source: TI12-security/trunk/python/ndg.security.server/ndg/security/server/wsgi/authn.py @ 5224

"""Module containing:
 * HTTP Basic Authentication Middleware
 * middleware to enable redirection to OpenID Relying Party for login
 * logout middleware for deleting AuthKit cookie and redirecting back to 
   referrer
 
NERC DataGrid Project
"""
__author__ = "P J Kershaw"
__date__ = "13/01/09"
__copyright__ = "(C) 2009 Science and Technology Facilities Council"
__license__ = "BSD - see LICENSE file in top-level directory"
__contact__ = "Philip.Kershaw@stfc.ac.uk"
__revision__ = "$Id$"
import logging
log = logging.getLogger(__name__)
from authkit.permissions import UserIn

from ndg.security.server.wsgi.utils.sessionmanagerclient import \
    WSGISessionManagerClient

class HTTPBasicAuthentication(object):
    '''Authkit based HTTP Basic Authentication'''
    def __init__(self):
        self._userIn = UserIn([])
        
    def __call__(self, environ, username, password):
        """validation function"""
        try:
            client = WSGISessionManagerClient(environ=environ,
                                    environKeyName=self.sessionManagerFilterID)
            res = client.connect(username, passphrase=password)

            if username not in self._userIn.users:
                self._userIn.users += [username]
            
            # TODO: set session
                
        except Exception, e:
            return False
        else:
            return True


import urllib
from urlparse import urlparse
from paste.request import construct_url
from beaker.middleware import SessionMiddleware
import authkit.authenticate

from ndg.security.server.wsgi import NDGSecurityMiddlewareBase, \
    NDGSecurityMiddlewareConfigError

class AuthenticationRedirectMiddleware(NDGSecurityMiddlewareBase):
    '''Middleware to redirect to another URI if no user is set in the 
    REMOTE_USER key of environ
    
    AuthKit.authenticate.middleware must be in place upstream of this 
    middleware.  AuthenticationMiddleware wrapper handles this.'''
    propertyDefaults = {
        'redirectURI': None,
        'sessionKey': 'beaker.session'
    }
    propertyDefaults.update(NDGSecurityMiddlewareBase.propertyDefaults)

    return2URIArgName = 'ndg.security.r'
    
    _isAuthenticated = lambda self: 'REMOTE_USER' in self.environ
    isAuthenticated = property(fget=_isAuthenticated,
                               doc='boolean for is user logged in')

    triggerStatus = '401'
    id = 'authNMiddleware'

    def __init__(self, app, global_conf, **app_conf):
        self._redirectURI = None
        super(AuthenticationRedirectMiddleware, self).__init__(app, 
                                                               global_conf, 
                                                               **app_conf)
        
    @NDGSecurityMiddlewareBase.initCall
    def __call__(self, environ, start_response):
        '''Invoke redirect if user is not authenticated'''
        
        if not self.isAuthenticated:
            # Redirect to OpenID Relying Party URI for user OpenID entry
            return self._setRedirectResponse()
        
        else:
            # Retrieve OpenID response parameters and set a Forbidden response
            # to trigger the PEP to check to see if the requested URI is a 
            # secured one
            
            def set403Response(status, header, exc_info=None):
                return start_response(self.getStatusMessage(403),
                                      header,
                                      exc_info)
                
            return self._app(environ, set403Response)            
   
    def _setRedirectURI(self, uri):
        if not isinstance(uri, basestring):
            raise TypeError("Redirect URI must be set to string type")   
         
        self._redirectURI = uri
        
    def _getRedirectURI(self):
        return self._redirectURI
    
    redirectURI = property(fget=_getRedirectURI,
                       fset=_setRedirectURI,
                       doc="URI to redirect to if user is not authenticated")

    def _setRedirectResponse(self):
        """Construct a redirect response adding in a return to address in a
        URI query argument
        
        @rtype: basestring
        @return: redirect response
        """
        
        return2URI = construct_url(self.environ)
        quotedReturn2URI = urllib.quote(return2URI, safe='')
        return2URIQueryArg = urllib.urlencode(
                    {AuthenticationRedirectMiddleware.return2URIArgName: 
                     quotedReturn2URI})

        redirectURI = self.redirectURI
        
        if '?' in redirectURI:
            if redirectURI.endswith('&'):
                redirectURI += return2URIQueryArg
            else:
                redirectURI += '&' + return2URIQueryArg
        else:
            if redirectURI.endswith('?'):
                redirectURI += return2URIQueryArg
            else:
                redirectURI += '?' + return2URIQueryArg
                
        return self._redirect(redirectURI)
        
    @classmethod
    def checker(cls, environ, status, headers):
        """Set the trigger for calling this middleware.  In this case, it's a
        HTTP 401 Unauthorized response detected in the middleware chain
        """
        log.debug("%s.checker received status %r, "
                  "headers %r", cls.__name__, status, headers)
        
        if status.startswith(cls.triggerStatus):
            log.debug("%s.checker caught status %s: invoking authentication "
                      "handler", cls.__name__, cls.triggerStatus)
            return True
        else:
            log.debug("%s.checker skipping status %s", cls.__name__, status)
            return False


class SessionHandlerMiddleware(NDGSecurityMiddlewareBase):
    '''Middleware to redirect back to referrer URI following call to a logout
    URI as implemented in AuthKit'''
    prefix = 'sessionHandler.'
    
    logoutReturn2URIArgName = 'ndg.security.logout.r'
    propertyDefaults = {
        'signoutPath': None,
        'sessionKey': 'beaker.session.ndg.security'
    }
    propertyDefaults.update(NDGSecurityMiddlewareBase.propertyDefaults)


    def __init__(self, app, global_conf, prefix='', **app_conf):
        super(SessionHandlerMiddleware, self).__init__(app, 
                                                       global_conf,
                                                       prefix=prefix, 
                                                       **app_conf)
        
    @NDGSecurityMiddlewareBase.initCall
    def __call__(self, environ, start_response):
        session = environ[self.sessionKey]
        
        if self.signoutPath and self.pathInfo == self.signoutPath:
            referer = session.get(self.__class__.logoutReturn2URIArgName)
            if referer is not None:
                def _start_response(status, header, exc_info=None):
                    header.extend([('Location', referer)])
                    return start_response(self.getStatusMessage(302), 
                                          header,
                                          exc_info)
                    
            else:
                log.error('No referer set for redirect following logout')
                _start_response = start_response
                
            # Clear user details from beaker session
            session.pop('username', None)
            session.pop('sessionManagerURI', None)
            session.pop('sessionId', None)
            session.save()
        else:
            if 'username' not in session and 'REMOTE_USER' in environ:
                session['username'] = environ['REMOTE_USER']
                
            if environ.get('REMOTE_USER_DATA', ''):
                # eval is safe here because AuthKit cookie is signed and 
                # AuthKit middleware checks for tampering
                if 'sessionManagerURI' not in session or \
                   'sessionId' not in session:
                    axData = eval(environ['REMOTE_USER_DATA'])
                    sessionManagerURI=axData['ax']['value.sessionManagerURI.1']
                    session['sessionManagerURI'] = sessionManagerURI

                    sessionId = axData['ax']['value.sessionId.1']
                    session['sessionId'] = sessionId
                    
                # Reset cookie removing user data
                environ['paste.auth_tkt.set_user'](session['username'])
                
            # Set a return to address for logout
            session[self.__class__.logoutReturn2URIArgName] = self.pathInfo
            session.save()
                      
            _start_response = start_response
            
        return self._app(environ, _start_response)


from authkit.authenticate.multi import MultiHandler

class AuthenticationMiddlewareConfigError(NDGSecurityMiddlewareConfigError):
    '''Authentication Middleware Configuration error'''

class AuthenticationMiddleware(MultiHandler, NDGSecurityMiddlewareBase):
    '''Handler to intercept 401 Unauthorized HTTP responses and redirect to an
    authentication URI.  This class also implements a redirect handler to
    redirect back to the referrer if logout is invoked.
    '''

    def __init__(self, app, global_conf, prefix='', **app_conf):
        '''
        @type app: callable following WSGI interface
        @param app: next middleware application in the chain      
        @type global_conf: dict        
        @param global_conf: PasteDeploy global configuration dictionary
        @type prefix: basestring
        @param prefix: prefix for configuration items
        @type app_conf: dict        
        @param app_conf: PasteDeploy application specific configuration 
        dictionary
        '''
        
        # Set logout URI parameter from AuthKit settings if not otherwise set
        sessionHandlerPrefix = prefix + SessionHandlerMiddleware.prefix
        signoutPathParamName = sessionHandlerPrefix + 'signoutPath'
        if signoutPathParamName not in app_conf:
            try:                   
                app_conf[signoutPathParamName] = app_conf[
                                                'authkit.cookie.signoutpath']
            except KeyError, e:
                raise AuthenticationMiddlewareConfigError("No %s or %s keys "
                                                    "set" % 
                                                    (signoutPathParamName, e))
        
        app = SessionHandlerMiddleware(app, 
                                       global_conf, 
                                       prefix=sessionHandlerPrefix,
                                       **app_conf)
        
        # Remove session handler middleware specific parameters
        for k in app_conf.keys():
            if k.startswith(sessionHandlerPrefix):
                del app_conf[k]
        
        app = authkit.authenticate.middleware(app, app_conf)        
        app = SessionMiddleware(app, 
                                environ_key='beaker.session.ndg.security',
                                **app_conf)
        
        MultiHandler.__init__(self, app)

        self.add_method(AuthenticationRedirectMiddleware.id, 
                        AuthenticationRedirectMiddleware.filter_app_factory, 
                        global_conf,
                        prefix=prefix,
                        **app_conf)
        
        self.add_checker(AuthenticationRedirectMiddleware.id, 
                         AuthenticationRedirectMiddleware.checker)