source: TI12-security/trunk/python/ndg.security.common/ndg/security/common/SessionMgr/__init__.py @ 2085

#!/usr/bin/env python
"""NDG Security client - client interface classes to Session Manager 

Make requests for authentication and authorisation

NERC Data Grid Project

P J Kershaw 24/04/06

Copyright (C) 2006 CCLRC & NERC

This software may be distributed under the terms of the Q Public License,
version 1.0 or later.
"""
__all__ = ['SessionMgr_services', 'SessionMgr_services_types']

import sys
import os

# Handle retrieval of public key cert for Session Manager/Attribute Authority
# at remote location
import tempfile
import urllib

from ndg.security.common.SessionCookie import SessionCookie
from ndg.security.common.wsSecurity import SignatureHandler
from ndg.security.common.X509 import *
from ndg.security.common.AttCert import AttCertParse
from SessionMgr_services import SessionMgrServiceLocator


#_____________________________________________________________________________
class SessionMgrClientError(Exception):
    """Exception handling for SessionMgrClient class"""

#_____________________________________________________________________________
class AttributeRequestDenied(Exception):
    """Raise when a getAttCert call to the Attribute Authority is denied"""

#_____________________________________________________________________________       
class SessionMgrClient(object):
    """Client interface to Session Manager Web Service"""
    
    #_________________________________________________________________________
    def __init__(self, uri=None, tracefile=None, **signatureHandlerKw):
        """
        @type uri: string
        @keyword uri: URI for Session Manager WS.  Setting it will set the 
        Service Proxy
                
        @type tracefile: file stream type
        @param tracefile: set to file object such as sys.stderr to give extra 
        WS debug information
        
        @type signatureHandlerKw: dict
        @param signatureHandlerKw: keywords to configure signature handler"""

        self.__srv = None
        self.__uri = None
        
        self.__srvCertTempFile = None
        
        
        if uri:
            self.__setURI(uri)

        # WS-Security Signature handler
        self.__signatureHandler = SignatureHandler(**signatureHandlerKw)
        
        self.__tracefile = tracefile

         
        # Instantiate Session Manager WS ZSI client
        if self.__uri:
            self.initService()
        

    #_________________________________________________________________________
    def __setURI(self, uri):
        "Set URI property method"
        
        if not isinstance(uri, basestring):
            raise SessionMgrClientError, \
                             "Session Manager WSDL URI must be a valid string"
        
        self.__uri = uri
        
    uri = property(fset=__setURI, doc="Set Session Manager URI")


    #_________________________________________________________________________
    def __getSignatureHandler(self):
        "Get SignatureHandler object property method"
        return self.__signatureHandler
    
    signatureHandler = property(fget=__getSignatureHandler,
                                doc="SignatureHandler object")
    
    
    #_________________________________________________________________________
    def __getSrvX509Cert(self):
        """Retrieve the X.509 certificate from file or if not available, from
        the Session Manager service"""
        
        # Don't proceed unless URI was set - user may have set public key via
        # srvCertFilePath instead
        if self.__srvCertFilePath is not None:
            return
                
        try:
            self.__srvCertTempFile = tempfile.NamedTemporaryFile()
            
            cert = self.getX509Cert()
            open(self.__srvCertTempFile.name, "w").write(cert)
            
            self.__srvCertFilePath = self.__srvCertTempFile.name
            
        except IOError, (errNo, errMsg):
            raise SessionMgrClientError, \
                            "Writing X.509 certificate to temp \"%s\": %s" % \
                            (self.__srvCertTempFile.name, errMsg)                                                                    
        except Exception, e:
            raise SessionMgrClientError, "Retrieving Session Manager " + \
                                         "X.509 certificate: %s" % str(e)
    
        
    #_________________________________________________________________________
    def initService(self, uri=None):
        """Set the WS client for the Session Manager"""
        if uri:
            self.__setURI(uri)
    
        # WS-Security Signature handler object is passed to binding
        try:
            locator = SessionMgrServiceLocator()
            self.__srv = locator.getSessionMgr(self.__uri,
                                       sig_handler=self.__signatureHandler,
                                       tracefile=self.__tracefile)
        except HTTPResponse, e:
            raise SessionMgrClientError, \
                "Initialising Service for \"%s\": %s %s" % \
                (self.__uri, e.status, e.reason)
            
        except Exception, e:
            raise SessionMgrClientError, \
                "Initialising Service for \"%s\": %s" % (self.__uri, str(e))

                                    
    #_________________________________________________________________________
    def addUser(self,
                username,
                passphrase=None,
                passphraseFilePath=None,
                clntPriKeyPwd=None):
        """Register a new user
        
        username:                the username for the new user 
        passphrase:                 user's pass-phrase
        passphraseFilePath:         a file containing the user's pass-phrase.  
                                 Use this as an alternative to passphrase keyword
        clntPriKeyPwd:           pass-phrase if any for the client's private
                                 key used to decrypt response from
                                 Session Manager
        """
    
        if passphrase is None:
            try:
                passphrase = open(passphraseFilePath).read().strip()
            
            except Exception, e:
                raise SessionMgrClientError, "Pass-phrase not defined: " + \
                                            str(e)
            
    
        # Make request for new user
        try:   
            self.__srv.addUser(username, passphrase)

        except Exception, e:
            raise SessionMgrClientError, "Adding new user: " + str(e)
    
        
    #_________________________________________________________________________   
    def connect(self,
                username,
                passphrase=None,
                passphraseFilePath=None,
                getCookie=False,
                createServerSess=True):
        """Request a new user session from the Session Manager
        
        @type username: string
        @param username: the username of the user to connect
        
        @type passphrase: string
        @keyword passphrase: user's pass-phrase
        
        @type passphraseFilePath: string
        @keyword passphraseFilePath: a file containing the user's pass-phrase.  
        Use this as an alternative to passphrase keyword.
                                 
        @type getCookie: bool
        @keyword getCookie: If set to True, return a cookie to be set in 
        a web browser client.  
                                 
        @type createServerSess: bool
        @keyword createServerSess: If set to True, the SessionMgr will create
        and manage a session for the user but note, this flag is ignored and 
        set to True if getCookie is set.  For command line case, where 
        getCookie is False, it's possible to choose to have a client or server
        side session using this keyword.
        
        @rtype: tuple
        @return proxy cert, proxy private key, user cert and cookie all as
        strings but cookie will be None if the getCookie keyword is False"""
    
        if passphrase is None:
            try:
                passphrase = open(passphraseFilePath).read().strip()
            
            except Exception, e:
                raise SessionMgrClientError, "Pass-phrase not defined: " + \
                                             str(e)

        # Make connection
        try: 
            userID = self.__srv.connect(username, 
                                        passphrase,
                                        createServerSess,
                                        getCookie)
            return userID
               
        except Exception, e:
            raise SessionMgrClientError, \
                                    "Connecting to Session Manager: " + str(e)
    
        
    #_________________________________________________________________________   
    def disconnect(self,
                   userCert=None,
                   sessCookie=None,
                   sessID=None,
                   encrSessionMgrURI=None):
        """Delete an existing user session from the Session Manager
        
        disconnect([sessCookie=s]|[sessID=i, encrSessionMgrURI=e]|
                   [userCert=u][key=arg, ...])
                   
        @type userCert:
        @keyword userCert: proxy certificate - use as ID instead of a cookie 
        in the case of a command line client.
        
        @type sessCookie: ndg.security.common.SessionCookie or string                 
        @keyword sessCookie: session cookie returned from call to connect() 
        for a browser client.  
                               
        @type sessID: string
        @keyword sessID: session ID.  Input this as well as encrSessionMgrURI 
        as an alternative to sessCookie in the case of a browser client.
        
        @type encrSessionMgrURI: string
        @keyword encrSessionMgrURI: encrypted Session Manager URI."""

        # Checking authentication details: either a proxy cert, 
        # session cookie, or session ID/encrypted Session Manager URI
        # combination
        if sessCookie:
            if isinstance(sessCookie, basestring):
                try:
                    sessCookie = SessionCookie(sessCookie)
                except Exception, e:
                    raise SessionMgrClientError, \
                                    "Error parsing session cookie: " + str(e)

            sessID = sessCookie.sessionID
            encrSessionMgrURI = sessCookie.encrSessionMgrURI
            
        elif not sessID and not encrSessionMgrURI:
            raise SessionMgrClientError, '"sessCookie or "sessID" and ' + \
                                '"encrSessionMgrURI" keywords must be set'

        # Make connection
        try: 
            self.__srv.disconnect(userCert, sessID, encrSessionMgrURI)
               
        except Exception, e:
            raise SessionMgrClientError, \
                        "Disconnecting from Session Manager: " + str(e)
   
    
    #_________________________________________________________________________ 
    def getAttCert(self,
                   proxyCert=None,
                   sessCookie=None,
                   sessID=None,
                   encrSessionMgrURI=None,
                   attAuthorityURI=None,
                   attAuthorityCert=None,
                   reqRole=None,
                   mapFromTrustedHosts=True,
                   rtnExtAttCertList=False,
                   extAttCertList=[],
                   extTrustedHostList=[]):    
        """Request NDG Session Manager Web Service to retrieve an Attribute
        Certificate from the given Attribute Authority and cache it in the
        user's credential wallet held by the session manager.
        
        getAttCert([sessCookie=s]|[sessID=i, encrSessionMgrURI=e]|
                   [proxyCert=p][key=arg, ...])
                   
        proxyCert:             proxy certificate - use as ID instead of 
                               a cookie in the case of a command line client.
        sessCookie:            session cookie returned from call to connect() 
                               for a browser client.  Input as a string or
                               SimpleCookie type.
        sessID:                session ID.  Input this as well as 
                               encrSessionMgrURI as an alternative to 
                               sessCookie in the case of a browser client.
        encrSessionMgrURI:     encrypted Session Manager URI.
        attAuthorityURI:       URI for Attribute Authority WS.
        attAuthorityCert:      The Session Manager uses the Public key of the
                               Attribute Authority to encrypt requests to it.
        reqRole:               The required role for access to a data set.
                               This can be left out in which case the 
                               Attribute Authority just returns whatever
                               Attribute Certificate it has for the user
        mapFromTrustedHosts:   Allow a mapped Attribute Certificate to be
                               created from a user certificate from another
                               trusted host.
        rtnExtAttCertList:     Set this flag True so that if authorisation is 
                               denied, a list of potential attribute 
                               certificates for mapping may be returned. 
        extAttCertList:        A list of Attribute Certificates from other
                               trusted hosts from which the target Attribute
                               Authority can make a mapped certificate
        extTrustedHostList:    A list of trusted hosts that can be used to
                               get Attribute Certificates for making a mapped
                               AC.
        """
        
        # Checking authentication details: either a proxy cert, 
        # session cookie, or session ID/encrypted Session Manager URI
        # combination
        if sessCookie:
            if isinstance(sessCookie, basestring):
                try:
                    sessCookie = SessionCookie(sessCookie)
                except Exception, e:
                    raise SessionMgrClientError, \
                                    "Error parsing session cookie: " + str(e)

            sessID = sessCookie.sessionID
            encrSessionMgrURI = sessCookie.encrSessionMgrURI
            
        elif not sessID and not encrSessionMgrURI and not proxyCert:
            raise SessionMgrClientError, \
                '"proxyCert" or "sessCookie or "sessID" and ' + \
                '"encrSessionMgrURI" keywords must be set'

            
        # Make request
        try:
            attCert, msg, extAttCertList = self.__srv.getAttCert(proxyCert,
                                                       sessID, 
                                                       encrSessionMgrURI,
                                                       attAuthorityURI,
                                                       attAuthorityCert,
                                                       reqRole,
                                                       mapFromTrustedHosts,
                                                       rtnExtAttCertList,
                                                       extAttCertList,
                                                       extTrustedHostList)
        except Exception, e:
            raise SessionMgrClientError, \
                                "Attribute Certificate request: " + str(e)
        if not attCert:
            raise AttributeRequestDenied, msg
        
        return attCert, extAttCertList
    
                                    
    #_________________________________________________________________________
    def getX509Cert(self):
        """Retrieve the public key of the Session Manager"""
        
        try:   
            resp = self.__srv.getX509Cert()
            return resp
        
        except Exception, e:
            raise SessionMgrClientError, "Retrieving X.509 certificate: " + \
                                         str(e)