source: mauRepo/dj_security_middleware/tags/v_0_8/dj_security_middleware/dj_security_middleware/middleware.py @ 8744

'''
BSD Licence
Copyright (c) 2012, Science & Technology Facilities Council (STFC)
All rights reserved.

Redistribution and use in source and binary forms, with or without modification, 
are permitted provided that the following conditions are met:

    * Redistributions of source code must retain the above copyright notice, 
        this list of conditions and the following disclaimer.
    * Redistributions in binary form must reproduce the above copyright notice,
        this list of conditions and the following disclaimer in the documentation
        and/or other materials provided with the distribution.
    * Neither the name of the Science & Technology Facilities Council (STFC) 
        nor the names of its contributors may be used to endorse or promote 
        products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, 
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, 
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Created on 2 Nov 2012

@author: mnagni
''' 
from paste.auth import auth_tkt
from paste.auth.auth_tkt import BadTicket
from django.conf import settings
from dj_security_middleware.exception import DJMiddlewareException,\
    MissingCookieException
from django.utils.http import urlencode
from django.http import HttpResponseRedirect
import socket
import logging
import urlparse
import re
import base64
from django.contrib.auth.views import logout
from cookielib import CookieJar

# Get an instance of a logger
LOGGER = logging.getLogger()

LOGIN_SERVICE_ERROR = 'No LOGIN_SETTING parameter is defined in the \
application settings.py file. Please define a proper URL to the \
authenticating service'

DJ_SECURITY_SHAREDSECRET_ERROR = 'No DJ_SECURITY_SHAREDSECRET parameter \
is defined in the application settings.py file. \
Please define it accordingly to the used LOGIN_SERVICE'

AUTHENTICATION_COOKIE_MISSING = 'The expected cookie is missing. \
Redirect to the authentication service'

DJ_MIDDLEWARE_IP_ERROR = 'No DJ_MIDDLEWARE_IP parameter \
is defined in the application settings.py file. \
Please define it accordingly to the machine/proxy seen by the LOGIN_SERVICE'

AUTH_TKT = 'auth_tkt'

class DJ_Security_Middleware(object):
    """
        Validates if the actual user is authenticated agains a 
        given authentication service.
        Actually the middleware intercepts all the requests submitted 
        to the underlying Django application and verifies if the presence 
        or not of a valid paste cookie in the request.
    """    
    def process_request(self, request):
        url_fiters = getattr(settings, 'DJ_SECURITY_FILTER', None)
        if url_fiters \
            and security_url_filter(request.path, url_fiters):
            return
        
        if not getattr(settings, 'DJ_SECURITY_LOGIN_SERVICE', None):
            raise DJMiddlewareException(LOGIN_SERVICE_ERROR)  
        if not getattr(settings, 'DJ_SECURITY_SHAREDSECRET', None):
            raise DJMiddlewareException(DJ_SECURITY_SHAREDSECRET_ERROR)
        
        custom_auth = getattr(settings, 'DJ_SECURITY_AUTH_CHECK', None)
        if custom_auth:
            try:
                if custom_auth(request):
                    return
            #Cannot specify the Exception type as don't know the
            # exceptions type raised by custom_auth                  
            except Exception:
                pass
        
        #if not settings.DJ_MIDDLEWARE_IP:
        #    raise DJMiddlewareException(DJ_MIDDLEWARE_IP_ERROR)        
         
        try:
            timestamp, userid, tokens, user_data = _is_authenticated(request)
            request.authenticated_user = {'timestamp': timestamp, \
                                             'userid': userid, \
                                             'tokens': tokens, \
                                             'user_data': user_data}
            LOGGER.debug("stored in request - userid:%s, user_data:%s" % (userid, user_data))
            pass
        except MissingCookieException as ex:
            LOGGER.info("Missing 'auth_tkt' cookie")
        except DJMiddlewareException as ex:        
            LOGGER.info(ex)
        url = '%s?%s' % (settings.DJ_SECURITY_LOGIN_SERVICE, _build_ret_url(request))
        LOGGER.info("error in authentication. Redirecting to %s" % (url))
        return HttpResponseRedirect(url)           
            
    def process_response(self, request, response):
        if len(request.REQUEST.get('logout', '')) > 0:
            response.delete_cookie(AUTH_TKT)
        return response 

def _build_ret_url(request):
    hostname = socket.getfqdn()
    if request.META['SERVER_PORT'] != 80:
        hostname = "%s:%s" % (hostname, request.META['SERVER_PORT'])
    qs = {}
    qs['r'] = base64.b64encode('http://%s%s?%s' % (hostname, request.path, request.GET.urlencode()))
    return urlencode(qs)           

def _is_authenticated(request):
    """
        Verifies the presence and validity of a paste cookie.
        If the cookie is not present the request is redirected 
        to the url specified in LOGIN_SERVICE
        ** Return ** a tuple containing (timestamp, userid, tokens, user_data)
        ** raise ** a DJ_SecurityException if the ticket is not valid
    """ 
    if AUTH_TKT in request.COOKIES:
        LOGGER.debug("Found auth_tkt: %s in cookies" % (request.COOKIES.get('auth_tkt')))
        try:
            
            return auth_tkt.parse_ticket(
                    settings.DJ_SECURITY_SHAREDSECRET, 
                    request.COOKIES.get(AUTH_TKT, ''), 
                    _get_host_ip())
        except BadTicket as ex:
            raise DJMiddlewareException(ex) 
    raise MissingCookieException(AUTHENTICATION_COOKIE_MISSING)
   
def _calculate_remote_ip(url_path):   
    remote_url = urlparse.urlparse(url_path)
    LOGGER.debug("calculating remote_ip for %s" % (str(remote_url)))
    port = 80
    host = None
    if remote_url.netloc:
        host = remote_url.netloc
    elif remote_url.path:
        host = remote_url.path
        
    if not host:
        return None
    
    if ':' in host:
        host, port = host.split(':')
    addrinfo = socket.getaddrinfo(host, int(port))
    LOGGER.debug("%s has remote_ip %s" % (url_path, addrinfo[0][-1][0]))
    for remote_url in addrinfo:
        if not remote_url[-1][0].startswith('127'):
            return remote_url[-1][0]
    return None
    
def _get_host_ip():
    if getattr(settings, 'DJ_MIDDLEWARE_IP', None):
        return settings.DJ_MIDDLEWARE_IP
        
    return _calculate_remote_ip(socket.getfqdn())

def security_url_filter(string, filters):
    """
        Checks a given url request against a list of url filters.
        ** string ** string a url
        ** filters ** a list of strings
        ** RETURN ** True if a match is found, False otherwise
    """ 
    try:        
        result = urlparse.urlparse(string)
        return _security_filter(result.path, filters)
    except AttributeError:
        return False

def _security_filter(string, filters):
    """
        Checks a given strings against a list of strings.
        ** string ** string a url
        ** filters ** a list of strings
    """    
    if not filters or not string or len(string.strip()) == 0:
        return False
    if string in filters:
        return True
    for ifilter in filters:
        if re.match(ifilter, string):
            return True
        
def logout(request):
    """
        Removes the authenticated user's ID from the request and flushes their
        session data, plus remove the auth_cookie
    """
    logout(request)
    CookieJar.clear(name = 'auth_tkt')