##// END OF EJS Templates
authn: Allow to pass in a default value if setting is not available in DB.
johbo -
r236:2440a1e7 default
parent child Browse files
Show More
@@ -1,615 +1,615 b''
1 1 # -*- coding: utf-8 -*-
2 2
3 3 # Copyright (C) 2010-2016 RhodeCode GmbH
4 4 #
5 5 # This program is free software: you can redistribute it and/or modify
6 6 # it under the terms of the GNU Affero General Public License, version 3
7 7 # (only), as published by the Free Software Foundation.
8 8 #
9 9 # This program is distributed in the hope that it will be useful,
10 10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 12 # GNU General Public License for more details.
13 13 #
14 14 # You should have received a copy of the GNU Affero General Public License
15 15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
16 16 #
17 17 # This program is dual-licensed. If you wish to learn more about the
18 18 # RhodeCode Enterprise Edition, including its added features, Support services,
19 19 # and proprietary license terms, please see https://rhodecode.com/licenses/
20 20
21 21 """
22 22 Authentication modules
23 23 """
24 24
25 25 import colander
26 26 import logging
27 27 import time
28 28 import traceback
29 29 import warnings
30 30
31 31 from pyramid.threadlocal import get_current_registry
32 32 from sqlalchemy.ext.hybrid import hybrid_property
33 33
34 34 from rhodecode.authentication.interface import IAuthnPluginRegistry
35 35 from rhodecode.authentication.schema import AuthnPluginSettingsSchemaBase
36 36 from rhodecode.lib import caches
37 37 from rhodecode.lib.auth import PasswordGenerator, _RhodeCodeCryptoBCrypt
38 38 from rhodecode.lib.utils2 import md5_safe, safe_int
39 39 from rhodecode.lib.utils2 import safe_str
40 40 from rhodecode.model.db import User
41 41 from rhodecode.model.meta import Session
42 42 from rhodecode.model.settings import SettingsModel
43 43 from rhodecode.model.user import UserModel
44 44 from rhodecode.model.user_group import UserGroupModel
45 45
46 46
47 47 log = logging.getLogger(__name__)
48 48
49 49 # auth types that authenticate() function can receive
50 50 VCS_TYPE = 'vcs'
51 51 HTTP_TYPE = 'http'
52 52
53 53
54 54 class LazyFormencode(object):
55 55 def __init__(self, formencode_obj, *args, **kwargs):
56 56 self.formencode_obj = formencode_obj
57 57 self.args = args
58 58 self.kwargs = kwargs
59 59
60 60 def __call__(self, *args, **kwargs):
61 61 from inspect import isfunction
62 62 formencode_obj = self.formencode_obj
63 63 if isfunction(formencode_obj):
64 64 # case we wrap validators into functions
65 65 formencode_obj = self.formencode_obj(*args, **kwargs)
66 66 return formencode_obj(*self.args, **self.kwargs)
67 67
68 68
69 69 class RhodeCodeAuthPluginBase(object):
70 70 # cache the authentication request for N amount of seconds. Some kind
71 71 # of authentication methods are very heavy and it's very efficient to cache
72 72 # the result of a call. If it's set to None (default) cache is off
73 73 AUTH_CACHE_TTL = None
74 74 AUTH_CACHE = {}
75 75
76 76 auth_func_attrs = {
77 77 "username": "unique username",
78 78 "firstname": "first name",
79 79 "lastname": "last name",
80 80 "email": "email address",
81 81 "groups": '["list", "of", "groups"]',
82 82 "extern_name": "name in external source of record",
83 83 "extern_type": "type of external source of record",
84 84 "admin": 'True|False defines if user should be RhodeCode super admin',
85 85 "active":
86 86 'True|False defines active state of user internally for RhodeCode',
87 87 "active_from_extern":
88 88 "True|False\None, active state from the external auth, "
89 89 "None means use definition from RhodeCode extern_type active value"
90 90 }
91 91 # set on authenticate() method and via set_auth_type func.
92 92 auth_type = None
93 93
94 94 # List of setting names to store encrypted. Plugins may override this list
95 95 # to store settings encrypted.
96 96 _settings_encrypted = []
97 97
98 98 # Mapping of python to DB settings model types. Plugins may override or
99 99 # extend this mapping.
100 100 _settings_type_map = {
101 101 colander.String: 'unicode',
102 102 colander.Integer: 'int',
103 103 colander.Boolean: 'bool',
104 104 colander.List: 'list',
105 105 }
106 106
107 107 def __init__(self, plugin_id):
108 108 self._plugin_id = plugin_id
109 109
110 110 def __str__(self):
111 111 return self.get_id()
112 112
113 113 def _get_setting_full_name(self, name):
114 114 """
115 115 Return the full setting name used for storing values in the database.
116 116 """
117 117 # TODO: johbo: Using the name here is problematic. It would be good to
118 118 # introduce either new models in the database to hold Plugin and
119 119 # PluginSetting or to use the plugin id here.
120 120 return 'auth_{}_{}'.format(self.name, name)
121 121
122 122 def _get_setting_type(self, name):
123 123 """
124 124 Return the type of a setting. This type is defined by the SettingsModel
125 125 and determines how the setting is stored in DB. Optionally the suffix
126 126 `.encrypted` is appended to instruct SettingsModel to store it
127 127 encrypted.
128 128 """
129 129 schema_node = self.get_settings_schema().get(name)
130 130 db_type = self._settings_type_map.get(
131 131 schema_node.typ.__class__, 'unicode')
132 132 if name in self._settings_encrypted:
133 133 db_type = '{}.encrypted'.format(db_type)
134 134 return db_type
135 135
136 136 def is_enabled(self):
137 137 """
138 138 Returns true if this plugin is enabled. An enabled plugin can be
139 139 configured in the admin interface but it is not consulted during
140 140 authentication.
141 141 """
142 142 auth_plugins = SettingsModel().get_auth_plugins()
143 143 return self.get_id() in auth_plugins
144 144
145 145 def is_active(self):
146 146 """
147 147 Returns true if the plugin is activated. An activated plugin is
148 148 consulted during authentication, assumed it is also enabled.
149 149 """
150 150 return self.get_setting_by_name('enabled')
151 151
152 152 def get_id(self):
153 153 """
154 154 Returns the plugin id.
155 155 """
156 156 return self._plugin_id
157 157
158 158 def get_display_name(self):
159 159 """
160 160 Returns a translation string for displaying purposes.
161 161 """
162 162 raise NotImplementedError('Not implemented in base class')
163 163
164 164 def get_settings_schema(self):
165 165 """
166 166 Returns a colander schema, representing the plugin settings.
167 167 """
168 168 return AuthnPluginSettingsSchemaBase()
169 169
170 def get_setting_by_name(self, name):
170 def get_setting_by_name(self, name, default=None):
171 171 """
172 172 Returns a plugin setting by name.
173 173 """
174 174 full_name = self._get_setting_full_name(name)
175 175 db_setting = SettingsModel().get_setting_by_name(full_name)
176 return db_setting.app_settings_value if db_setting else None
176 return db_setting.app_settings_value if db_setting else default
177 177
178 178 def create_or_update_setting(self, name, value):
179 179 """
180 180 Create or update a setting for this plugin in the persistent storage.
181 181 """
182 182 full_name = self._get_setting_full_name(name)
183 183 type_ = self._get_setting_type(name)
184 184 db_setting = SettingsModel().create_or_update_setting(
185 185 full_name, value, type_)
186 186 return db_setting.app_settings_value
187 187
188 188 def get_settings(self):
189 189 """
190 190 Returns the plugin settings as dictionary.
191 191 """
192 192 settings = {}
193 193 for node in self.get_settings_schema():
194 194 settings[node.name] = self.get_setting_by_name(node.name)
195 195 return settings
196 196
197 197 @property
198 198 def validators(self):
199 199 """
200 200 Exposes RhodeCode validators modules
201 201 """
202 202 # this is a hack to overcome issues with pylons threadlocals and
203 203 # translator object _() not beein registered properly.
204 204 class LazyCaller(object):
205 205 def __init__(self, name):
206 206 self.validator_name = name
207 207
208 208 def __call__(self, *args, **kwargs):
209 209 from rhodecode.model import validators as v
210 210 obj = getattr(v, self.validator_name)
211 211 # log.debug('Initializing lazy formencode object: %s', obj)
212 212 return LazyFormencode(obj, *args, **kwargs)
213 213
214 214 class ProxyGet(object):
215 215 def __getattribute__(self, name):
216 216 return LazyCaller(name)
217 217
218 218 return ProxyGet()
219 219
220 220 @hybrid_property
221 221 def name(self):
222 222 """
223 223 Returns the name of this authentication plugin.
224 224
225 225 :returns: string
226 226 """
227 227 raise NotImplementedError("Not implemented in base class")
228 228
229 229 @property
230 230 def is_headers_auth(self):
231 231 """
232 232 Returns True if this authentication plugin uses HTTP headers as
233 233 authentication method.
234 234 """
235 235 return False
236 236
237 237 @hybrid_property
238 238 def is_container_auth(self):
239 239 """
240 240 Deprecated method that indicates if this authentication plugin uses
241 241 HTTP headers as authentication method.
242 242 """
243 243 warnings.warn(
244 244 'Use is_headers_auth instead.', category=DeprecationWarning)
245 245 return self.is_headers_auth
246 246
247 247 @hybrid_property
248 248 def allows_creating_users(self):
249 249 """
250 250 Defines if Plugin allows users to be created on-the-fly when
251 251 authentication is called. Controls how external plugins should behave
252 252 in terms if they are allowed to create new users, or not. Base plugins
253 253 should not be allowed to, but External ones should be !
254 254
255 255 :return: bool
256 256 """
257 257 return False
258 258
259 259 def set_auth_type(self, auth_type):
260 260 self.auth_type = auth_type
261 261
262 262 def allows_authentication_from(
263 263 self, user, allows_non_existing_user=True,
264 264 allowed_auth_plugins=None, allowed_auth_sources=None):
265 265 """
266 266 Checks if this authentication module should accept a request for
267 267 the current user.
268 268
269 269 :param user: user object fetched using plugin's get_user() method.
270 270 :param allows_non_existing_user: if True, don't allow the
271 271 user to be empty, meaning not existing in our database
272 272 :param allowed_auth_plugins: if provided, users extern_type will be
273 273 checked against a list of provided extern types, which are plugin
274 274 auth_names in the end
275 275 :param allowed_auth_sources: authentication type allowed,
276 276 `http` or `vcs` default is both.
277 277 defines if plugin will accept only http authentication vcs
278 278 authentication(git/hg) or both
279 279 :returns: boolean
280 280 """
281 281 if not user and not allows_non_existing_user:
282 282 log.debug('User is empty but plugin does not allow empty users,'
283 283 'not allowed to authenticate')
284 284 return False
285 285
286 286 expected_auth_plugins = allowed_auth_plugins or [self.name]
287 287 if user and (user.extern_type and
288 288 user.extern_type not in expected_auth_plugins):
289 289 log.debug(
290 290 'User `%s` is bound to `%s` auth type. Plugin allows only '
291 291 '%s, skipping', user, user.extern_type, expected_auth_plugins)
292 292
293 293 return False
294 294
295 295 # by default accept both
296 296 expected_auth_from = allowed_auth_sources or [HTTP_TYPE, VCS_TYPE]
297 297 if self.auth_type not in expected_auth_from:
298 298 log.debug('Current auth source is %s but plugin only allows %s',
299 299 self.auth_type, expected_auth_from)
300 300 return False
301 301
302 302 return True
303 303
304 304 def get_user(self, username=None, **kwargs):
305 305 """
306 306 Helper method for user fetching in plugins, by default it's using
307 307 simple fetch by username, but this method can be custimized in plugins
308 308 eg. headers auth plugin to fetch user by environ params
309 309
310 310 :param username: username if given to fetch from database
311 311 :param kwargs: extra arguments needed for user fetching.
312 312 """
313 313 user = None
314 314 log.debug(
315 315 'Trying to fetch user `%s` from RhodeCode database', username)
316 316 if username:
317 317 user = User.get_by_username(username)
318 318 if not user:
319 319 log.debug('User not found, fallback to fetch user in '
320 320 'case insensitive mode')
321 321 user = User.get_by_username(username, case_insensitive=True)
322 322 else:
323 323 log.debug('provided username:`%s` is empty skipping...', username)
324 324 if not user:
325 325 log.debug('User `%s` not found in database', username)
326 326 return user
327 327
328 328 def user_activation_state(self):
329 329 """
330 330 Defines user activation state when creating new users
331 331
332 332 :returns: boolean
333 333 """
334 334 raise NotImplementedError("Not implemented in base class")
335 335
336 336 def auth(self, userobj, username, passwd, settings, **kwargs):
337 337 """
338 338 Given a user object (which may be null), username, a plaintext
339 339 password, and a settings object (containing all the keys needed as
340 340 listed in settings()), authenticate this user's login attempt.
341 341
342 342 Return None on failure. On success, return a dictionary of the form:
343 343
344 344 see: RhodeCodeAuthPluginBase.auth_func_attrs
345 345 This is later validated for correctness
346 346 """
347 347 raise NotImplementedError("not implemented in base class")
348 348
349 349 def _authenticate(self, userobj, username, passwd, settings, **kwargs):
350 350 """
351 351 Wrapper to call self.auth() that validates call on it
352 352
353 353 :param userobj: userobj
354 354 :param username: username
355 355 :param passwd: plaintext password
356 356 :param settings: plugin settings
357 357 """
358 358 auth = self.auth(userobj, username, passwd, settings, **kwargs)
359 359 if auth:
360 360 # check if hash should be migrated ?
361 361 new_hash = auth.get('_hash_migrate')
362 362 if new_hash:
363 363 self._migrate_hash_to_bcrypt(username, passwd, new_hash)
364 364 return self._validate_auth_return(auth)
365 365 return auth
366 366
367 367 def _migrate_hash_to_bcrypt(self, username, password, new_hash):
368 368 new_hash_cypher = _RhodeCodeCryptoBCrypt()
369 369 # extra checks, so make sure new hash is correct.
370 370 password_encoded = safe_str(password)
371 371 if new_hash and new_hash_cypher.hash_check(
372 372 password_encoded, new_hash):
373 373 cur_user = User.get_by_username(username)
374 374 cur_user.password = new_hash
375 375 Session().add(cur_user)
376 376 Session().flush()
377 377 log.info('Migrated user %s hash to bcrypt', cur_user)
378 378
379 379 def _validate_auth_return(self, ret):
380 380 if not isinstance(ret, dict):
381 381 raise Exception('returned value from auth must be a dict')
382 382 for k in self.auth_func_attrs:
383 383 if k not in ret:
384 384 raise Exception('Missing %s attribute from returned data' % k)
385 385 return ret
386 386
387 387
388 388 class RhodeCodeExternalAuthPlugin(RhodeCodeAuthPluginBase):
389 389
390 390 @hybrid_property
391 391 def allows_creating_users(self):
392 392 return True
393 393
394 394 def use_fake_password(self):
395 395 """
396 396 Return a boolean that indicates whether or not we should set the user's
397 397 password to a random value when it is authenticated by this plugin.
398 398 If your plugin provides authentication, then you will generally
399 399 want this.
400 400
401 401 :returns: boolean
402 402 """
403 403 raise NotImplementedError("Not implemented in base class")
404 404
405 405 def _authenticate(self, userobj, username, passwd, settings, **kwargs):
406 406 # at this point _authenticate calls plugin's `auth()` function
407 407 auth = super(RhodeCodeExternalAuthPlugin, self)._authenticate(
408 408 userobj, username, passwd, settings, **kwargs)
409 409 if auth:
410 410 # maybe plugin will clean the username ?
411 411 # we should use the return value
412 412 username = auth['username']
413 413
414 414 # if external source tells us that user is not active, we should
415 415 # skip rest of the process. This can prevent from creating users in
416 416 # RhodeCode when using external authentication, but if it's
417 417 # inactive user we shouldn't create that user anyway
418 418 if auth['active_from_extern'] is False:
419 419 log.warning(
420 420 "User %s authenticated against %s, but is inactive",
421 421 username, self.__module__)
422 422 return None
423 423
424 424 cur_user = User.get_by_username(username, case_insensitive=True)
425 425 is_user_existing = cur_user is not None
426 426
427 427 if is_user_existing:
428 428 log.debug('Syncing user `%s` from '
429 429 '`%s` plugin', username, self.name)
430 430 else:
431 431 log.debug('Creating non existing user `%s` from '
432 432 '`%s` plugin', username, self.name)
433 433
434 434 if self.allows_creating_users:
435 435 log.debug('Plugin `%s` allows to '
436 436 'create new users', self.name)
437 437 else:
438 438 log.debug('Plugin `%s` does not allow to '
439 439 'create new users', self.name)
440 440
441 441 user_parameters = {
442 442 'username': username,
443 443 'email': auth["email"],
444 444 'firstname': auth["firstname"],
445 445 'lastname': auth["lastname"],
446 446 'active': auth["active"],
447 447 'admin': auth["admin"],
448 448 'extern_name': auth["extern_name"],
449 449 'extern_type': self.name,
450 450 'plugin': self,
451 451 'allow_to_create_user': self.allows_creating_users,
452 452 }
453 453
454 454 if not is_user_existing:
455 455 if self.use_fake_password():
456 456 # Randomize the PW because we don't need it, but don't want
457 457 # them blank either
458 458 passwd = PasswordGenerator().gen_password(length=16)
459 459 user_parameters['password'] = passwd
460 460 else:
461 461 # Since the password is required by create_or_update method of
462 462 # UserModel, we need to set it explicitly.
463 463 # The create_or_update method is smart and recognises the
464 464 # password hashes as well.
465 465 user_parameters['password'] = cur_user.password
466 466
467 467 # we either create or update users, we also pass the flag
468 468 # that controls if this method can actually do that.
469 469 # raises NotAllowedToCreateUserError if it cannot, and we try to.
470 470 user = UserModel().create_or_update(**user_parameters)
471 471 Session().flush()
472 472 # enforce user is just in given groups, all of them has to be ones
473 473 # created from plugins. We store this info in _group_data JSON
474 474 # field
475 475 try:
476 476 groups = auth['groups'] or []
477 477 UserGroupModel().enforce_groups(user, groups, self.name)
478 478 except Exception:
479 479 # for any reason group syncing fails, we should
480 480 # proceed with login
481 481 log.error(traceback.format_exc())
482 482 Session().commit()
483 483 return auth
484 484
485 485
486 486 def loadplugin(plugin_id):
487 487 """
488 488 Loads and returns an instantiated authentication plugin.
489 489 Returns the RhodeCodeAuthPluginBase subclass on success,
490 490 or None on failure.
491 491 """
492 492 # TODO: Disusing pyramids thread locals to retrieve the registry.
493 493 authn_registry = get_current_registry().getUtility(IAuthnPluginRegistry)
494 494 plugin = authn_registry.get_plugin(plugin_id)
495 495 if plugin is None:
496 496 log.error('Authentication plugin not found: "%s"', plugin_id)
497 497 return plugin
498 498
499 499
500 500 def get_auth_cache_manager(custom_ttl=None):
501 501 return caches.get_cache_manager(
502 502 'auth_plugins', 'rhodecode.authentication', custom_ttl)
503 503
504 504
505 505 def authenticate(username, password, environ=None, auth_type=None,
506 506 skip_missing=False):
507 507 """
508 508 Authentication function used for access control,
509 509 It tries to authenticate based on enabled authentication modules.
510 510
511 511 :param username: username can be empty for headers auth
512 512 :param password: password can be empty for headers auth
513 513 :param environ: environ headers passed for headers auth
514 514 :param auth_type: type of authentication, either `HTTP_TYPE` or `VCS_TYPE`
515 515 :param skip_missing: ignores plugins that are in db but not in environment
516 516 :returns: None if auth failed, plugin_user dict if auth is correct
517 517 """
518 518 if not auth_type or auth_type not in [HTTP_TYPE, VCS_TYPE]:
519 519 raise ValueError('auth type must be on of http, vcs got "%s" instead'
520 520 % auth_type)
521 521 headers_only = environ and not (username and password)
522 522
523 523 authn_registry = get_current_registry().getUtility(IAuthnPluginRegistry)
524 524 for plugin in authn_registry.get_plugins_for_authentication():
525 525 plugin.set_auth_type(auth_type)
526 526 user = plugin.get_user(username)
527 527 display_user = user.username if user else username
528 528
529 529 if headers_only and not plugin.is_headers_auth:
530 530 log.debug('Auth type is for headers only and plugin `%s` is not '
531 531 'headers plugin, skipping...', plugin.get_id())
532 532 continue
533 533
534 534 # load plugin settings from RhodeCode database
535 535 plugin_settings = plugin.get_settings()
536 536 log.debug('Plugin settings:%s', plugin_settings)
537 537
538 538 log.debug('Trying authentication using ** %s **', plugin.get_id())
539 539 # use plugin's method of user extraction.
540 540 user = plugin.get_user(username, environ=environ,
541 541 settings=plugin_settings)
542 542 display_user = user.username if user else username
543 543 log.debug(
544 544 'Plugin %s extracted user is `%s`', plugin.get_id(), display_user)
545 545
546 546 if not plugin.allows_authentication_from(user):
547 547 log.debug('Plugin %s does not accept user `%s` for authentication',
548 548 plugin.get_id(), display_user)
549 549 continue
550 550 else:
551 551 log.debug('Plugin %s accepted user `%s` for authentication',
552 552 plugin.get_id(), display_user)
553 553
554 554 log.info('Authenticating user `%s` using %s plugin',
555 555 display_user, plugin.get_id())
556 556
557 557 _cache_ttl = 0
558 558
559 559 if isinstance(plugin.AUTH_CACHE_TTL, (int, long)):
560 560 # plugin cache set inside is more important than the settings value
561 561 _cache_ttl = plugin.AUTH_CACHE_TTL
562 562 elif plugin_settings.get('auth_cache_ttl'):
563 563 _cache_ttl = safe_int(plugin_settings.get('auth_cache_ttl'), 0)
564 564
565 565 plugin_cache_active = bool(_cache_ttl and _cache_ttl > 0)
566 566
567 567 # get instance of cache manager configured for a namespace
568 568 cache_manager = get_auth_cache_manager(custom_ttl=_cache_ttl)
569 569
570 570 log.debug('Cache for plugin `%s` active: %s', plugin.get_id(),
571 571 plugin_cache_active)
572 572
573 573 # for environ based password can be empty, but then the validation is
574 574 # on the server that fills in the env data needed for authentication
575 575 _password_hash = md5_safe(plugin.name + username + (password or ''))
576 576
577 577 # _authenticate is a wrapper for .auth() method of plugin.
578 578 # it checks if .auth() sends proper data.
579 579 # For RhodeCodeExternalAuthPlugin it also maps users to
580 580 # Database and maps the attributes returned from .auth()
581 581 # to RhodeCode database. If this function returns data
582 582 # then auth is correct.
583 583 start = time.time()
584 584 log.debug('Running plugin `%s` _authenticate method',
585 585 plugin.get_id())
586 586
587 587 def auth_func():
588 588 """
589 589 This function is used internally in Cache of Beaker to calculate
590 590 Results
591 591 """
592 592 return plugin._authenticate(
593 593 user, username, password, plugin_settings,
594 594 environ=environ or {})
595 595
596 596 if plugin_cache_active:
597 597 plugin_user = cache_manager.get(
598 598 _password_hash, createfunc=auth_func)
599 599 else:
600 600 plugin_user = auth_func()
601 601
602 602 auth_time = time.time() - start
603 603 log.debug('Authentication for plugin `%s` completed in %.3fs, '
604 604 'expiration time of fetched cache %.1fs.',
605 605 plugin.get_id(), auth_time, _cache_ttl)
606 606
607 607 log.debug('PLUGIN USER DATA: %s', plugin_user)
608 608
609 609 if plugin_user:
610 610 log.debug('Plugin returned proper authentication data')
611 611 return plugin_user
612 612 # we failed to Auth because .auth() method didn't return proper user
613 613 log.debug("User `%s` failed to authenticate against %s",
614 614 display_user, plugin.get_id())
615 615 return None
General Comments 0
You need to be logged in to leave comments. Login now