source: TI12-security/trunk/python/NDG/SecurityCGI.py @ 1007

#!/usr/bin/env python

"""NDG Security CGI services

NERC Data Grid Project

P J Kershaw 23/05/06

Copyright (C) 2006 CCLRC & NERC

This software may be distributed under the terms of the Q Public License,
version 1.0 or later.
"""
from Cookie import SimpleCookie

import sys
import cgi
import os

from NDG.SecurityClient import *
from NDG.Session import UserSession 
from NDG.Session import UserSessionError


class SecurityCGIError(Exception):
    """Exception handling for NDG Security CGI class."""
    
    def __init__(self, msg):
        self.__msg = msg
         
    def __str__(self):
        return self.__msg

   
class SecurityCGI(cgi.FieldStorage):
    """CGI interface class for NDG Security
    
    Terms used throughout:        
        remote site     - where user is accessing resources
        home site       - where user's credentials are held or they login"""

    #_________________________________________________________________________
    def __init__(self,
                 smWSDL,
                 userName=None,
                 passPhrase=None,
                 smPubKeyFilePath=None,
                 clntPubKeyFilePath=None,
                 clntPriKeyFilePath=None,
                 clntPriKeyPwd=None,
                 aaPubKey=None,
                 scriptName=None,
                 returnURI=None, 
                 trustedHosts=None,
                 wsDebug=False,
                 **cgiFieldStorageKwArgs):
        """scriptName:        name of script to call in forms - defaults to
                              this file.  Modify if you inherit from this
                              class.
        smWSDL:    URI For Session Manager WSDL used for user 
                              authentication
        returnURI:            the address to redirect back to following a 
                              redirect  
                              to the user's home site to obtain their 
                              credentials
        trustedHosts:         dictionary of URIs for trusted hosts indexed by
                              hostname
        wsDebug:              print output from WS transactions to stderr"""
        
        self.smWSDL = smWSDL
        self.userName = userName
        self.passPhrase = passPhrase
        self.smPubKeyFilePath = smPubKeyFilePath
        self.clntPubKeyFilePath = clntPubKeyFilePath
        self.clntPriKeyFilePath = clntPriKeyFilePath
        self.clntPriKeyPwd = clntPriKeyPwd
        self.__aaPubKey = aaPubKey
        
        if scriptName:
            self.scriptName = scriptName
        else:
            self.scriptName = __file__
            
        self.returnURI = returnURI
        self.trustedHosts = trustedHosts
        self.__wsDebug = False
        self.__authorisationMethod = None
        
        cgi.FieldStorage.__init__(self, **cgiFieldStorageKwArgs)

 
    #_________________________________________________________________________
    def processFields(self, **kwargs):
        """Call appropriate actions according to the fields set"""
        
        if 'requestURI' in self:
            # Request credentials from user's home site
            self.requestCreds(**kwargs)
    
        elif 'NDG-ID1' in self and 'NDG-ID2' in self and 'expires' in self:
            # Receive credentials back from home site and set a new cookie at
            # remote site
            self.receiveCredsResponse(self['NDG-ID1'].value, 
                                      self['NDG-ID2'].value,
                                      self['NDG-ID2']['expires'], 
                                      **kwargs)
    
        elif 'authenticate' in self:
            # User has logged on at home site and a cookie is now set - 
            # next step is processCredsRequest() below
            sessCookie = self.authenticate()
            
            if 'returnURI' in self:
                # Authentication is required following a redirect from 
                # another site - redirect back to the remote site returning
                # the cookie information
                self.processCredsRequest(sessCookie=sessCookie,
                                         setCookie=True, 
                                         **kwargs)
                
        elif 'returnURI' in self:
            # Home site receives request from remote site for credentials and
            # returns them
            self.processCredsRequest(**kwargs)
        else:
            # Remote site presents possible sites for user to get their 
            # credentials from
            self.showHomeSiteSelect(**kwargs)
    
    
    #_________________________________________________________________________
    # Use instance name as an alias to processFields method
    __call__ = processFields
    

    #_________________________________________________________________________
    def requestCreds(self,
                     requestURI=None,
                     pageTitle='',
                     headTags='',
                     delayTime=0,
                     redirectMsg=''):
        """Request credentials from a user's home site
        
        requestURI:   site to request credentials from - default is 
                      'requestURI' CGI form value
        pageTitle:    Give the redirect page a title
        headTags:     Optionally add additional tags in <head/> section
        delayTime:    time in seconds before carrying out redirect - redirect
                      page will be displayed in this interval
        redirectMsg:  Message to put on redirect page.  Can be plain text or
                      formatted HTML"""
        
        if requestURI is None:
            requestURI = self['requestURI'].value
            
        print """Content-type: text/html
    
<html>
<head>
<title>%s</title>
<meta http-equiv="REFRESH" content="%d; url=%s?returnURI=%s">
%s
</head>
<body>
%s
</body>
</html>""" % \
    (pageTitle, delayTime, requestURI, self.returnURI, headTags, redirectMsg)
    
    
    #_________________________________________________________________________
    def receiveCredsResponse(self, 
                             sessID,
                             sessMgrURI, 
                             expiry,
                             pageTitle='',
                             hdrTxt='',
                             bodyTxt=''):
        """Remote site receives returned credentials and creates a new cookie 
        for its domain"""
    
        sessCookie = UserSession.createSecurityCookie(sessID,
                                                      sessMgrURI,
                                                      expiryStr=expiry)
    
        print """Content-type: text/html"
%s

<html>
<head>
<title>%s</title>
%s
</head>
<body>
    %s
</body>
</html>""" % (sessCookie.output(), pageTitle, hdrTxt, bodyTxt)
    
    
    #_________________________________________________________________________
    def processCredsRequest(self, 
                            returnURI=None, 
                            sessCookie=None, 
                            **returnCredsKwArgs):
        """Receive request from remote site for credentials.  Process and 
        return via a redirect"""

        if returnURI is None:
            returnURI = self['returnURI'].value
                                                         
        # Check for cookie in environment
        if 'HTTP_COOKIE' in os.environ:
    
            # Get session ID from existing cookie
            sessCookie = SimpleCookie(os.environ['HTTP_COOKIE'])

        
        if sessCookie:
            # Cookie is set - check for NDG cookie
            try:
                UserSession.isValidSecurityCookie(sessCookie, raiseExcep=True)
                
            except UserSessionError, e:
                raise SecurityCGIError, \
                                    'Checking existing session cookie: %s' % e

            # Return cookie to requestor
            self.returnCreds(sessCookie, returnURI, **returnCredsKwArgs)
            
        else:
            # No cookie present - display login.  Submit must redirect back to
            # this script with '?authenticate=1&returnURI=<...>'
            self.showLogin(returnURI=returnURI,
                           setCookie=True,
                           contentTypeHdr=True,
                           pageTitle="NDG Login",
                           htmlTag=True,
                           bodyTag=True)

    
    #_________________________________________________________________________
    def returnCreds(self,
                    sessCookie, 
                    returnURI=None,
                    pageTitle='',
                    hdrTxt='',
                    delayTime=0,
                    redirectMsg='',
                    setCookie=False):
        """User's home site returns credentials to requestor via a HTTP 
        redirect
        
        sessCookie:   NDG Session cookie
        pageTitle:    Give the redirect page a title
        headTags:     Optionally add additional tags in <head/> section
        delayTime:    time in seconds before carrying out redirect - redirect
                      page will be displayed in this interval
        redirectMsg:  Message to put on redirect page.  Can be plain text or
                      formatted HTML"""

        if returnURI is None:
            returnURI = self['returnURI'].value
                                         
        if setCookie:
            cookieTxt = sessCookie.output() + os.line_sep()
        else:
            cookieTxt = ''
            
        print """Content-type: text/html
%s    
<html>
<head>
<title>%s</title>
<meta http-equiv="REFRESH" 
content="%d; url=%s?NDG-ID1=%s&NDG-ID2=%s&expires=%s">
%s
</head>
<body>
%s
</body>
</html>""" % ( cookieTxt,
               pageTitle, 
               delayTime, 
               returnURI, 
               sessCookie['NDG-ID1'].value,
               sessCookie['NDG-ID2'].value,
               base64.b64encode(sessCookie['NDG-ID1']['expires']),
               redirectMsg)    
    
    
    #_________________________________________________________________________
    def authenticate(self, bAuthorise=False):
        """Authenticate username and passphrase input from preceeding login
        form

        bAuthorise: set to True so that if an error occurs, login will be
                    recalled followed by authorisation"""

        if self.__wsDebug:
            traceFile = sys.stderr
        else:
            traceFile = None


        if 'userName' in self:
            self.userName = self['userName'].value
            
        if 'passPhrase' in self:
            self.passPhrase = self['passPhrase'].value
            
            
        if self.userName is None:
            raise SecurityCGIError("no username set for authentication")

        if self.passPhrase is None:
            raise SecurityCGIError("no pass-phrase set for authentication")


        # Instantiate WS proxy and request connection
        try:
            smClient = SessionClient(
                                smWSDL=self.smWSDL,
                                smPubKeyFilePath=self.smPubKeyFilePath,
                                clntPubKeyFilePath=self.clntPubKeyFilePath,
                                clntPriKeyFilePath=self.clntPriKeyFilePath,
                                traceFile=traceFile)

            return smClient.connect(userName=self.userName,
                                    pPhrase=self.passPhrase,
                                    clntPriKeyPwd=self.clntPriKeyPwd)
        except Exception, e:
            raise SecurityCGIError("Session client: " + str(e))
            
    
    #_________________________________________________________________________
    def showLogin(self,
                  returnURI=None,
                  contentTypeHdr=False,
                  htmlTag=False,
                  pageTitle='',
                  hdrTxt='',
                  headTag=False,
                  bodyTag=False,
                  bAuthorise=False):
        """Display initial NDG login form"""
    
        if contentTypeHdr: print "Content-type: text/html\n\n"
        
        if htmlTag: print "<html>"
    
        if headTag:
            if not hdrTxt:
                hdrTxt = """    <style type=\"text/css\">
<!--
.al {
text-align: justify
}
a{
text-decoration:none;
}
a:hover{
color:#0000FF;
}
    body { font-family: Verdana, sans-serif; font-size: 11}
    table { font-family: Verdana, sans-serif; font-size: 11}
-->
</style>"""
                    
            print """<head>
        <title>%s</title>
        %s
    </head>""" % (pageTitle, hdrTxt)
    
    
        if bodyTag: print "<body>"
    
        if returnURI:
            returnURIfield = \
                "<input type=hidden name=returnURI value=\"%s\">" % returnURI
        else:
            returnURIfield = ''
        
    
        if bAuthorise:
            authoriseArg = "<input type=hidden name=authorise value=\"1\">"
        else:
            authoriseArg = ""
    
    
        # Set authorisation method default
        authorisationMethodChk = {  "allowMapping":              '',
                                    "allowMappingWithPrompt" :   '',
                                    "noMapping":                 ''}
    
        if self.__authorisationMethod is None:
            # Default to safest option for user
            authorisationMethodChk["allowMappingWithPrompt"] = ' checked'
        else:
            authorisationMethodChk[self.__authorisationMethod] = ' checked'
    
        print \
    """<script language="javascript">
    <!--
        function toggleLayer(layerId)
        {
            if (document.getElementById)
            {
                // Standard
                var style = document.getElementById(layerId).style;
            }
            else if (document.all)
            {
                // Old msie versions
                var style = document.all[whichLayer].style;
            }
            else if (document.layers)
            {
                // nn4
                var style = document.layers[whichLayer].style;
            }
            style.visibility = style.visibility == "visible" ? "hidden":"visible";
        }
    //-->
    </script>
    <h3>NERC Data Grid Site Login (Test)<BR clear=all></h3>
    <hr>
    
    <form action="%s" method="POST">
    
    <table bgcolor=#ADD8E6 cellspacing=0 border=0 cellpadding=5>
    <tbody>
    <tr><td>User Name:</td> <td><input type=text name=userName value="">
    </td></tr>
    <tr>
        <td>Password:</td>
        <td><input type=password name=passPhrase></td>
    </tr>
    <tr>
        <td colspan="2" align="right">
            <a href="javascript:toggleLayer('advSettings');">Advanced Settings</a>
            <input type=submit value="Login">
        </td>
    </tr>
    <input type=hidden name=authenticate value="1">
    %s"""  % (self.scriptName, returnURIfield)
    
        print \
    """</tbody></table>
    <br>
    <div id="advSettings" style="position: relative; visibility: hidden;">
        <h4>Role Mapping for access to other trusted sites</h4>
        <p>Your account has roles or <i>privileges</i> which determine what data you have access to.  If you access data at another NDG trusted site, these roles can be mapped to local roles at that site to help you gain access:
        </p>
        <table bgcolor=#ADD8E6 cellspacing=0 border=0 cellpadding=5>
        <tbody>
        <tr>
        <td>
            <input type="radio" name="authorisationMethod" value="allowMapping"%s>
        </td>
            <td>
                Allow my roles to be mapped to local roles at other NDG trusted sites.
            </td>
        </tr>
        <tr>
            <td>
                <input type="radio" name="authorisationMethod" value="allowMappingWithPrompt"%s>
            </td>
        <td>
            Allow my roles to be mapped, but prompt me so that I may choose which roles to map before gaining access.
        </td>
        <tr>
        <td>
            <input type="radio" name="authorisationMethod" value="noMapping"%s>
        </td>
        <td>
            Don't allow mapping of my roles.
        </td>
        </tr>
        </tbody>
        </table>
    </div>
    </form>
    """ % (authorisationMethodChk['allowMapping'], \
           authorisationMethodChk['allowMappingWithPrompt'], \
           authorisationMethodChk['noMapping'])
    
        if bodyTag: print "</body>"
        if htmlTag: print "</html>"
    
        # end of showLogin()
    
    
    def showHomeSiteSelect(self,
                           trustedHosts=None,
                           scriptName=None,
                           contentTypeHdr=False,
                           htmlTag=False,
                           hdrTag=False,
                           hdrTxt='',
                           bodyTag=False,
                           pageTitle=""):

        if trustedHosts:
            self.trustedHosts = trustedHosts
        
        if scriptName:
            self.scriptName = scriptName
            
                
        if contentTypeHdr:
            print "Content-type: text/html\n\n"
                
        if htmlTag:
            print "<html>\n"

        if hdrTag:            
            if not hdrTxt:
                hdrTxt = """    <style type=\"text/css\">
<!--
.al {
text-align: justify
}
a{
text-decoration:none;
}
a:hover{
color:#0000FF;
}
    body { font-family: Verdana, sans-serif; font-size: 11}
    table { font-family: Verdana, sans-serif; font-size: 11}
-->
</style>"""

            print """<head>
            
    <title>%s</title>
    %s
</head>""" % (pageTitle, hdrTxt)
    
    
        if bodyTag:
            print "<body>\n"

            print """
    <form action="%s" method="POST">
    <table bgcolor=#ADD8E6 cellspacing=0 border=0 cellpadding=5>
    <tbody>
    <tr>
      <td>
        <select name="requestURI">        
          <option value="">Select your home site...""" % self.scriptName
          
            for hostname, uri in trustedHosts.items():
                print "<option value=\"%s\">%s" % (uri, hostname)
                
            print \
"""        </select>
      </td>
      <td align="right">
        <input type=submit value="Go">
      </td>
    </tr>
    </tbody>
    </table>
    </form>"""

        if bodyTag:
            print "</body>\n"

        if htmlTag:
            print "</html>\n"
    
        # end of showHomeSiteSelect()
        
        
if __name__ == "__main__":
    clntPubKeyFilePath = "../certs/GabrielCGI-cert.pem"
    clntPriKeyFilePath = "../certs/GabrielCGI-key.pem"

    securityCGI = SecurityCGI("http://gabriel.bnsc.rl.ac.uk/sessionMgr.wsdl",
                 smPubKeyFilePath="/usr/local/NDG/conf/certs/gabriel-sm-cert.pem,
                 clntPubKeyFilePath=clntPubKeyFilePath,
                 clntPriKeyFilePath=clntPriKeyFilePath,
                 returnURI="https://gabriel.bnsc.rl.ac.uk/cgi-bin/security.py", 
                 trustedHosts=None)
    securityCGI()