##// END OF EJS Templates
authn: Add rhodecode token auth plugin.
johbo -
r79:bfb1a9cf default
parent child Browse files
Show More
@@ -0,0 +1,134 b''
1 # -*- coding: utf-8 -*-
2
3 # Copyright (C) 2016-2016 RhodeCode GmbH
4 #
5 # This program is free software: you can redistribute it and/or modify
6 # it under the terms of the GNU Affero General Public License, version 3
7 # (only), as published by the Free Software Foundation.
8 #
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
13 #
14 # You should have received a copy of the GNU Affero General Public License
15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
16 #
17 # This program is dual-licensed. If you wish to learn more about the
18 # RhodeCode Enterprise Edition, including its added features, Support services,
19 # and proprietary license terms, please see https://rhodecode.com/licenses/
20
21 """
22 RhodeCode authentication token plugin for built in internal auth
23 """
24
25 import logging
26
27 from sqlalchemy.ext.hybrid import hybrid_property
28
29 from rhodecode.translation import _
30 from rhodecode.authentication.base import RhodeCodeAuthPluginBase, VCS_TYPE
31 from rhodecode.authentication.routes import AuthnPluginResourceBase
32 from rhodecode.model.db import User, UserApiKeys
33
34
35 log = logging.getLogger(__name__)
36
37
38 def plugin_factory(plugin_id, *args, **kwds):
39 plugin = RhodeCodeAuthPlugin(plugin_id)
40 return plugin
41
42
43 class RhodecodeAuthnResource(AuthnPluginResourceBase):
44 pass
45
46
47 class RhodeCodeAuthPlugin(RhodeCodeAuthPluginBase):
48 """
49 Enables usage of authentication tokens for vcs operations.
50 """
51
52 def includeme(self, config):
53 config.add_authn_plugin(self)
54 config.add_authn_resource(self.get_id(), RhodecodeAuthnResource(self))
55 config.add_view(
56 'rhodecode.authentication.views.AuthnPluginViewBase',
57 attr='settings_get',
58 request_method='GET',
59 route_name='auth_home',
60 context=RhodecodeAuthnResource)
61 config.add_view(
62 'rhodecode.authentication.views.AuthnPluginViewBase',
63 attr='settings_post',
64 request_method='POST',
65 route_name='auth_home',
66 context=RhodecodeAuthnResource)
67
68 def get_display_name(self):
69 return _('Rhodecode Token Auth')
70
71 @hybrid_property
72 def name(self):
73 return "authtoken"
74
75 def user_activation_state(self):
76 def_user_perms = User.get_default_user().AuthUser.permissions['global']
77 return 'hg.register.auto_activate' in def_user_perms
78
79 def allows_authentication_from(
80 self, user, allows_non_existing_user=True,
81 allowed_auth_plugins=None, allowed_auth_sources=None):
82 """
83 Custom method for this auth that doesn't accept empty users. And also
84 allows rhodecode and authtoken extern_type to auth with this. But only
85 via vcs mode
86 """
87 # only this and rhodecode plugins can use this type
88 from rhodecode.authentication.plugins import auth_rhodecode
89 allowed_auth_plugins = [
90 self.name, auth_rhodecode.RhodeCodeAuthPlugin.name]
91 # only for vcs operations
92 allowed_auth_sources = [VCS_TYPE]
93
94 return super(RhodeCodeAuthPlugin, self).allows_authentication_from(
95 user, allows_non_existing_user=False,
96 allowed_auth_plugins=allowed_auth_plugins,
97 allowed_auth_sources=allowed_auth_sources)
98
99 def auth(self, userobj, username, password, settings, **kwargs):
100 if not userobj:
101 log.debug('userobj was:%s skipping' % (userobj, ))
102 return None
103
104 user_attrs = {
105 "username": userobj.username,
106 "firstname": userobj.firstname,
107 "lastname": userobj.lastname,
108 "groups": [],
109 "email": userobj.email,
110 "admin": userobj.admin,
111 "active": userobj.active,
112 "active_from_extern": userobj.active,
113 "extern_name": userobj.user_id,
114 "extern_type": userobj.extern_type,
115 }
116
117 log.debug('Authenticating user with args %s', user_attrs)
118 if userobj.active:
119 role = UserApiKeys.ROLE_VCS
120 active_tokens = [x.api_key for x in
121 User.extra_valid_auth_tokens(userobj, role=role)]
122 if userobj.username == username and password in active_tokens:
123 log.info(
124 'user `%s` successfully authenticated via %s',
125 user_attrs['username'], self.name)
126 return user_attrs
127 log.error(
128 'user `%s` failed to authenticate via %s, reason: bad or '
129 'inactive token.', username, self.name)
130 else:
131 log.warning(
132 'user `%s` failed to authenticate via %s, reason: account not '
133 'active.', username, self.name)
134 return None
@@ -1,223 +1,223 b''
1 # -*- coding: utf-8 -*-
1 # -*- coding: utf-8 -*-
2
2
3 # Copyright (C) 2012-2016 RhodeCode GmbH
3 # Copyright (C) 2012-2016 RhodeCode GmbH
4 #
4 #
5 # This program is free software: you can redistribute it and/or modify
5 # This program is free software: you can redistribute it and/or modify
6 # it under the terms of the GNU Affero General Public License, version 3
6 # it under the terms of the GNU Affero General Public License, version 3
7 # (only), as published by the Free Software Foundation.
7 # (only), as published by the Free Software Foundation.
8 #
8 #
9 # This program is distributed in the hope that it will be useful,
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
12 # GNU General Public License for more details.
13 #
13 #
14 # You should have received a copy of the GNU Affero General Public License
14 # You should have received a copy of the GNU Affero General Public License
15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
15 # along with this program. If not, see <http://www.gnu.org/licenses/>.
16 #
16 #
17 # This program is dual-licensed. If you wish to learn more about the
17 # This program is dual-licensed. If you wish to learn more about the
18 # RhodeCode Enterprise Edition, including its added features, Support services,
18 # RhodeCode Enterprise Edition, including its added features, Support services,
19 # and proprietary license terms, please see https://rhodecode.com/licenses/
19 # and proprietary license terms, please see https://rhodecode.com/licenses/
20
20
21 import colander
21 import colander
22 import logging
22 import logging
23
23
24 from sqlalchemy.ext.hybrid import hybrid_property
24 from sqlalchemy.ext.hybrid import hybrid_property
25
25
26 from rhodecode.authentication.base import RhodeCodeExternalAuthPlugin
26 from rhodecode.authentication.base import RhodeCodeExternalAuthPlugin
27 from rhodecode.authentication.schema import AuthnPluginSettingsSchemaBase
27 from rhodecode.authentication.schema import AuthnPluginSettingsSchemaBase
28 from rhodecode.authentication.routes import AuthnPluginResourceBase
28 from rhodecode.authentication.routes import AuthnPluginResourceBase
29 from rhodecode.lib.colander_utils import strip_whitespace
29 from rhodecode.lib.colander_utils import strip_whitespace
30 from rhodecode.lib.utils2 import str2bool, safe_unicode
30 from rhodecode.lib.utils2 import str2bool, safe_unicode
31 from rhodecode.model.db import User
31 from rhodecode.model.db import User
32 from rhodecode.translation import _
32 from rhodecode.translation import _
33
33
34
34
35 log = logging.getLogger(__name__)
35 log = logging.getLogger(__name__)
36
36
37
37
38 def plugin_factory(plugin_id, *args, **kwds):
38 def plugin_factory(plugin_id, *args, **kwds):
39 """
39 """
40 Factory function that is called during plugin discovery.
40 Factory function that is called during plugin discovery.
41 It returns the plugin instance.
41 It returns the plugin instance.
42 """
42 """
43 plugin = RhodeCodeAuthPlugin(plugin_id)
43 plugin = RhodeCodeAuthPlugin(plugin_id)
44 return plugin
44 return plugin
45
45
46
46
47 class HeadersAuthnResource(AuthnPluginResourceBase):
47 class HeadersAuthnResource(AuthnPluginResourceBase):
48 pass
48 pass
49
49
50
50
51 class HeadersSettingsSchema(AuthnPluginSettingsSchemaBase):
51 class HeadersSettingsSchema(AuthnPluginSettingsSchemaBase):
52 header = colander.SchemaNode(
52 header = colander.SchemaNode(
53 colander.String(),
53 colander.String(),
54 default='REMOTE_USER',
54 default='REMOTE_USER',
55 description=_('Header to extract the user from'),
55 description=_('Header to extract the user from'),
56 preparer=strip_whitespace,
56 preparer=strip_whitespace,
57 title=_('Header'),
57 title=_('Header'),
58 widget='string')
58 widget='string')
59 fallback_header = colander.SchemaNode(
59 fallback_header = colander.SchemaNode(
60 colander.String(),
60 colander.String(),
61 default='HTTP_X_FORWARDED_USER',
61 default='HTTP_X_FORWARDED_USER',
62 description=_('Header to extract the user from when main one fails'),
62 description=_('Header to extract the user from when main one fails'),
63 preparer=strip_whitespace,
63 preparer=strip_whitespace,
64 title=_('Fallback header'),
64 title=_('Fallback header'),
65 widget='string')
65 widget='string')
66 clean_username = colander.SchemaNode(
66 clean_username = colander.SchemaNode(
67 colander.Boolean(),
67 colander.Boolean(),
68 default=True,
68 default=True,
69 description=_('Perform cleaning of user, if passed user has @ in '
69 description=_('Perform cleaning of user, if passed user has @ in '
70 'username then first part before @ is taken. '
70 'username then first part before @ is taken. '
71 'If there\'s \\ in the username only the part after '
71 'If there\'s \\ in the username only the part after '
72 ' \\ is taken'),
72 ' \\ is taken'),
73 missing=False,
73 missing=False,
74 title=_('Clean username'),
74 title=_('Clean username'),
75 widget='bool')
75 widget='bool')
76
76
77
77
78 class RhodeCodeAuthPlugin(RhodeCodeExternalAuthPlugin):
78 class RhodeCodeAuthPlugin(RhodeCodeExternalAuthPlugin):
79
79
80 def includeme(self, config):
80 def includeme(self, config):
81 config.add_authn_plugin(self)
81 config.add_authn_plugin(self)
82 config.add_authn_resource(self.get_id(), HeadersAuthnResource(self))
82 config.add_authn_resource(self.get_id(), HeadersAuthnResource(self))
83 config.add_view(
83 config.add_view(
84 'rhodecode.authentication.views.AuthnPluginViewBase',
84 'rhodecode.authentication.views.AuthnPluginViewBase',
85 attr='settings_get',
85 attr='settings_get',
86 request_method='GET',
86 request_method='GET',
87 route_name='auth_home',
87 route_name='auth_home',
88 context=HeadersAuthnResource)
88 context=HeadersAuthnResource)
89 config.add_view(
89 config.add_view(
90 'rhodecode.authentication.views.AuthnPluginViewBase',
90 'rhodecode.authentication.views.AuthnPluginViewBase',
91 attr='settings_post',
91 attr='settings_post',
92 request_method='POST',
92 request_method='POST',
93 route_name='auth_home',
93 route_name='auth_home',
94 context=HeadersAuthnResource)
94 context=HeadersAuthnResource)
95
95
96 def get_display_name(self):
96 def get_display_name(self):
97 return _('Headers')
97 return _('Headers')
98
98
99 def get_settings_schema(self):
99 def get_settings_schema(self):
100 return HeadersSettingsSchema()
100 return HeadersSettingsSchema()
101
101
102 @hybrid_property
102 @hybrid_property
103 def name(self):
103 def name(self):
104 return 'headers'
104 return 'headers'
105
105
106 @hybrid_property
106 @hybrid_property
107 def is_container_auth(self):
107 def is_container_auth(self):
108 return True
108 return True
109
109
110 def use_fake_password(self):
110 def use_fake_password(self):
111 return True
111 return True
112
112
113 def user_activation_state(self):
113 def user_activation_state(self):
114 def_user_perms = User.get_default_user().AuthUser.permissions['global']
114 def_user_perms = User.get_default_user().AuthUser.permissions['global']
115 return 'hg.extern_activate.auto' in def_user_perms
115 return 'hg.extern_activate.auto' in def_user_perms
116
116
117 def _clean_username(self, username):
117 def _clean_username(self, username):
118 # Removing realm and domain from username
118 # Removing realm and domain from username
119 username = username.split('@')[0]
119 username = username.split('@')[0]
120 username = username.rsplit('\\')[-1]
120 username = username.rsplit('\\')[-1]
121 return username
121 return username
122
122
123 def _get_username(self, environ, settings):
123 def _get_username(self, environ, settings):
124 username = None
124 username = None
125 environ = environ or {}
125 environ = environ or {}
126 if not environ:
126 if not environ:
127 log.debug('got empty environ: %s' % environ)
127 log.debug('got empty environ: %s' % environ)
128
128
129 settings = settings or {}
129 settings = settings or {}
130 if settings.get('header'):
130 if settings.get('header'):
131 header = settings.get('header')
131 header = settings.get('header')
132 username = environ.get(header)
132 username = environ.get(header)
133 log.debug('extracted %s:%s' % (header, username))
133 log.debug('extracted %s:%s' % (header, username))
134
134
135 # fallback mode
135 # fallback mode
136 if not username and settings.get('fallback_header'):
136 if not username and settings.get('fallback_header'):
137 header = settings.get('fallback_header')
137 header = settings.get('fallback_header')
138 username = environ.get(header)
138 username = environ.get(header)
139 log.debug('extracted %s:%s' % (header, username))
139 log.debug('extracted %s:%s' % (header, username))
140
140
141 if username and str2bool(settings.get('clean_username')):
141 if username and str2bool(settings.get('clean_username')):
142 log.debug('Received username `%s` from headers' % username)
142 log.debug('Received username `%s` from headers' % username)
143 username = self._clean_username(username)
143 username = self._clean_username(username)
144 log.debug('New cleanup user is:%s' % username)
144 log.debug('New cleanup user is:%s' % username)
145 return username
145 return username
146
146
147 def get_user(self, username=None, **kwargs):
147 def get_user(self, username=None, **kwargs):
148 """
148 """
149 Helper method for user fetching in plugins, by default it's using
149 Helper method for user fetching in plugins, by default it's using
150 simple fetch by username, but this method can be custimized in plugins
150 simple fetch by username, but this method can be custimized in plugins
151 eg. headers auth plugin to fetch user by environ params
151 eg. headers auth plugin to fetch user by environ params
152 :param username: username if given to fetch
152 :param username: username if given to fetch
153 :param kwargs: extra arguments needed for user fetching.
153 :param kwargs: extra arguments needed for user fetching.
154 """
154 """
155 environ = kwargs.get('environ') or {}
155 environ = kwargs.get('environ') or {}
156 settings = kwargs.get('settings') or {}
156 settings = kwargs.get('settings') or {}
157 username = self._get_username(environ, settings)
157 username = self._get_username(environ, settings)
158 # we got the username, so use default method now
158 # we got the username, so use default method now
159 return super(RhodeCodeAuthPlugin, self).get_user(username)
159 return super(RhodeCodeAuthPlugin, self).get_user(username)
160
160
161 def auth(self, userobj, username, password, settings, **kwargs):
161 def auth(self, userobj, username, password, settings, **kwargs):
162 """
162 """
163 Get's the headers_auth username (or email). It tries to get username
163 Get's the headers_auth username (or email). It tries to get username
164 from REMOTE_USER if this plugin is enabled, if that fails
164 from REMOTE_USER if this plugin is enabled, if that fails
165 it tries to get username from HTTP_X_FORWARDED_USER if fallback header
165 it tries to get username from HTTP_X_FORWARDED_USER if fallback header
166 is set. clean_username extracts the username from this data if it's
166 is set. clean_username extracts the username from this data if it's
167 having @ in it.
167 having @ in it.
168 Return None on failure. On success, return a dictionary of the form:
168 Return None on failure. On success, return a dictionary of the form:
169
169
170 see: RhodeCodeAuthPluginBase.auth_func_attrs
170 see: RhodeCodeAuthPluginBase.auth_func_attrs
171
171
172 :param userobj:
172 :param userobj:
173 :param username:
173 :param username:
174 :param password:
174 :param password:
175 :param settings:
175 :param settings:
176 :param kwargs:
176 :param kwargs:
177 """
177 """
178 environ = kwargs.get('environ')
178 environ = kwargs.get('environ')
179 if not environ:
179 if not environ:
180 log.debug('Empty environ data skipping...')
180 log.debug('Empty environ data skipping...')
181 return None
181 return None
182
182
183 if not userobj:
183 if not userobj:
184 userobj = self.get_user('', environ=environ, settings=settings)
184 userobj = self.get_user('', environ=environ, settings=settings)
185
185
186 # we don't care passed username/password for headers auth plugins.
186 # we don't care passed username/password for headers auth plugins.
187 # only way to log in is using environ
187 # only way to log in is using environ
188 username = None
188 username = None
189 if userobj:
189 if userobj:
190 username = getattr(userobj, 'username')
190 username = getattr(userobj, 'username')
191
191
192 if not username:
192 if not username:
193 # we don't have any objects in DB user doesn't exist extrac username
193 # we don't have any objects in DB user doesn't exist extract
194 # from environ based on the settings
194 # username from environ based on the settings
195 username = self._get_username(environ, settings)
195 username = self._get_username(environ, settings)
196
196
197 # if cannot fetch username, it's a no-go for this plugin to proceed
197 # if cannot fetch username, it's a no-go for this plugin to proceed
198 if not username:
198 if not username:
199 return None
199 return None
200
200
201 # old attrs fetched from RhodeCode database
201 # old attrs fetched from RhodeCode database
202 admin = getattr(userobj, 'admin', False)
202 admin = getattr(userobj, 'admin', False)
203 active = getattr(userobj, 'active', True)
203 active = getattr(userobj, 'active', True)
204 email = getattr(userobj, 'email', '')
204 email = getattr(userobj, 'email', '')
205 firstname = getattr(userobj, 'firstname', '')
205 firstname = getattr(userobj, 'firstname', '')
206 lastname = getattr(userobj, 'lastname', '')
206 lastname = getattr(userobj, 'lastname', '')
207 extern_type = getattr(userobj, 'extern_type', '')
207 extern_type = getattr(userobj, 'extern_type', '')
208
208
209 user_attrs = {
209 user_attrs = {
210 'username': username,
210 'username': username,
211 'firstname': safe_unicode(firstname or username),
211 'firstname': safe_unicode(firstname or username),
212 'lastname': safe_unicode(lastname or ''),
212 'lastname': safe_unicode(lastname or ''),
213 'groups': [],
213 'groups': [],
214 'email': email or '',
214 'email': email or '',
215 'admin': admin or False,
215 'admin': admin or False,
216 'active': active,
216 'active': active,
217 'active_from_extern': True,
217 'active_from_extern': True,
218 'extern_name': username,
218 'extern_name': username,
219 'extern_type': extern_type,
219 'extern_type': extern_type,
220 }
220 }
221
221
222 log.info('user `%s` authenticated correctly' % user_attrs['username'])
222 log.info('user `%s` authenticated correctly' % user_attrs['username'])
223 return user_attrs
223 return user_attrs
General Comments 0
You need to be logged in to leave comments. Login now