Changeset 7057 for TI12-security/trunk/MyProxyWebService

Timestamp:

23/06/10 09:33:00 (10 years ago)

Author:

pjkersha

Message:

Incomplete - task 5: MyProxy? Web Service Interface

• Removed HTML keygen interface - it won't work with existing MyProxy? API as this expects a signed certificate request.

Location:

TI12-security/trunk/MyProxyWebService/myproxy/server

Files:

• test/keygen.html (deleted)
• wsgi/middleware.py (modified) (2 diffs)

TI12-security/trunk/MyProxyWebService/myproxy/server/wsgi/middleware.py

@@ -335 +335 @@
             
             requestMethod = environ.get('REQUEST_METHOD')                         
-            certReqKey = self.__class__.CERT_REQ_POST_PARAM_KEYNAME
-            
-            if requestMethod == 'POST':
-                pemCertReq = request.POST.get(certReqKey)
-                if pemCertReq is None:
-                    response = ("No %r form variable set in POST message" % 
-                                certReqKey)
-                    log.error(response)
-                    raise HttpBasicAuthResponseException(response, 
-                                                         httplib.BAD_REQUEST)
-            
-                log.debug("cert req = %r", pemCertReq)
-                
-                # Expecting PEM encoded request
-                try:
-                    certReq = crypto.load_certificate_request(
-                                                            crypto.FILETYPE_PEM,
-                                                            pemCertReq)
-                except crypto.Error, e:
-                    log.error("Error loading input certificate request: %r", 
-                              pemCertReq)
-                    raise HttpBasicAuthResponseException("Error loading input "
-                                                         "certificate request",
-                                                         httplib.BAD_REQUEST)
-                
-                # Convert to ASN1 format expect by logon client call
-                asn1CertReq = crypto.dump_certificate_request(
-                                                        crypto.FILETYPE_ASN1, 
-                                                        certReq)
-                
-                # Alternative, GET method would set this variable, set to None
-                # here to correctly initialise MyProxy.logon call
-                pubKey = None
-                
-            elif requestMethod == 'GET':
-                # Interpret as a HTML keygen request.  See:
-                # https://developer.mozilla.org/en/HTML/Element/keygen
-                # A Netscape Signed Public Key and Challenge (SPKAC) is set as a
-                # query argument
-                spkac = request.GET.get(certReqKey)
-                if spkac is None:
-                    response = ("No %r query argument set in GET request" % 
-                                certReqKey)
-                    log.error(response)
-                    raise HttpBasicAuthResponseException(response, 
-                                                         httplib.BAD_REQUEST) 
-                
-                # Remove any carriage returns to enable PyOpenSSL interface to
-                # correctly parse
-                strippedSpkac = ''.join(re.split('\s+', spkac))
-                try:
-                    spki = crypto.NetscapeSPKI(strippedSpkac)
-                    
-                except crypto.Error, e:
-                    log.error("Error loading input signed public key and "
-                              "challenge: %r", spkac)
-                    raise HttpBasicAuthResponseException("Error loading input "
-                                                         "Signed Public Key "
-                                                         "and challenge",
-                                                         httplib.BAD_REQUEST)
-                
-                # Extract public key 
-                try:
-                    pubKey = spki.get_pubkey()
-                    
-                except crypto.Error, e:
-                    log.error("Error extracting public key from input "
-                              "signed public key and challenge: %r", spkac)
-                    raise HttpBasicAuthResponseException("Error procesing "
-                                                         "input Signed Public "
-                                                         "Key and challenge",
-                                                         httplib.BAD_REQUEST)
-                    
-                # Alternative, POST method would set this variable, set to None
-                # here to correctly initialise MyProxy.logon call
-                certReq = crypto.X509Req()
-                certReq.set_pubkey(pubKey)
-                asn1CertReq = crypto.dump_certificate_request(
-                                                        crypto.FILETYPE_ASN1, 
-                                                        certReq)
-            else:
+            if requestMethod != 'POST':
                 response = "HTTP Request method not recognised"
                 log.error("HTTP Request method %r not recognised", 
@@ -421 +341 @@
                 raise HttpBasicAuthResponseException(response, 
                                                      httplib.METHOD_NOT_ALLOWED)
+                
+            certReqKey = self.__class__.CERT_REQ_POST_PARAM_KEYNAME
+            pemCertReq = request.POST.get(certReqKey)
+            if pemCertReq is None:
+                response = ("No %r form variable set in POST message" % 
+                            certReqKey)
+                log.error(response)
+                raise HttpBasicAuthResponseException(response, 
+                                                     httplib.BAD_REQUEST)
+        
+            log.debug("cert req = %r", pemCertReq)
+            
+            # Expecting PEM encoded request
+            try:
+                certReq = crypto.load_certificate_request(
+                                                        crypto.FILETYPE_PEM,
+                                                        pemCertReq)
+            except crypto.Error, e:
+                log.error("Error loading input certificate request: %r", 
+                          pemCertReq)
+                raise HttpBasicAuthResponseException("Error loading input "
+                                                     "certificate request",
+                                                     httplib.BAD_REQUEST)
+            
+            # Convert to ASN1 format expect by logon client call
+            asn1CertReq = crypto.dump_certificate_request(
+                                                    crypto.FILETYPE_ASN1, 
+                                                    certReq)
 
             try: