author | Sylvain Thénault <sylvain.thenault@logilab.fr> |
Fri, 21 Aug 2009 15:03:00 +0200 | |
branch | stable |
changeset 2960 | 1c6eafc68586 |
parent 2267 | e1d2df3f1091 |
child 2887 | 1282dc6525c5 |
child 4212 | ab6573088b4a |
permissions | -rw-r--r-- |
0 | 1 |
"""user authentication component |
2 |
||
3 |
:organization: Logilab |
|
1977
606923dff11b
big bunch of copyright / docstring update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1690
diff
changeset
|
4 |
:copyright: 2001-2009 LOGILAB S.A. (Paris, FRANCE), license is LGPL v2. |
0 | 5 |
:contact: http://www.logilab.fr/ -- mailto:contact@logilab.fr |
1977
606923dff11b
big bunch of copyright / docstring update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1690
diff
changeset
|
6 |
:license: GNU Lesser General Public License, v2.1 - http://www.gnu.org/licenses |
0 | 7 |
""" |
8 |
__docformat__ = "restructuredtext en" |
|
9 |
||
10 |
from logilab.common.decorators import clear_cache |
|
11 |
||
12 |
from cubicweb import AuthenticationError, BadConnectionId |
|
13 |
from cubicweb.dbapi import repo_connect, ConnectionProperties |
|
14 |
from cubicweb.web import ExplicitLogin, InvalidSession |
|
15 |
from cubicweb.web.application import AbstractAuthenticationManager |
|
1668 | 16 |
|
0 | 17 |
|
18 |
class RepositoryAuthenticationManager(AbstractAuthenticationManager): |
|
19 |
"""authenticate user associated to a request and check session validity""" |
|
1668 | 20 |
|
0 | 21 |
def __init__(self): |
22 |
self.repo = self.config.repository(self.vreg) |
|
23 |
self.log_queries = self.config['query-log-file'] |
|
24 |
||
25 |
def validate_session(self, req, session): |
|
26 |
"""check session validity, and return eventually hijacked session |
|
27 |
||
28 |
:raise InvalidSession: |
|
29 |
if session is corrupted for a reason or another and should be closed |
|
30 |
""" |
|
31 |
# with this authentication manager, session is actually a dbapi |
|
32 |
# connection |
|
33 |
cnx = session |
|
34 |
login = req.get_authorization()[0] |
|
35 |
try: |
|
36 |
# calling cnx.user() check connection validity, raise |
|
37 |
# BadConnectionId on failure |
|
38 |
user = cnx.user(req) |
|
2267
e1d2df3f1091
move login by email functionnality on the repository side to avoid buggy call to internal_session from the web interface side
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
1977
diff
changeset
|
39 |
# check cnx.login and not user.login, since in case of login by |
e1d2df3f1091
move login by email functionnality on the repository side to avoid buggy call to internal_session from the web interface side
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
1977
diff
changeset
|
40 |
# email, login and cnx.login are the email while user.login is the |
e1d2df3f1091
move login by email functionnality on the repository side to avoid buggy call to internal_session from the web interface side
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
1977
diff
changeset
|
41 |
# actual user login |
e1d2df3f1091
move login by email functionnality on the repository side to avoid buggy call to internal_session from the web interface side
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
1977
diff
changeset
|
42 |
if login and cnx.login != login: |
0 | 43 |
cnx.close() |
44 |
raise InvalidSession('login mismatch') |
|
45 |
except BadConnectionId: |
|
46 |
# check if a connection should be automatically restablished |
|
47 |
if (login is None or login == cnx.login): |
|
48 |
login, password = cnx.login, cnx.password |
|
49 |
cnx = self.authenticate(req, login, password) |
|
50 |
user = cnx.user(req) |
|
51 |
# backport session's data |
|
52 |
cnx.data = session.data |
|
53 |
else: |
|
54 |
raise InvalidSession('bad connection id') |
|
55 |
# associate the connection to the current request |
|
56 |
req.set_connection(cnx, user) |
|
57 |
return cnx |
|
1488
6da89a703c5a
add ability to login with a primary email address - no tests for now are unittest_application.py are now broken
Florent <florent@secondweb.fr>
parents:
0
diff
changeset
|
58 |
|
0 | 59 |
def authenticate(self, req, _login=None, _password=None): |
60 |
"""authenticate user and return corresponding user object |
|
1488
6da89a703c5a
add ability to login with a primary email address - no tests for now are unittest_application.py are now broken
Florent <florent@secondweb.fr>
parents:
0
diff
changeset
|
61 |
|
0 | 62 |
:raise ExplicitLogin: if authentication is required (no authentication |
63 |
info found or wrong user/password) |
|
64 |
||
65 |
Note: this method is violating AuthenticationManager interface by |
|
66 |
returning a session instance instead of the user. This is expected by |
|
67 |
the InMemoryRepositorySessionManager. |
|
68 |
""" |
|
69 |
if _login is not None: |
|
70 |
login, password = _login, _password |
|
71 |
else: |
|
72 |
login, password = req.get_authorization() |
|
73 |
if not login: |
|
74 |
# No session and no login -> try anonymous |
|
75 |
login, password = self.vreg.config.anonymous_user() |
|
76 |
if not login: # anonymous not authorized |
|
77 |
raise ExplicitLogin() |
|
78 |
# remove possibly cached cursor coming from closed connection |
|
79 |
clear_cache(req, 'cursor') |
|
80 |
cnxprops = ConnectionProperties(self.vreg.config.repo_method, |
|
81 |
close=False, log=self.log_queries) |
|
82 |
try: |
|
83 |
cnx = repo_connect(self.repo, login, password, cnxprops=cnxprops) |
|
84 |
except AuthenticationError: |
|
85 |
req.set_message(req._('authentication failure')) |
|
86 |
# restore an anonymous connection if possible |
|
87 |
anonlogin, anonpassword = self.vreg.config.anonymous_user() |
|
88 |
if anonlogin and anonlogin != login: |
|
89 |
cnx = repo_connect(self.repo, anonlogin, anonpassword, |
|
90 |
cnxprops=cnxprops) |
|
91 |
self._init_cnx(cnx, anonlogin, anonpassword) |
|
92 |
else: |
|
93 |
raise ExplicitLogin() |
|
94 |
else: |
|
95 |
self._init_cnx(cnx, login, password) |
|
96 |
# associate the connection to the current request |
|
97 |
req.set_connection(cnx) |
|
98 |
return cnx |
|
99 |
||
100 |
def _init_cnx(self, cnx, login, password): |
|
101 |
# decorate connection |
|
102 |
if login == self.vreg.config.anonymous_user()[0]: |
|
103 |
cnx.anonymous_connection = True |
|
104 |
cnx.vreg = self.vreg |
|
105 |
cnx.login = login |
|
106 |
cnx.password = password |
|
107 |