|
|
# -*- coding: utf-8 -*-
|
|
|
|
|
|
# Copyright (C) 2010-2016 RhodeCode GmbH
|
|
|
#
|
|
|
# This program is free software: you can redistribute it and/or modify
|
|
|
# it under the terms of the GNU Affero General Public License, version 3
|
|
|
# (only), as published by the Free Software Foundation.
|
|
|
#
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
# GNU General Public License for more details.
|
|
|
#
|
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
#
|
|
|
# This program is dual-licensed. If you wish to learn more about the
|
|
|
# RhodeCode Enterprise Edition, including its added features, Support services,
|
|
|
# and proprietary license terms, please see https://rhodecode.com/licenses/
|
|
|
|
|
|
"""
|
|
|
Authentication modules
|
|
|
"""
|
|
|
|
|
|
import logging
|
|
|
import time
|
|
|
import traceback
|
|
|
|
|
|
from authomatic import Authomatic
|
|
|
from authomatic.adapters import WebObAdapter
|
|
|
from authomatic.providers import oauth2, oauth1
|
|
|
from pylons import url
|
|
|
from pylons.controllers.util import Response
|
|
|
from pylons.i18n.translation import _
|
|
|
from pyramid.threadlocal import get_current_registry
|
|
|
from sqlalchemy.ext.hybrid import hybrid_property
|
|
|
|
|
|
import rhodecode.lib.helpers as h
|
|
|
from rhodecode.authentication.interface import IAuthnPluginRegistry
|
|
|
from rhodecode.authentication.schema import AuthnPluginSettingsSchemaBase
|
|
|
from rhodecode.lib import caches
|
|
|
from rhodecode.lib.auth import PasswordGenerator, _RhodeCodeCryptoBCrypt
|
|
|
from rhodecode.lib.utils2 import md5_safe, safe_int
|
|
|
from rhodecode.lib.utils2 import safe_str
|
|
|
from rhodecode.model.db import User, ExternalIdentity
|
|
|
from rhodecode.model.meta import Session
|
|
|
from rhodecode.model.settings import SettingsModel
|
|
|
from rhodecode.model.user import UserModel
|
|
|
from rhodecode.model.user_group import UserGroupModel
|
|
|
|
|
|
|
|
|
log = logging.getLogger(__name__)
|
|
|
|
|
|
# auth types that authenticate() function can receive
|
|
|
VCS_TYPE = 'vcs'
|
|
|
HTTP_TYPE = 'http'
|
|
|
|
|
|
|
|
|
class LazyFormencode(object):
|
|
|
def __init__(self, formencode_obj, *args, **kwargs):
|
|
|
self.formencode_obj = formencode_obj
|
|
|
self.args = args
|
|
|
self.kwargs = kwargs
|
|
|
|
|
|
def __call__(self, *args, **kwargs):
|
|
|
from inspect import isfunction
|
|
|
formencode_obj = self.formencode_obj
|
|
|
if isfunction(formencode_obj):
|
|
|
# case we wrap validators into functions
|
|
|
formencode_obj = self.formencode_obj(*args, **kwargs)
|
|
|
return formencode_obj(*self.args, **self.kwargs)
|
|
|
|
|
|
|
|
|
class RhodeCodeAuthPluginBase(object):
|
|
|
# cache the authentication request for N amount of seconds. Some kind
|
|
|
# of authentication methods are very heavy and it's very efficient to cache
|
|
|
# the result of a call. If it's set to None (default) cache is off
|
|
|
AUTH_CACHE_TTL = None
|
|
|
AUTH_CACHE = {}
|
|
|
|
|
|
auth_func_attrs = {
|
|
|
"username": "unique username",
|
|
|
"firstname": "first name",
|
|
|
"lastname": "last name",
|
|
|
"email": "email address",
|
|
|
"groups": '["list", "of", "groups"]',
|
|
|
"extern_name": "name in external source of record",
|
|
|
"extern_type": "type of external source of record",
|
|
|
"admin": 'True|False defines if user should be RhodeCode super admin',
|
|
|
"active":
|
|
|
'True|False defines active state of user internally for RhodeCode',
|
|
|
"active_from_extern":
|
|
|
"True|False\None, active state from the external auth, "
|
|
|
"None means use definition from RhodeCode extern_type active value"
|
|
|
}
|
|
|
# set on authenticate() method and via set_auth_type func.
|
|
|
auth_type = None
|
|
|
|
|
|
# List of setting names to store encrypted. Plugins may override this list
|
|
|
# to store settings encrypted.
|
|
|
_settings_encrypted = []
|
|
|
|
|
|
# Mapping of python to DB settings model types. Plugins may override or
|
|
|
# extend this mapping.
|
|
|
_settings_type_map = {
|
|
|
str: 'str',
|
|
|
int: 'int',
|
|
|
unicode: 'unicode',
|
|
|
bool: 'bool',
|
|
|
list: 'list',
|
|
|
}
|
|
|
|
|
|
def __init__(self, plugin_id):
|
|
|
self._plugin_id = plugin_id
|
|
|
|
|
|
def _get_setting_full_name(self, name):
|
|
|
"""
|
|
|
Return the full setting name used for storing values in the database.
|
|
|
"""
|
|
|
# TODO: johbo: Using the name here is problematic. It would be good to
|
|
|
# introduce either new models in the database to hold Plugin and
|
|
|
# PluginSetting or to use the plugin id here.
|
|
|
return 'auth_{}_{}'.format(self.name, name)
|
|
|
|
|
|
def _get_setting_type(self, name, value):
|
|
|
"""
|
|
|
Get the type as used by the SettingsModel accordingly to type of passed
|
|
|
value. Optionally the suffix `.encrypted` is appended to instruct
|
|
|
SettingsModel to store it encrypted.
|
|
|
"""
|
|
|
type_ = self._settings_type_map.get(type(value), 'unicode')
|
|
|
if name in self._settings_encrypted:
|
|
|
type_ = '{}.encrypted'.format(type_)
|
|
|
return type_
|
|
|
|
|
|
def is_enabled(self):
|
|
|
"""
|
|
|
Returns true if this plugin is enabled. An enabled plugin can be
|
|
|
configured in the admin interface but it is not consulted during
|
|
|
authentication.
|
|
|
"""
|
|
|
auth_plugins = SettingsModel().get_auth_plugins()
|
|
|
return self.get_id() in auth_plugins
|
|
|
|
|
|
def is_active(self):
|
|
|
"""
|
|
|
Returns true if the plugin is activated. An activated plugin is
|
|
|
consulted during authentication, assumed it is also enabled.
|
|
|
"""
|
|
|
return self.get_setting_by_name('enabled')
|
|
|
|
|
|
def get_id(self):
|
|
|
"""
|
|
|
Returns the plugin id.
|
|
|
"""
|
|
|
return self._plugin_id
|
|
|
|
|
|
def get_display_name(self):
|
|
|
"""
|
|
|
Returns a translation string for displaying purposes.
|
|
|
"""
|
|
|
raise NotImplementedError('Not implemented in base class')
|
|
|
|
|
|
def get_settings_schema(self):
|
|
|
"""
|
|
|
Returns a colander schema, representing the plugin settings.
|
|
|
"""
|
|
|
return AuthnPluginSettingsSchemaBase()
|
|
|
|
|
|
def get_setting_by_name(self, name):
|
|
|
"""
|
|
|
Returns a plugin setting by name.
|
|
|
"""
|
|
|
full_name = self._get_setting_full_name(name)
|
|
|
db_setting = SettingsModel().get_setting_by_name(full_name)
|
|
|
return db_setting.app_settings_value if db_setting else None
|
|
|
|
|
|
def create_or_update_setting(self, name, value):
|
|
|
"""
|
|
|
Create or update a setting for this plugin in the persistent storage.
|
|
|
"""
|
|
|
full_name = self._get_setting_full_name(name)
|
|
|
type_ = self._get_setting_type(name, value)
|
|
|
db_setting = SettingsModel().create_or_update_setting(
|
|
|
full_name, value, type_)
|
|
|
return db_setting.app_settings_value
|
|
|
|
|
|
def get_settings(self):
|
|
|
"""
|
|
|
Returns the plugin settings as dictionary.
|
|
|
"""
|
|
|
settings = {}
|
|
|
for node in self.get_settings_schema():
|
|
|
settings[node.name] = self.get_setting_by_name(node.name)
|
|
|
return settings
|
|
|
|
|
|
@property
|
|
|
def validators(self):
|
|
|
"""
|
|
|
Exposes RhodeCode validators modules
|
|
|
"""
|
|
|
# this is a hack to overcome issues with pylons threadlocals and
|
|
|
# translator object _() not beein registered properly.
|
|
|
class LazyCaller(object):
|
|
|
def __init__(self, name):
|
|
|
self.validator_name = name
|
|
|
|
|
|
def __call__(self, *args, **kwargs):
|
|
|
from rhodecode.model import validators as v
|
|
|
obj = getattr(v, self.validator_name)
|
|
|
# log.debug('Initializing lazy formencode object: %s', obj)
|
|
|
return LazyFormencode(obj, *args, **kwargs)
|
|
|
|
|
|
class ProxyGet(object):
|
|
|
def __getattribute__(self, name):
|
|
|
return LazyCaller(name)
|
|
|
|
|
|
return ProxyGet()
|
|
|
|
|
|
@hybrid_property
|
|
|
def name(self):
|
|
|
"""
|
|
|
Returns the name of this authentication plugin.
|
|
|
|
|
|
:returns: string
|
|
|
"""
|
|
|
raise NotImplementedError("Not implemented in base class")
|
|
|
|
|
|
@hybrid_property
|
|
|
def is_container_auth(self):
|
|
|
"""
|
|
|
Returns bool if this module uses container auth.
|
|
|
|
|
|
This property will trigger an automatic call to authenticate on
|
|
|
a visit to the website or during a push/pull.
|
|
|
|
|
|
:returns: bool
|
|
|
"""
|
|
|
return False
|
|
|
|
|
|
@hybrid_property
|
|
|
def allows_creating_users(self):
|
|
|
"""
|
|
|
Defines if Plugin allows users to be created on-the-fly when
|
|
|
authentication is called. Controls how external plugins should behave
|
|
|
in terms if they are allowed to create new users, or not. Base plugins
|
|
|
should not be allowed to, but External ones should be !
|
|
|
|
|
|
:return: bool
|
|
|
"""
|
|
|
return False
|
|
|
|
|
|
def set_auth_type(self, auth_type):
|
|
|
self.auth_type = auth_type
|
|
|
|
|
|
def allows_authentication_from(
|
|
|
self, user, allows_non_existing_user=True,
|
|
|
allowed_auth_plugins=None, allowed_auth_sources=None):
|
|
|
"""
|
|
|
Checks if this authentication module should accept a request for
|
|
|
the current user.
|
|
|
|
|
|
:param user: user object fetched using plugin's get_user() method.
|
|
|
:param allows_non_existing_user: if True, don't allow the
|
|
|
user to be empty, meaning not existing in our database
|
|
|
:param allowed_auth_plugins: if provided, users extern_type will be
|
|
|
checked against a list of provided extern types, which are plugin
|
|
|
auth_names in the end
|
|
|
:param allowed_auth_sources: authentication type allowed,
|
|
|
`http` or `vcs` default is both.
|
|
|
defines if plugin will accept only http authentication vcs
|
|
|
authentication(git/hg) or both
|
|
|
:returns: boolean
|
|
|
"""
|
|
|
if not user and not allows_non_existing_user:
|
|
|
log.debug('User is empty but plugin does not allow empty users,'
|
|
|
'not allowed to authenticate')
|
|
|
return False
|
|
|
|
|
|
expected_auth_plugins = allowed_auth_plugins or [self.name]
|
|
|
if user and (user.extern_type and
|
|
|
user.extern_type not in expected_auth_plugins):
|
|
|
log.debug(
|
|
|
'User `%s` is bound to `%s` auth type. Plugin allows only '
|
|
|
'%s, skipping', user, user.extern_type, expected_auth_plugins)
|
|
|
|
|
|
return False
|
|
|
|
|
|
# by default accept both
|
|
|
expected_auth_from = allowed_auth_sources or [HTTP_TYPE, VCS_TYPE]
|
|
|
if self.auth_type not in expected_auth_from:
|
|
|
log.debug('Current auth source is %s but plugin only allows %s',
|
|
|
self.auth_type, expected_auth_from)
|
|
|
return False
|
|
|
|
|
|
return True
|
|
|
|
|
|
def get_user(self, username=None, **kwargs):
|
|
|
"""
|
|
|
Helper method for user fetching in plugins, by default it's using
|
|
|
simple fetch by username, but this method can be custimized in plugins
|
|
|
eg. container auth plugin to fetch user by environ params
|
|
|
|
|
|
:param username: username if given to fetch from database
|
|
|
:param kwargs: extra arguments needed for user fetching.
|
|
|
"""
|
|
|
user = None
|
|
|
log.debug(
|
|
|
'Trying to fetch user `%s` from RhodeCode database', username)
|
|
|
if username:
|
|
|
user = User.get_by_username(username)
|
|
|
if not user:
|
|
|
log.debug('User not found, fallback to fetch user in '
|
|
|
'case insensitive mode')
|
|
|
user = User.get_by_username(username, case_insensitive=True)
|
|
|
else:
|
|
|
log.debug('provided username:`%s` is empty skipping...', username)
|
|
|
if not user:
|
|
|
log.debug('User `%s` not found in database', username)
|
|
|
return user
|
|
|
|
|
|
def user_activation_state(self):
|
|
|
"""
|
|
|
Defines user activation state when creating new users
|
|
|
|
|
|
:returns: boolean
|
|
|
"""
|
|
|
raise NotImplementedError("Not implemented in base class")
|
|
|
|
|
|
def auth(self, userobj, username, passwd, settings, **kwargs):
|
|
|
"""
|
|
|
Given a user object (which may be null), username, a plaintext
|
|
|
password, and a settings object (containing all the keys needed as
|
|
|
listed in settings()), authenticate this user's login attempt.
|
|
|
|
|
|
Return None on failure. On success, return a dictionary of the form:
|
|
|
|
|
|
see: RhodeCodeAuthPluginBase.auth_func_attrs
|
|
|
This is later validated for correctness
|
|
|
"""
|
|
|
raise NotImplementedError("not implemented in base class")
|
|
|
|
|
|
def _authenticate(self, userobj, username, passwd, settings, **kwargs):
|
|
|
"""
|
|
|
Wrapper to call self.auth() that validates call on it
|
|
|
|
|
|
:param userobj: userobj
|
|
|
:param username: username
|
|
|
:param passwd: plaintext password
|
|
|
:param settings: plugin settings
|
|
|
"""
|
|
|
auth = self.auth(userobj, username, passwd, settings, **kwargs)
|
|
|
if auth:
|
|
|
# check if hash should be migrated ?
|
|
|
new_hash = auth.get('_hash_migrate')
|
|
|
if new_hash:
|
|
|
self._migrate_hash_to_bcrypt(username, passwd, new_hash)
|
|
|
return self._validate_auth_return(auth)
|
|
|
return auth
|
|
|
|
|
|
def _migrate_hash_to_bcrypt(self, username, password, new_hash):
|
|
|
new_hash_cypher = _RhodeCodeCryptoBCrypt()
|
|
|
# extra checks, so make sure new hash is correct.
|
|
|
password_encoded = safe_str(password)
|
|
|
if new_hash and new_hash_cypher.hash_check(
|
|
|
password_encoded, new_hash):
|
|
|
cur_user = User.get_by_username(username)
|
|
|
cur_user.password = new_hash
|
|
|
Session().add(cur_user)
|
|
|
Session().flush()
|
|
|
log.info('Migrated user %s hash to bcrypt', cur_user)
|
|
|
|
|
|
def _validate_auth_return(self, ret):
|
|
|
if not isinstance(ret, dict):
|
|
|
raise Exception('returned value from auth must be a dict')
|
|
|
for k in self.auth_func_attrs:
|
|
|
if k not in ret:
|
|
|
raise Exception('Missing %s attribute from returned data' % k)
|
|
|
return ret
|
|
|
|
|
|
|
|
|
class RhodeCodeExternalAuthPlugin(RhodeCodeAuthPluginBase):
|
|
|
|
|
|
@hybrid_property
|
|
|
def allows_creating_users(self):
|
|
|
return True
|
|
|
|
|
|
def use_fake_password(self):
|
|
|
"""
|
|
|
Return a boolean that indicates whether or not we should set the user's
|
|
|
password to a random value when it is authenticated by this plugin.
|
|
|
If your plugin provides authentication, then you will generally
|
|
|
want this.
|
|
|
|
|
|
:returns: boolean
|
|
|
"""
|
|
|
raise NotImplementedError("Not implemented in base class")
|
|
|
|
|
|
def _authenticate(self, userobj, username, passwd, settings, **kwargs):
|
|
|
# at this point _authenticate calls plugin's `auth()` function
|
|
|
auth = super(RhodeCodeExternalAuthPlugin, self)._authenticate(
|
|
|
userobj, username, passwd, settings, **kwargs)
|
|
|
if auth:
|
|
|
# maybe plugin will clean the username ?
|
|
|
# we should use the return value
|
|
|
username = auth['username']
|
|
|
|
|
|
# if external source tells us that user is not active, we should
|
|
|
# skip rest of the process. This can prevent from creating users in
|
|
|
# RhodeCode when using external authentication, but if it's
|
|
|
# inactive user we shouldn't create that user anyway
|
|
|
if auth['active_from_extern'] is False:
|
|
|
log.warning(
|
|
|
"User %s authenticated against %s, but is inactive",
|
|
|
username, self.__module__)
|
|
|
return None
|
|
|
|
|
|
cur_user = User.get_by_username(username, case_insensitive=True)
|
|
|
is_user_existing = cur_user is not None
|
|
|
|
|
|
if is_user_existing:
|
|
|
log.debug('Syncing user `%s` from '
|
|
|
'`%s` plugin', username, self.name)
|
|
|
else:
|
|
|
log.debug('Creating non existing user `%s` from '
|
|
|
'`%s` plugin', username, self.name)
|
|
|
|
|
|
if self.allows_creating_users:
|
|
|
log.debug('Plugin `%s` allows to '
|
|
|
'create new users', self.name)
|
|
|
else:
|
|
|
log.debug('Plugin `%s` does not allow to '
|
|
|
'create new users', self.name)
|
|
|
|
|
|
user_parameters = {
|
|
|
'username': username,
|
|
|
'email': auth["email"],
|
|
|
'firstname': auth["firstname"],
|
|
|
'lastname': auth["lastname"],
|
|
|
'active': auth["active"],
|
|
|
'admin': auth["admin"],
|
|
|
'extern_name': auth["extern_name"],
|
|
|
'extern_type': self.name,
|
|
|
'plugin': self,
|
|
|
'allow_to_create_user': self.allows_creating_users,
|
|
|
}
|
|
|
|
|
|
if not is_user_existing:
|
|
|
if self.use_fake_password():
|
|
|
# Randomize the PW because we don't need it, but don't want
|
|
|
# them blank either
|
|
|
passwd = PasswordGenerator().gen_password(length=16)
|
|
|
user_parameters['password'] = passwd
|
|
|
else:
|
|
|
# Since the password is required by create_or_update method of
|
|
|
# UserModel, we need to set it explicitly.
|
|
|
# The create_or_update method is smart and recognises the
|
|
|
# password hashes as well.
|
|
|
user_parameters['password'] = cur_user.password
|
|
|
|
|
|
# we either create or update users, we also pass the flag
|
|
|
# that controls if this method can actually do that.
|
|
|
# raises NotAllowedToCreateUserError if it cannot, and we try to.
|
|
|
user = UserModel().create_or_update(**user_parameters)
|
|
|
Session().flush()
|
|
|
# enforce user is just in given groups, all of them has to be ones
|
|
|
# created from plugins. We store this info in _group_data JSON
|
|
|
# field
|
|
|
try:
|
|
|
groups = auth['groups'] or []
|
|
|
UserGroupModel().enforce_groups(user, groups, self.name)
|
|
|
except Exception:
|
|
|
# for any reason group syncing fails, we should
|
|
|
# proceed with login
|
|
|
log.error(traceback.format_exc())
|
|
|
Session().commit()
|
|
|
return auth
|
|
|
|
|
|
|
|
|
class AuthomaticBase(RhodeCodeExternalAuthPlugin):
|
|
|
|
|
|
# TODO: Think about how to create and store this secret string.
|
|
|
# We need the secret for the authomatic library. It needs to be the same
|
|
|
# across requests.
|
|
|
def _get_authomatic_secret(self, length=40):
|
|
|
secret = self.get_setting_by_name('secret')
|
|
|
if secret is None or secret == 'None' or secret == '':
|
|
|
from Crypto import Random, Hash
|
|
|
secret_bytes = Random.new().read(length)
|
|
|
secret_hash = Hash.SHA256.new()
|
|
|
secret_hash.update(secret_bytes)
|
|
|
secret = secret_hash.hexdigest()
|
|
|
self.create_or_update_setting('secret', secret)
|
|
|
Session.commit()
|
|
|
secret = self.get_setting_by_name('secret')
|
|
|
return secret
|
|
|
|
|
|
def get_authomatic(self):
|
|
|
scope = []
|
|
|
if self.name == 'bitbucket':
|
|
|
provider_class = oauth1.Bitbucket
|
|
|
scope = ['account', 'email', 'repository', 'issue', 'issue:write']
|
|
|
elif self.name == 'github':
|
|
|
provider_class = oauth2.GitHub
|
|
|
scope = ['repo', 'public_repo', 'user:email']
|
|
|
elif self.name == 'google':
|
|
|
provider_class = oauth2.Google
|
|
|
scope = ['profile', 'email']
|
|
|
elif self.name == 'twitter':
|
|
|
provider_class = oauth1.Twitter
|
|
|
|
|
|
authomatic_conf = {
|
|
|
self.name: {
|
|
|
'class_': provider_class,
|
|
|
'consumer_key': self.get_setting_by_name('consumer_key'),
|
|
|
'consumer_secret': self.get_setting_by_name('consumer_secret'),
|
|
|
'scope': scope,
|
|
|
'access_headers': {'User-Agent': 'TestAppAgent'},
|
|
|
}
|
|
|
}
|
|
|
secret = self._get_authomatic_secret()
|
|
|
return Authomatic(config=authomatic_conf,
|
|
|
secret=secret)
|
|
|
|
|
|
def get_provider_result(self, request):
|
|
|
"""
|
|
|
Provides `authomatic.core.LoginResult` for provider and request
|
|
|
|
|
|
:param provider_name:
|
|
|
:param request:
|
|
|
:param config:
|
|
|
:return:
|
|
|
"""
|
|
|
response = Response()
|
|
|
adapter = WebObAdapter(request, response)
|
|
|
authomatic_inst = self.get_authomatic()
|
|
|
return authomatic_inst.login(adapter, self.name), response
|
|
|
|
|
|
def handle_social_data(self, session, user_id, social_data):
|
|
|
"""
|
|
|
Updates user tokens in database whenever necessary
|
|
|
:param request:
|
|
|
:param user:
|
|
|
:param social_data:
|
|
|
:return:
|
|
|
"""
|
|
|
if not self.is_active():
|
|
|
h.flash(_('This provider is currently disabled'),
|
|
|
category='warning')
|
|
|
return False
|
|
|
|
|
|
social_data = social_data
|
|
|
update_identity = False
|
|
|
|
|
|
existing_row = ExternalIdentity.by_external_id_and_provider(
|
|
|
social_data['user']['id'],
|
|
|
social_data['credentials.provider']
|
|
|
)
|
|
|
|
|
|
if existing_row:
|
|
|
Session().delete(existing_row)
|
|
|
update_identity = True
|
|
|
|
|
|
if not existing_row or update_identity:
|
|
|
if not update_identity:
|
|
|
h.flash(_('Your external identity is now '
|
|
|
'connected with your account'), category='success')
|
|
|
|
|
|
if not social_data['user']['id']:
|
|
|
h.flash(_('No external user id found? Perhaps permissions'
|
|
|
'for authentication are set incorrectly'),
|
|
|
category='error')
|
|
|
return False
|
|
|
|
|
|
ex_identity = ExternalIdentity()
|
|
|
ex_identity.external_id = social_data['user']['id']
|
|
|
ex_identity.external_username = social_data['user']['user_name']
|
|
|
ex_identity.provider_name = social_data['credentials.provider']
|
|
|
ex_identity.access_token = social_data['credentials.token']
|
|
|
ex_identity.token_secret = social_data['credentials.token_secret']
|
|
|
ex_identity.alt_token = social_data['credentials.refresh_token']
|
|
|
ex_identity.local_user_id = user_id
|
|
|
Session().add(ex_identity)
|
|
|
session.pop('rhodecode.social_auth', None)
|
|
|
return ex_identity
|
|
|
|
|
|
def callback_url(self):
|
|
|
try:
|
|
|
return url('social_auth', provider_name=self.name, qualified=True)
|
|
|
except TypeError:
|
|
|
pass
|
|
|
return ''
|
|
|
|
|
|
|
|
|
def loadplugin(plugin_id):
|
|
|
"""
|
|
|
Loads and returns an instantiated authentication plugin.
|
|
|
Returns the RhodeCodeAuthPluginBase subclass on success,
|
|
|
raises exceptions on failure.
|
|
|
|
|
|
raises:
|
|
|
KeyError -- if no plugin available with given name
|
|
|
TypeError -- if the RhodeCodeAuthPlugin is not a subclass of
|
|
|
ours RhodeCodeAuthPluginBase
|
|
|
"""
|
|
|
# TODO: Disusing pyramids thread locals to retrieve the registry.
|
|
|
authn_registry = get_current_registry().getUtility(IAuthnPluginRegistry)
|
|
|
plugin = authn_registry.get_plugin(plugin_id)
|
|
|
if plugin is None:
|
|
|
log.error('Authentication plugin not found: "%s"', plugin_id)
|
|
|
return plugin
|
|
|
|
|
|
|
|
|
def get_auth_cache_manager(custom_ttl=None):
|
|
|
return caches.get_cache_manager(
|
|
|
'auth_plugins', 'rhodecode.authentication', custom_ttl)
|
|
|
|
|
|
|
|
|
def authenticate(username, password, environ=None, auth_type=None,
|
|
|
skip_missing=False):
|
|
|
"""
|
|
|
Authentication function used for access control,
|
|
|
It tries to authenticate based on enabled authentication modules.
|
|
|
|
|
|
:param username: username can be empty for container auth
|
|
|
:param password: password can be empty for container auth
|
|
|
:param environ: environ headers passed for container auth
|
|
|
:param auth_type: type of authentication, either `HTTP_TYPE` or `VCS_TYPE`
|
|
|
:param skip_missing: ignores plugins that are in db but not in environment
|
|
|
:returns: None if auth failed, plugin_user dict if auth is correct
|
|
|
"""
|
|
|
if not auth_type or auth_type not in [HTTP_TYPE, VCS_TYPE]:
|
|
|
raise ValueError('auth type must be on of http, vcs got "%s" instead'
|
|
|
% auth_type)
|
|
|
container_only = environ and not (username and password)
|
|
|
auth_plugins = SettingsModel().get_auth_plugins()
|
|
|
for plugin_id in auth_plugins:
|
|
|
plugin = loadplugin(plugin_id)
|
|
|
|
|
|
if plugin is None:
|
|
|
log.warning('Authentication plugin missing: "{}"'.format(
|
|
|
plugin_id))
|
|
|
continue
|
|
|
|
|
|
if not plugin.is_active():
|
|
|
log.info('Authentication plugin is inactive: "{}"'.format(
|
|
|
plugin_id))
|
|
|
continue
|
|
|
|
|
|
plugin.set_auth_type(auth_type)
|
|
|
user = plugin.get_user(username)
|
|
|
display_user = user.username if user else username
|
|
|
|
|
|
if container_only and not plugin.is_container_auth:
|
|
|
log.debug('Auth type is for container only and plugin `%s` is not '
|
|
|
'container plugin, skipping...', plugin_id)
|
|
|
continue
|
|
|
|
|
|
# load plugin settings from RhodeCode database
|
|
|
plugin_settings = plugin.get_settings()
|
|
|
log.debug('Plugin settings:%s', plugin_settings)
|
|
|
|
|
|
log.debug('Trying authentication using ** %s **', plugin_id)
|
|
|
# use plugin's method of user extraction.
|
|
|
user = plugin.get_user(username, environ=environ,
|
|
|
settings=plugin_settings)
|
|
|
display_user = user.username if user else username
|
|
|
log.debug('Plugin %s extracted user is `%s`', plugin_id, display_user)
|
|
|
|
|
|
if not plugin.allows_authentication_from(user):
|
|
|
log.debug('Plugin %s does not accept user `%s` for authentication',
|
|
|
plugin_id, display_user)
|
|
|
continue
|
|
|
else:
|
|
|
log.debug('Plugin %s accepted user `%s` for authentication',
|
|
|
plugin_id, display_user)
|
|
|
|
|
|
log.info('Authenticating user `%s` using %s plugin',
|
|
|
display_user, plugin_id)
|
|
|
|
|
|
_cache_ttl = 0
|
|
|
|
|
|
if isinstance(plugin.AUTH_CACHE_TTL, (int, long)):
|
|
|
# plugin cache set inside is more important than the settings value
|
|
|
_cache_ttl = plugin.AUTH_CACHE_TTL
|
|
|
elif plugin_settings.get('auth_cache_ttl'):
|
|
|
_cache_ttl = safe_int(plugin_settings.get('auth_cache_ttl'), 0)
|
|
|
|
|
|
plugin_cache_active = bool(_cache_ttl and _cache_ttl > 0)
|
|
|
|
|
|
# get instance of cache manager configured for a namespace
|
|
|
cache_manager = get_auth_cache_manager(custom_ttl=_cache_ttl)
|
|
|
|
|
|
log.debug('Cache for plugin `%s` active: %s', plugin_id,
|
|
|
plugin_cache_active)
|
|
|
|
|
|
# for environ based password can be empty, but then the validation is
|
|
|
# on the server that fills in the env data needed for authentication
|
|
|
_password_hash = md5_safe(plugin.name + username + (password or ''))
|
|
|
|
|
|
# _authenticate is a wrapper for .auth() method of plugin.
|
|
|
# it checks if .auth() sends proper data.
|
|
|
# For RhodeCodeExternalAuthPlugin it also maps users to
|
|
|
# Database and maps the attributes returned from .auth()
|
|
|
# to RhodeCode database. If this function returns data
|
|
|
# then auth is correct.
|
|
|
start = time.time()
|
|
|
log.debug('Running plugin `%s` _authenticate method',
|
|
|
plugin_id)
|
|
|
|
|
|
def auth_func():
|
|
|
"""
|
|
|
This function is used internally in Cache of Beaker to calculate
|
|
|
Results
|
|
|
"""
|
|
|
return plugin._authenticate(
|
|
|
user, username, password, plugin_settings,
|
|
|
environ=environ or {})
|
|
|
|
|
|
if plugin_cache_active:
|
|
|
plugin_user = cache_manager.get(
|
|
|
_password_hash, createfunc=auth_func)
|
|
|
else:
|
|
|
plugin_user = auth_func()
|
|
|
|
|
|
auth_time = time.time() - start
|
|
|
log.debug('Authentication for plugin `%s` completed in %.3fs, '
|
|
|
'expiration time of fetched cache %.1fs.',
|
|
|
plugin_id, auth_time, _cache_ttl)
|
|
|
|
|
|
log.debug('PLUGIN USER DATA: %s', plugin_user)
|
|
|
|
|
|
if plugin_user:
|
|
|
log.debug('Plugin returned proper authentication data')
|
|
|
return plugin_user
|
|
|
# we failed to Auth because .auth() method didn't return proper user
|
|
|
log.debug("User `%s` failed to authenticate against %s",
|
|
|
display_user, plugin_id)
|
|
|
return None
|
|
|
|
