auth.py
591 lines
| 20.6 KiB
| text/x-python
|
PythonLexer
r895 | # -*- coding: utf-8 -*- | |||
""" | ||||
rhodecode.lib.auth | ||||
~~~~~~~~~~~~~~~~~~ | ||||
authentication and permission libraries | ||||
:created_on: Apr 4, 2010 | ||||
:copyright: (c) 2010 by marcink. | ||||
:license: LICENSE_NAME, see LICENSE_FILE for more details. | ||||
""" | ||||
r547 | # This program is free software; you can redistribute it and/or | |||
# modify it under the terms of the GNU General Public License | ||||
# as published by the Free Software Foundation; version 2 | ||||
# of the License or (at your opinion) any later version of the license. | ||||
# | ||||
# This program is distributed in the hope that it will be useful, | ||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of | ||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||||
# GNU General Public License for more details. | ||||
# | ||||
# You should have received a copy of the GNU General Public License | ||||
# along with this program; if not, write to the Free Software | ||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, | ||||
# MA 02110-1301, USA. | ||||
r895 | import random | |||
import logging | ||||
import traceback | ||||
r1116 | import hashlib | |||
r1118 | ||||
r1116 | from tempfile import _RandomNameSequence | |||
r895 | from decorator import decorator | |||
r547 | from pylons import config, session, url, request | |||
from pylons.controllers.util import abort, redirect | ||||
r1056 | from pylons.i18n.translation import _ | |||
r895 | ||||
r1118 | from rhodecode import __platform__ | |||
if __platform__ == 'Windows': | ||||
from hashlib import sha256 | ||||
if __platform__ in ('Linux', 'Darwin'): | ||||
import bcrypt | ||||
r895 | from rhodecode.lib.exceptions import LdapPasswordError, LdapUsernameError | |||
r547 | from rhodecode.lib.utils import get_repo_slug | |||
r713 | from rhodecode.lib.auth_ldap import AuthLdap | |||
r895 | ||||
r547 | from rhodecode.model import meta | |||
r673 | from rhodecode.model.user import UserModel | |||
r1117 | from rhodecode.model.db import Permission | |||
r895 | ||||
r547 | ||||
r673 | log = logging.getLogger(__name__) | |||
r547 | ||||
class PasswordGenerator(object): | ||||
"""This is a simple class for generating password from | ||||
different sets of characters | ||||
usage: | ||||
passwd_gen = PasswordGenerator() | ||||
#print 8-letter password containing only big and small letters of alphabet | ||||
print passwd_gen.gen_password(8, passwd_gen.ALPHABETS_BIG_SMALL) | ||||
""" | ||||
ALPHABETS_NUM = r'''1234567890'''#[0] | ||||
ALPHABETS_SMALL = r'''qwertyuiopasdfghjklzxcvbnm'''#[1] | ||||
ALPHABETS_BIG = r'''QWERTYUIOPASDFGHJKLZXCVBNM'''#[2] | ||||
ALPHABETS_SPECIAL = r'''`-=[]\;',./~!@#$%^&*()_+{}|:"<>?''' #[3] | ||||
ALPHABETS_FULL = ALPHABETS_BIG + ALPHABETS_SMALL + ALPHABETS_NUM + ALPHABETS_SPECIAL#[4] | ||||
ALPHABETS_ALPHANUM = ALPHABETS_BIG + ALPHABETS_SMALL + ALPHABETS_NUM#[5] | ||||
ALPHABETS_BIG_SMALL = ALPHABETS_BIG + ALPHABETS_SMALL | ||||
ALPHABETS_ALPHANUM_BIG = ALPHABETS_BIG + ALPHABETS_NUM#[6] | ||||
ALPHABETS_ALPHANUM_SMALL = ALPHABETS_SMALL + ALPHABETS_NUM#[7] | ||||
r673 | ||||
r547 | def __init__(self, passwd=''): | |||
self.passwd = passwd | ||||
def gen_password(self, len, type): | ||||
self.passwd = ''.join([random.choice(type) for _ in xrange(len)]) | ||||
return self.passwd | ||||
r1118 | class RhodeCodeCrypto(object): | |||
@classmethod | ||||
def hash_string(cls, str_): | ||||
""" | ||||
Cryptographic function used for password hashing based on pybcrypt | ||||
or pycrypto in windows | ||||
:param password: password to hash | ||||
""" | ||||
if __platform__ == 'Windows': | ||||
return sha256(str_).hexdigest() | ||||
elif __platform__ in ('Linux', 'Darwin'): | ||||
return bcrypt.hashpw(str_, bcrypt.gensalt(10)) | ||||
else: | ||||
raise Exception('Unknown or unsupoprted platform %s' % __platform__) | ||||
@classmethod | ||||
def hash_check(cls, password, hashed): | ||||
""" | ||||
Checks matching password with it's hashed value, runs different | ||||
implementation based on platform it runs on | ||||
:param password: password | ||||
:param hashed: password in hashed form | ||||
""" | ||||
if __platform__ == 'Windows': | ||||
return sha256(password).hexdigest() == hashed | ||||
elif __platform__ in ('Linux', 'Darwin'): | ||||
return bcrypt.hashpw(password, hashed) == hashed | ||||
else: | ||||
raise Exception('Unknown or unsupoprted platform %s' % __platform__) | ||||
r673 | ||||
r547 | def get_crypt_password(password): | |||
r1118 | return RhodeCodeCrypto.hash_string(password) | |||
def check_password(password, hashed): | ||||
return RhodeCodeCrypto.hash_check(password, hashed) | ||||
r547 | ||||
r1116 | def generate_api_key(username, salt=None): | |||
if salt is None: | ||||
salt = _RandomNameSequence().next() | ||||
return hashlib.sha1(username + salt).hexdigest() | ||||
r547 | def authfunc(environ, username, password): | |||
r1016 | """Dummy authentication function used in Mercurial/Git/ and access control, | |||
r761 | ||||
:param environ: needed only for using in Basic auth | ||||
""" | ||||
return authenticate(username, password) | ||||
def authenticate(username, password): | ||||
r1016 | """Authentication function used for access control, | |||
r699 | firstly checks for db authentication then if ldap is enabled for ldap | |||
r705 | authentication, also creates ldap user if not in database | |||
r699 | :param username: username | |||
:param password: password | ||||
""" | ||||
r705 | user_model = UserModel() | |||
user = user_model.get_by_username(username, cache=False) | ||||
r699 | ||||
r761 | log.debug('Authenticating user using RhodeCode account') | |||
|
r991 | if user is not None and not user.ldap_dn: | ||
r547 | if user.active: | |||
r674 | ||||
if user.username == 'default' and user.active: | ||||
r761 | log.info('user %s authenticated correctly as anonymous user', | |||
username) | ||||
r674 | return True | |||
elif user.username == username and check_password(password, user.password): | ||||
r547 | log.info('user %s authenticated correctly', username) | |||
return True | ||||
else: | ||||
r761 | log.warning('user %s is disabled', username) | |||
r705 | ||||
else: | ||||
r761 | log.debug('Regular authentication failed') | |||
r742 | user_obj = user_model.get_by_username(username, cache=False, | |||
case_insensitive=True) | ||||
r761 | ||||
|
r991 | if user_obj is not None and not user_obj.ldap_dn: | ||
r749 | log.debug('this user already exists as non ldap') | |||
r748 | return False | |||
r705 | from rhodecode.model.settings import SettingsModel | |||
ldap_settings = SettingsModel().get_ldap_settings() | ||||
#====================================================================== | ||||
r1016 | # FALLBACK TO LDAP AUTH IF ENABLE | |||
r705 | #====================================================================== | |||
if ldap_settings.get('ldap_active', False): | ||||
r761 | log.debug("Authenticating user using ldap") | |||
r705 | kwargs = { | |||
'server':ldap_settings.get('ldap_host', ''), | ||||
'base_dn':ldap_settings.get('ldap_base_dn', ''), | ||||
'port':ldap_settings.get('ldap_port'), | ||||
'bind_dn':ldap_settings.get('ldap_dn_user'), | ||||
'bind_pass':ldap_settings.get('ldap_dn_pass'), | ||||
'use_ldaps':ldap_settings.get('ldap_ldaps'), | ||||
|
r991 | 'tls_reqcert':ldap_settings.get('ldap_tls_reqcert'), | ||
'ldap_filter':ldap_settings.get('ldap_filter'), | ||||
'search_scope':ldap_settings.get('ldap_search_scope'), | ||||
'attr_login':ldap_settings.get('ldap_attr_login'), | ||||
r705 | 'ldap_version':3, | |||
} | ||||
log.debug('Checking for ldap authentication') | ||||
try: | ||||
aldap = AuthLdap(**kwargs) | ||||
|
r991 | (user_dn, ldap_attrs) = aldap.authenticate_ldap(username, password) | ||
log.debug('Got ldap DN response %s', user_dn) | ||||
r705 | ||||
|
r991 | user_attrs = { | ||
'name' : ldap_attrs[ldap_settings.get('ldap_attr_firstname')][0], | ||||
'lastname' : ldap_attrs[ldap_settings.get('ldap_attr_lastname')][0], | ||||
'email' : ldap_attrs[ldap_settings.get('ldap_attr_email')][0], | ||||
} | ||||
if user_model.create_ldap(username, password, user_dn, user_attrs): | ||||
r1016 | log.info('created new ldap user %s', username) | |||
r705 | ||||
r761 | return True | |||
except (LdapUsernameError, LdapPasswordError,): | ||||
pass | ||||
except (Exception,): | ||||
r705 | log.error(traceback.format_exc()) | |||
r761 | pass | |||
r547 | return False | |||
class AuthUser(object): | ||||
r1117 | """ | |||
A simple object that handles all attributes of user in RhodeCode | ||||
It does lookup based on API key,given user, or user present in session | ||||
Then it fills all required information for such user. It also checks if | ||||
anonymous access is enabled and if so, it returns default user as logged | ||||
in | ||||
r547 | """ | |||
r1016 | ||||
r1117 | def __init__(self, user_id=None, api_key=None): | |||
self.user_id = user_id | ||||
r1120 | self.api_key = None | |||
r1117 | ||||
r547 | self.username = 'None' | |||
self.name = '' | ||||
self.lastname = '' | ||||
self.email = '' | ||||
self.is_authenticated = False | ||||
r1117 | self.admin = False | |||
r547 | self.permissions = {} | |||
r1120 | self._api_key = api_key | |||
r1117 | self.propagate_data() | |||
def propagate_data(self): | ||||
user_model = UserModel() | ||||
r1120 | self.anonymous_user = user_model.get_by_username('default', cache=True) | |||
r1122 | if self._api_key and self._api_key != self.anonymous_user.api_key: | |||
r1117 | #try go get user by api key | |||
r1120 | log.debug('Auth User lookup by API KEY %s', self._api_key) | |||
user_model.fill_data(self, api_key=self._api_key) | ||||
r1117 | else: | |||
log.debug('Auth User lookup by USER ID %s', self.user_id) | ||||
if self.user_id is not None and self.user_id != self.anonymous_user.user_id: | ||||
user_model.fill_data(self, user_id=self.user_id) | ||||
else: | ||||
if self.anonymous_user.active is True: | ||||
user_model.fill_data(self, user_id=self.anonymous_user.user_id) | ||||
#then we set this user is logged in | ||||
self.is_authenticated = True | ||||
else: | ||||
self.is_authenticated = False | ||||
log.debug('Auth User is now %s', self) | ||||
user_model.fill_perms(self) | ||||
@property | ||||
def is_admin(self): | ||||
return self.admin | ||||
r547 | ||||
r673 | def __repr__(self): | |||
r1117 | return "<AuthUser('id:%s:%s|%s')>" % (self.user_id, self.username, | |||
self.is_authenticated) | ||||
def set_authenticated(self, authenticated=True): | ||||
if self.user_id != self.anonymous_user.user_id: | ||||
self.is_authenticated = authenticated | ||||
r547 | ||||
def set_available_permissions(config): | ||||
r895 | """This function will propagate pylons globals with all available defined | |||
r1016 | permission given in db. We don't want to check each time from db for new | |||
r547 | permissions since adding a new permission also requires application restart | |||
ie. to decorate new views with the newly created permission | ||||
r895 | ||||
:param config: current pylons config instance | ||||
r547 | """ | |||
log.info('getting information about all available permissions') | ||||
try: | ||||
r629 | sa = meta.Session() | |||
r547 | all_perms = sa.query(Permission).all() | |||
r629 | except: | |||
pass | ||||
r547 | finally: | |||
meta.Session.remove() | ||||
r673 | ||||
r547 | config['available_permissions'] = [x.permission_name for x in all_perms] | |||
#=============================================================================== | ||||
# CHECK DECORATORS | ||||
#=============================================================================== | ||||
class LoginRequired(object): | ||||
r1117 | """ | |||
Must be logged in to execute this function else | ||||
redirect to login page | ||||
:param api_access: if enabled this checks only for valid auth token | ||||
and grants access based on valid token | ||||
""" | ||||
def __init__(self, api_access=False): | ||||
self.api_access = api_access | ||||
r673 | ||||
r547 | def __call__(self, func): | |||
return decorator(self.__wrapper, func) | ||||
r673 | ||||
r547 | def __wrapper(self, func, *fargs, **fkwargs): | |||
r1117 | cls = fargs[0] | |||
user = cls.rhodecode_user | ||||
api_access_ok = False | ||||
if self.api_access: | ||||
log.debug('Checking API KEY access for %s', cls) | ||||
if user.api_key == request.GET.get('api_key'): | ||||
api_access_ok = True | ||||
else: | ||||
log.debug("API KEY token not valid") | ||||
log.debug('Checking if %s is authenticated @ %s', user.username, cls) | ||||
if user.is_authenticated or api_access_ok: | ||||
r547 | log.debug('user %s is authenticated', user.username) | |||
return func(*fargs, **fkwargs) | ||||
else: | ||||
r1117 | log.warn('user %s NOT authenticated', user.username) | |||
r673 | ||||
r547 | p = '' | |||
if request.environ.get('SCRIPT_NAME') != '/': | ||||
p += request.environ.get('SCRIPT_NAME') | ||||
r673 | ||||
r547 | p += request.environ.get('PATH_INFO') | |||
if request.environ.get('QUERY_STRING'): | ||||
p += '?' + request.environ.get('QUERY_STRING') | ||||
r673 | ||||
log.debug('redirecting to login page with %s', p) | ||||
r547 | return redirect(url('login_home', came_from=p)) | |||
r779 | class NotAnonymous(object): | |||
"""Must be logged in to execute this function else | ||||
redirect to login page""" | ||||
def __call__(self, func): | ||||
return decorator(self.__wrapper, func) | ||||
def __wrapper(self, func, *fargs, **fkwargs): | ||||
r1117 | cls = fargs[0] | |||
self.user = cls.rhodecode_user | ||||
r779 | ||||
r1117 | log.debug('Checking if user is not anonymous @%s', cls) | |||
anonymous = self.user.username == 'default' | ||||
r779 | ||||
if anonymous: | ||||
p = '' | ||||
if request.environ.get('SCRIPT_NAME') != '/': | ||||
p += request.environ.get('SCRIPT_NAME') | ||||
p += request.environ.get('PATH_INFO') | ||||
if request.environ.get('QUERY_STRING'): | ||||
p += '?' + request.environ.get('QUERY_STRING') | ||||
r1056 | ||||
import rhodecode.lib.helpers as h | ||||
h.flash(_('You need to be a registered user to perform this action'), | ||||
category='warning') | ||||
r779 | return redirect(url('login_home', came_from=p)) | |||
else: | ||||
return func(*fargs, **fkwargs) | ||||
r547 | class PermsDecorator(object): | |||
r1117 | """Base class for controller decorators""" | |||
r673 | ||||
r547 | def __init__(self, *required_perms): | |||
available_perms = config['available_permissions'] | ||||
for perm in required_perms: | ||||
if perm not in available_perms: | ||||
raise Exception("'%s' permission is not defined" % perm) | ||||
self.required_perms = set(required_perms) | ||||
self.user_perms = None | ||||
r673 | ||||
r547 | def __call__(self, func): | |||
return decorator(self.__wrapper, func) | ||||
r673 | ||||
r547 | def __wrapper(self, func, *fargs, **fkwargs): | |||
r1117 | cls = fargs[0] | |||
self.user = cls.rhodecode_user | ||||
r673 | self.user_perms = self.user.permissions | |||
log.debug('checking %s permissions %s for %s %s', | ||||
r1117 | self.__class__.__name__, self.required_perms, cls, | |||
r673 | self.user) | |||
r547 | ||||
if self.check_permissions(): | ||||
r1117 | log.debug('Permission granted for %s %s', cls, self.user) | |||
r547 | return func(*fargs, **fkwargs) | |||
r673 | ||||
r547 | else: | |||
r1117 | log.warning('Permission denied for %s %s', cls, self.user) | |||
r547 | #redirect with forbidden ret code | |||
return abort(403) | ||||
r673 | ||||
r547 | def check_permissions(self): | |||
"""Dummy function for overriding""" | ||||
raise Exception('You have to write this function in child class') | ||||
class HasPermissionAllDecorator(PermsDecorator): | ||||
"""Checks for access permission for all given predicates. All of them | ||||
have to be meet in order to fulfill the request | ||||
""" | ||||
r673 | ||||
r547 | def check_permissions(self): | |||
if self.required_perms.issubset(self.user_perms.get('global')): | ||||
return True | ||||
return False | ||||
r673 | ||||
r547 | ||||
class HasPermissionAnyDecorator(PermsDecorator): | ||||
"""Checks for access permission for any of given predicates. In order to | ||||
fulfill the request any of predicates must be meet | ||||
""" | ||||
r673 | ||||
r547 | def check_permissions(self): | |||
if self.required_perms.intersection(self.user_perms.get('global')): | ||||
return True | ||||
return False | ||||
class HasRepoPermissionAllDecorator(PermsDecorator): | ||||
"""Checks for access permission for all given predicates for specific | ||||
repository. All of them have to be meet in order to fulfill the request | ||||
""" | ||||
r673 | ||||
r547 | def check_permissions(self): | |||
repo_name = get_repo_slug(request) | ||||
try: | ||||
user_perms = set([self.user_perms['repositories'][repo_name]]) | ||||
except KeyError: | ||||
return False | ||||
if self.required_perms.issubset(user_perms): | ||||
return True | ||||
return False | ||||
r673 | ||||
r547 | ||||
class HasRepoPermissionAnyDecorator(PermsDecorator): | ||||
"""Checks for access permission for any of given predicates for specific | ||||
repository. In order to fulfill the request any of predicates must be meet | ||||
""" | ||||
r673 | ||||
r547 | def check_permissions(self): | |||
repo_name = get_repo_slug(request) | ||||
r673 | ||||
r547 | try: | |||
user_perms = set([self.user_perms['repositories'][repo_name]]) | ||||
except KeyError: | ||||
return False | ||||
if self.required_perms.intersection(user_perms): | ||||
return True | ||||
return False | ||||
#=============================================================================== | ||||
# CHECK FUNCTIONS | ||||
#=============================================================================== | ||||
class PermsFunction(object): | ||||
"""Base function for other check functions""" | ||||
r673 | ||||
r547 | def __init__(self, *perms): | |||
available_perms = config['available_permissions'] | ||||
r673 | ||||
r547 | for perm in perms: | |||
if perm not in available_perms: | ||||
raise Exception("'%s' permission in not defined" % perm) | ||||
self.required_perms = set(perms) | ||||
self.user_perms = None | ||||
self.granted_for = '' | ||||
self.repo_name = None | ||||
r673 | ||||
r547 | def __call__(self, check_Location=''): | |||
r548 | user = session.get('rhodecode_user', False) | |||
r547 | if not user: | |||
return False | ||||
self.user_perms = user.permissions | ||||
r1117 | self.granted_for = user | |||
r673 | log.debug('checking %s %s %s', self.__class__.__name__, | |||
self.required_perms, user) | ||||
r547 | if self.check_permissions(): | |||
r1117 | log.debug('Permission granted %s @ %s', self.granted_for, | |||
check_Location or 'unspecified location') | ||||
r547 | return True | |||
r673 | ||||
r547 | else: | |||
r1117 | log.warning('Permission denied for %s @ %s', self.granted_for, | |||
check_Location or 'unspecified location') | ||||
r673 | return False | |||
r547 | def check_permissions(self): | |||
"""Dummy function for overriding""" | ||||
raise Exception('You have to write this function in child class') | ||||
r673 | ||||
r547 | class HasPermissionAll(PermsFunction): | |||
def check_permissions(self): | ||||
if self.required_perms.issubset(self.user_perms.get('global')): | ||||
return True | ||||
return False | ||||
class HasPermissionAny(PermsFunction): | ||||
def check_permissions(self): | ||||
if self.required_perms.intersection(self.user_perms.get('global')): | ||||
return True | ||||
return False | ||||
class HasRepoPermissionAll(PermsFunction): | ||||
r673 | ||||
r547 | def __call__(self, repo_name=None, check_Location=''): | |||
self.repo_name = repo_name | ||||
return super(HasRepoPermissionAll, self).__call__(check_Location) | ||||
r673 | ||||
r547 | def check_permissions(self): | |||
if not self.repo_name: | ||||
self.repo_name = get_repo_slug(request) | ||||
try: | ||||
self.user_perms = set([self.user_perms['repositories']\ | ||||
[self.repo_name]]) | ||||
except KeyError: | ||||
return False | ||||
r673 | self.granted_for = self.repo_name | |||
r547 | if self.required_perms.issubset(self.user_perms): | |||
return True | ||||
return False | ||||
r673 | ||||
r547 | class HasRepoPermissionAny(PermsFunction): | |||
r673 | ||||
r547 | def __call__(self, repo_name=None, check_Location=''): | |||
self.repo_name = repo_name | ||||
return super(HasRepoPermissionAny, self).__call__(check_Location) | ||||
r673 | ||||
r547 | def check_permissions(self): | |||
if not self.repo_name: | ||||
self.repo_name = get_repo_slug(request) | ||||
try: | ||||
self.user_perms = set([self.user_perms['repositories']\ | ||||
[self.repo_name]]) | ||||
except KeyError: | ||||
return False | ||||
self.granted_for = self.repo_name | ||||
if self.required_perms.intersection(self.user_perms): | ||||
return True | ||||
return False | ||||
#=============================================================================== | ||||
# SPECIAL VERSION TO HANDLE MIDDLEWARE AUTH | ||||
#=============================================================================== | ||||
class HasPermissionAnyMiddleware(object): | ||||
def __init__(self, *perms): | ||||
self.required_perms = set(perms) | ||||
r673 | ||||
r547 | def __call__(self, user, repo_name): | |||
r1117 | usr = AuthUser(user.user_id) | |||
r547 | try: | |||
r1117 | self.user_perms = set([usr.permissions['repositories'][repo_name]]) | |||
r547 | except: | |||
self.user_perms = set() | ||||
self.granted_for = '' | ||||
self.username = user.username | ||||
r673 | self.repo_name = repo_name | |||
r547 | return self.check_permissions() | |||
r673 | ||||
r547 | def check_permissions(self): | |||
log.debug('checking mercurial protocol ' | ||||
r1040 | 'permissions %s for user:%s repository:%s', self.user_perms, | |||
r547 | self.username, self.repo_name) | |||
if self.required_perms.intersection(self.user_perms): | ||||
log.debug('permission granted') | ||||
return True | ||||
log.debug('permission denied') | ||||
return False | ||||