authz.msi import Policy, PDP, PIP


class AuthzServiceMiddlewareError(Exception):
    """Authorisation Service generic exception type"""
    

class AuthzServiceMiddlewareConfigError(AuthzServiceMiddlewareError):
    """Authorisation Service configuration error"""
    
    
class AuthzServiceMiddleware(object):
    '''WSGI to add an NDG Security Authorization Service in the environ.  This
    enables multiple WSGI filters to access the same underlying Attribute
    Authority instance e.g. provide SAML SOAP and WSDL SOAP based interfaces
    to the same Authorization Service
    '''
    DEFAULT_AUTHZ_DECISION_QUERY_IFACE_KEYNAME = \
    'ndg.security.server.wsgi.authorizationservice.authzDecisionQueryInterface'
    
    ENVIRON_KEYNAME_AUTHZ_DECISION_QUERY_IFACE_OPTNAME = \
        'authzDecisionQueryInterfaceEnvironKeyName'
    
    AUTHZ_DECISION_QUERY_IFACE_OPTNAME = 'authzDecisionQueryInterface'
    
    POLICY_FILEPATH_OPTNAME = 'filePath'
    POLICY_CFG_PREFIX = 'policy.'
    
    __slots__ = ('__pdp', '__authzDecisionFunc', '__authzDecisionFuncKeyName')
        
    def __init__(self, app):
        '''Set-up an Authorization Service instance
        '''        
        super(AuthzServiceMiddleware, self).__init__(app, {}) 
         
        self._app = app
        self.__pdp = None
        self.__authzDecisionFunc = None
        self.__authzDecisionFuncKeyName = None
    
    def initialise(self, global_conf, prefix='authorizationservice.',
                   **app_conf):
        """Set-up Authorization Service middleware using a Paste app factory 
        pattern.  Overloaded base class method to enable custom settings from 
        app_conf
        
        @type app: callable following WSGI interface
        @param app: next middleware application in the chain      
        @type global_conf: dict        
        @param global_conf: PasteDeploy global configuration dictionary
        @type prefix: basestring
        @param prefix: prefix for configuration items
        @type app_conf: dict        
        @param app_conf: PasteDeploy application specific configuration 
        dictionary
        """
        cls = AuthzServiceMiddleware
        
        # Initialise the Authorisation Policy
        policyCfgPrefix = prefix + cls.POLICY_CFG_PREFIX
        policyFilePathOptName = policyCfgPrefix + cls.POLICY_FILEPATH_OPTNAME
        
        policyFilePath = app_conf.get(policyFilePathOptName)
        if policyFilePath is None:
            raise AuthzServiceMiddlewareConfigError("Expecting policy file "
                                                    "setting option %r" %
                                                    policyFilePathOptName)
        
        policy = Policy.Parse(policyFilePath)
        
        # Initialise the Policy Information Point 
        pip = PIP()
        
        # Initialise the PDP reading in the policy        
        self.pdp = PDP(policy, pip)
        
        authzDecisionQueryIfaceEnvironKeyOptName = prefix + \
            cls.ENVIRON_KEYNAME_AUTHZ_DECISION_QUERY_IFACE_OPTNAME
            
        self.authzDecisionFuncKeyName = app_conf.get(
                                authzDecisionQueryIfaceEnvironKeyOptName,
                                cls.DEFAULT_AUTHZ_DECISION_QUERY_IFACE_KEYNAME)
        
        authzDecisionQueryIfaceOptName = prefix + \
                                         cls.AUTHZ_DECISION_QUERY_IFACE_OPTNAME
                                         
        self.authzDecisionFunc = app_conf.get(
                                authzDecisionQueryIfaceOptName,
                                cls.DEFAULT_AUTHZ_DECISION_QUERY_IFACE_KEYNAME)
        
    @classmethod
    def filter_app_factory(cls, app, global_conf, **app_conf):
        '''Wrapper to enable instantiation compatible with Paste Deploy
        filter application factory function signature
        
        @type app: callable following WSGI interface
        @param app: next middleware application in the chain      
        @type global_conf: dict        
        @param global_conf: PasteDeploy global configuration dictionary
        @type prefix: basestring
        @param prefix: prefix for configuration items
        @type app_conf: dict        
        @param app_conf: PasteDeploy application specific configuration 
        dictionary
        '''
        app = cls(app)
        app.initialise(global_conf, **app_conf)
        
        return app
    
    def __call__(self, environ, start_response):
        '''Set the Authorization Decision function in environ
        
        @type environ: dict
        @param environ: WSGI environment variables dictionary
        @type start_response: function
        @param start_response: standard WSGI start response function
        @rtype: iterable
        @return: next application in the WSGI stack
        '''
        environ[self.authzDecisionFuncKeyName] = self.authzDecisionFunc
        return self._app(environ, start_response)

    def _getPdp(self):
        return self.__pdp

    def _setPdp(self, value):
        if not isinstance(value, PDP):
            raise TypeError('Expecting %r type for "pdp" attribute; got %r '
                            'instead' % value)
            
        self.__pdp = value

    pdp = property(_getPdp, _setPdp, None, "Policy Decision Point")

    def _get_authzDecisionFuncKeyName(self):
        return self.__authzDecisionFuncKeyName

    def _set_authzDecisionFuncKeyName(self, val):
        if not isinstance(val, basestring):
            raise TypeError('Expecting %r for "getAuthzDecisionKeyName" '
                            'attribute; got %r' % (basestring, type(val)))
        self.__authzDecisionFuncKeyName = val
        
    authzDecisionFuncKeyName = property(fget=_get_authzDecisionFuncKeyName, 
                                        fset=_set_authzDecisionFuncKeyName, 
                                        doc="Key name used to index "
                                            "Authorization Service SAML authz "
                                            "decision query function in "
                                            "environ dictionary")
    
    def _getAuthzDecisionFunc(self):
        return self.__authzDecisionFunc
    
    def _setAuthzDecisionFunc(self, value):
        if isinstance(value, basestring):
            self.__authzDecisionFunc = importModuleObject(value)
            
        elif iscallable(value):
            self.__authzDecisionFunc = value
        else:
            raise TypeError('Expecting callable for "authzDecisionFunc" '
                            'attribute; got %r instead.' % type(value))
    
    authzDecisionFunc = property(_getAuthzDecisionFunc,
                                 _setAuthzDecisionFunc,
                                 doc="authorisation decision function set in "
                                     "environ for downstream SAML Query "
                                     "middleware to invoke in response to "
                                     "<authzDecisionQuery>s")
         
    def createAuthzDecisionFunc(self):
        """Return the authorisation decision function so that __call__ can add
        it to environ for the SAML Query middleware to pick up and invoke
        
        @return: SAML authorisation decision function
        @rtype: callable
        """
        def getAuthzDecision(authzDecisionQuery):
            """Authorisation decision function accepts a SAML AuthzDecisionQuery
            and calls the Policy Decision Point returning a response
            
            @type authzDecisionQuery: saml.saml2.core.AuthzDecisionQuery
            @param authzDecisionQuery: WSGI environment variables dictionary
            @rtype: saml.saml2.core.Response
            @return: SAML response containing Authorisation Decision Statement
            """        
            # Make a request object to pass to the PDP
            request = Request()
            request.subject[Subject.USERID_NS
                            ] = authzDecisionQuery.subject.nameID.value
            
            # IdP Session Manager specific settings:
            #
            # The following won't be set if the IdP running the OpenID Provider
            # hasn't also deployed a Session Manager.  In this case, the
            # Attribute Authority will be queried directly from here without a
            # remote Session Manager intermediary to cache credentials
            request.resource[Resource.URI_NS] = authzDecisionQuery.resource
    
            # Call the PDP
            pdpResponse = self.pdp.evaluate(request)        
            
            response = Response()
                        
            authzDecisionStatement = AuthzDecisionStatement()
            authzDecisionStatement.resource = authzDecisionQuery.resource
            authzDecisionStatement.actions.append(Action())
            authzDecisionStatement.actions[-1].namespace = Action.GHPP_NS_URI
            authzDecisionStatement.actions[-1].value = Action.HTTP_GET_ACTION
            assertion.authzDecisionStatements.append(authzDecisionStatement)

            if pdpResponse.status == Response.DECISION_PERMIT:
                log.info("AuthzServiceMiddleware.__call__: PDP granted "
                         "access for URI path [%s] using policy [%s]", 
                         resourceURI, 
                         self.policyFilePath)
                
                authzDecisionStatement.decision = DecisionType.PERMIT
            
            elif pdpResponse.status == Response.DECISION_INDETERMINATE:
                log.info("AuthzServiceMiddleware.__call__: PDP returned a "
                         "status of [%s] denying access for URI path [%s] using "
                         "policy [%s]", 
                         pdpResponse.decisionValue2String[response.status],
                         resourceURI,
                         self.policyFilePath) 
                
                authzDecisionStatement.decision = DecisionType.INDETERMINATE
                  
            else:
                log.info("AuthzServiceMiddleware.__call__: PDP returned a "
                         "status of [%s] denying access for URI path [%s] using "
                         "policy [%s]", 
                         pdpResponse.decisionValue2String[response.status],
                         resourceURI,
                         self.policyFilePath) 
                
                authzDecisionStatement.decision = DecisionType.DENY
                                                                
            
            now = datetime.utcnow()
            response.issueInstant = now
            
            # Make up a request ID that this response is responding to
            response.inResponseTo = query.id
            response.id = str(uuid4())
            response.version = SAMLVersion(SAMLVersion.VERSION_20)
                
            response.issuer = Issuer()
            response.issuer.format = self.issuerFormat
            response.issuer.value = self.issuer

            response.status = Status()
            response.status.statusCode = StatusCode()
            response.status.statusMessage = StatusMessage()        
            
            response.status.statusCode.value = StatusCode.SUCCESS_URI
            response.status.statusMessage.value = "Response created successfully"
               
            assertion = Assertion()
            assertion.version = SAMLVersion(SAMLVersion.VERSION_20)
            assertion.id = str(uuid4())
            assertion.issueInstant = now
            
            # Add a conditions statement for a validity of 8 hours
            assertion.conditions = Conditions()
            assertion.conditions.notBefore = now
            assertion.conditions.notOnOrAfter = now + timedelta(seconds=60*60*8)
                   
            assertion.subject = Subject()  
            assertion.subject.nameID = NameID()
            assertion.subject.nameID.format = query.subject.nameID.format
            assertion.subject.nameID.value = query.subject.nameID.value
                
            assertion.issuer = Issuer()
            assertion.issuer.format = self.issuerFormat
            assertion.issuer.value = self.issuer
    
            response.assertions.append(assertion)
            return response
        
        return getAuthzDecision