web/views/authentication.py
author Alexandre Fayolle <alexandre.fayolle@logilab.fr>
Wed, 07 Apr 2010 11:56:30 +0200
branchstable
changeset 5171 1c2567af37dd
parent 4916 4b8cdda342ae
child 5223 6abd6e3599f4
child 5417 55ff79dad1a6
permissions -rw-r--r--
merge
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
     1
"""user authentication component
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
     2
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
     3
:organization: Logilab
4212
ab6573088b4a update copyright: welcome 2010
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 2267
diff changeset
     4
:copyright: 2001-2010 LOGILAB S.A. (Paris, FRANCE), license is LGPL v2.
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
     5
:contact: http://www.logilab.fr/ -- mailto:contact@logilab.fr
1977
606923dff11b big bunch of copyright / docstring update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents: 1690
diff changeset
     6
:license: GNU Lesser General Public License, v2.1 - http://www.gnu.org/licenses
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
     7
"""
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
     8
__docformat__ = "restructuredtext en"
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
     9
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    10
from logilab.common.decorators import clear_cache
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    11
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    12
from cubicweb import AuthenticationError, BadConnectionId
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    13
from cubicweb.view import Component
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    14
from cubicweb.dbapi import repo_connect, ConnectionProperties
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    15
from cubicweb.web import ExplicitLogin, InvalidSession
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    16
from cubicweb.web.application import AbstractAuthenticationManager
1668
d2ac1d681d70 delete-trailing-whitespaces
sylvain.thenault@logilab.fr
parents: 1490
diff changeset
    17
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    18
class NoAuthInfo(Exception): pass
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    19
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    20
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    21
class WebAuthInfoRetreiver(Component):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    22
    __registry__ = 'webauth'
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    23
    order = None
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    24
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    25
    def authentication_information(self, req):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    26
        """retreive authentication information from the given request, raise
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    27
        NoAuthInfo if expected information is not found.
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    28
        """
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    29
        raise NotImplementedError()
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    30
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    31
    def authenticated(self, req, cnx, retreiver):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    32
        """callback when return authentication information have opened a
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    33
        repository connection successfully
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    34
        """
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    35
        pass
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    36
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    37
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    38
class LoginPasswordRetreiver(WebAuthInfoRetreiver):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    39
    __regid__ = 'loginpwdauth'
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    40
    order = 10
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    41
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    42
    def authentication_information(self, req):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    43
        """retreive authentication information from the given request, raise
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    44
        NoAuthInfo if expected information is not found.
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    45
        """
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    46
        login, password = req.get_authorization()
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    47
        if not login:
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
    48
            raise NoAuthInfo()
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    49
        return login, {'password': password}
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    50
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    51
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    52
class RepositoryAuthenticationManager(AbstractAuthenticationManager):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    53
    """authenticate user associated to a request and check session validity"""
1668
d2ac1d681d70 delete-trailing-whitespaces
sylvain.thenault@logilab.fr
parents: 1490
diff changeset
    54
2887
1282dc6525c5 give vreg where we need it (eg no bound request)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2267
diff changeset
    55
    def __init__(self, vreg):
1282dc6525c5 give vreg where we need it (eg no bound request)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2267
diff changeset
    56
        super(RepositoryAuthenticationManager, self).__init__(vreg)
1282dc6525c5 give vreg where we need it (eg no bound request)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2267
diff changeset
    57
        self.repo = vreg.config.repository(vreg)
1282dc6525c5 give vreg where we need it (eg no bound request)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2267
diff changeset
    58
        self.log_queries = vreg.config['query-log-file']
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    59
        self.authinforetreivers = sorted(vreg['webauth'].possible_objects(vreg),
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    60
                                    key=lambda x: x.order)
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    61
        assert self.authinforetreivers
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
    62
        self.anoninfo = vreg.config.anonymous_user()
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    63
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    64
    def validate_session(self, req, session):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    65
        """check session validity, and return eventually hijacked session
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    66
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    67
        :raise InvalidSession:
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    68
          if session is corrupted for a reason or another and should be closed
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    69
        """
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    70
        # with this authentication manager, session is actually a dbapi
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    71
        # connection
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    72
        cnx = session
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    73
        login = req.get_authorization()[0]
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    74
        try:
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    75
            # calling cnx.user() check connection validity, raise
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    76
            # BadConnectionId on failure
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    77
            user = cnx.user(req)
2267
e1d2df3f1091 move login by email functionnality on the repository side to avoid buggy call to internal_session from the web interface side
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 1977
diff changeset
    78
            # check cnx.login and not user.login, since in case of login by
e1d2df3f1091 move login by email functionnality on the repository side to avoid buggy call to internal_session from the web interface side
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 1977
diff changeset
    79
            # email, login and cnx.login are the email while user.login is the
e1d2df3f1091 move login by email functionnality on the repository side to avoid buggy call to internal_session from the web interface side
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 1977
diff changeset
    80
            # actual user login
e1d2df3f1091 move login by email functionnality on the repository side to avoid buggy call to internal_session from the web interface side
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 1977
diff changeset
    81
            if login and cnx.login != login:
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    82
                cnx.close()
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    83
                raise InvalidSession('login mismatch')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    84
        except BadConnectionId:
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    85
            # check if a connection should be automatically restablished
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    86
            if (login is None or login == cnx.login):
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    87
                cnx = self._authenticate(req, cnx.login, cnx.authinfo)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    88
                user = cnx.user(req)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    89
                # backport session's data
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    90
                cnx.data = session.data
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    91
            else:
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    92
                raise InvalidSession('bad connection id')
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    93
        # associate the connection to the current request
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    94
        req.set_connection(cnx, user)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    95
        return cnx
1488
6da89a703c5a add ability to login with a primary email address - no tests for now are unittest_application.py are now broken
Florent <florent@secondweb.fr>
parents: 0
diff changeset
    96
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    97
    def authenticate(self, req):
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    98
        """authenticate user and return corresponding user object
1488
6da89a703c5a add ability to login with a primary email address - no tests for now are unittest_application.py are now broken
Florent <florent@secondweb.fr>
parents: 0
diff changeset
    99
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   100
        :raise ExplicitLogin: if authentication is required (no authentication
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   101
        info found or wrong user/password)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   102
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   103
        Note: this method is violating AuthenticationManager interface by
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   104
        returning a session instance instead of the user. This is expected by
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   105
        the InMemoryRepositorySessionManager.
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   106
        """
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   107
        for retreiver in self.authinforetreivers:
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   108
            try:
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   109
                login, authinfo = retreiver.authentication_information(req)
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   110
            except NoAuthInfo:
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   111
                continue
4855
e69b2f2f2d61 when some authentication plugin fail, we may try another one
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4252
diff changeset
   112
            try:
e69b2f2f2d61 when some authentication plugin fail, we may try another one
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4252
diff changeset
   113
                cnx = self._authenticate(req, login, authinfo)
e69b2f2f2d61 when some authentication plugin fail, we may try another one
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4252
diff changeset
   114
            except ExplicitLogin:
e69b2f2f2d61 when some authentication plugin fail, we may try another one
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4252
diff changeset
   115
                continue # the next one may succeed
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   116
            for retreiver_ in self.authinforetreivers:
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   117
                retreiver_.authenticated(req, cnx, retreiver)
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   118
            break
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   119
        else:
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   120
            # false if no authentication info found, eg this is not an
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   121
            # authentication failure
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   122
            if 'login' in locals():
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   123
                req.set_message(req._('authentication failure'))
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   124
            cnx = self._open_anonymous_connection(req)
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   125
        return cnx
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   126
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   127
    def _authenticate(self, req, login, authinfo):
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   128
        cnxprops = ConnectionProperties(self.vreg.config.repo_method,
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   129
                                        close=False, log=self.log_queries)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   130
        try:
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   131
            cnx = repo_connect(self.repo, login, cnxprops=cnxprops, **authinfo)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   132
        except AuthenticationError:
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   133
            raise ExplicitLogin()
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   134
        self._init_cnx(cnx, login, authinfo)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   135
        # associate the connection to the current request
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   136
        req.set_connection(cnx)
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   137
        return cnx
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   138
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   139
    def _open_anonymous_connection(self, req):
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   140
        # restore an anonymous connection if possible
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   141
        login, password = self.anoninfo
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   142
        if login:
4916
4b8cdda342ae fix tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4910
diff changeset
   143
            cnx = self._authenticate(req, login, {'password': password})
4b8cdda342ae fix tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4910
diff changeset
   144
            cnx.anonymous_connection = True
4b8cdda342ae fix tests
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4910
diff changeset
   145
            return cnx
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   146
        raise ExplicitLogin()
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   147
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   148
    def _init_cnx(self, cnx, login, authinfo):
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   149
        # decorate connection
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   150
        cnx.vreg = self.vreg
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   151
        cnx.login = login
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   152
        cnx.authinfo = authinfo
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   153