web/views/authentication.py
author Alexandre Fayolle <alexandre.fayolle@logilab.fr>
Wed, 22 Sep 2010 10:10:19 +0200
branchstable
changeset 6295 6e1c2aca9fa0
parent 5992 5f9a9086c171
child 6012 d56fd78006cd
permissions -rw-r--r--
updated yams and logilab.database dependency, start preparing 3.9.8
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
5421
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     1
# copyright 2003-2010 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     2
# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     3
#
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     4
# This file is part of CubicWeb.
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     5
#
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     6
# CubicWeb is free software: you can redistribute it and/or modify it under the
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     7
# terms of the GNU Lesser General Public License as published by the Free
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     8
# Software Foundation, either version 2.1 of the License, or (at your option)
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     9
# any later version.
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    10
#
5424
8ecbcbff9777 replace logilab-common by CubicWeb in disclaimer
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5421
diff changeset
    11
# CubicWeb is distributed in the hope that it will be useful, but WITHOUT
5421
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    12
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    13
# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    14
# details.
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    15
#
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    16
# You should have received a copy of the GNU Lesser General Public License along
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    17
# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.
5992
5f9a9086c171 cleanup
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
    18
"""user authentication component"""
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    19
5251
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
    20
from __future__ import with_statement
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
    21
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    22
__docformat__ = "restructuredtext en"
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    23
5251
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
    24
from threading import Lock
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
    25
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    26
from logilab.common.decorators import clear_cache
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    27
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    28
from cubicweb import AuthenticationError, BadConnectionId
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    29
from cubicweb.view import Component
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    30
from cubicweb.dbapi import repo_connect, ConnectionProperties
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    31
from cubicweb.web import InvalidSession
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    32
from cubicweb.web.application import AbstractAuthenticationManager
1668
d2ac1d681d70 delete-trailing-whitespaces
sylvain.thenault@logilab.fr
parents: 1490
diff changeset
    33
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    34
class NoAuthInfo(Exception): pass
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    35
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    36
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    37
class WebAuthInfoRetreiver(Component):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    38
    __registry__ = 'webauth'
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    39
    order = None
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    40
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    41
    def authentication_information(self, req):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    42
        """retreive authentication information from the given request, raise
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    43
        NoAuthInfo if expected information is not found.
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    44
        """
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    45
        raise NotImplementedError()
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    46
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    47
    def authenticated(self, retreiver, req, cnx, login, authinfo):
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    48
        """callback when return authentication information have opened a
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    49
        repository connection successfully. Take care req has no session
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    50
        attached yet, hence req.execute isn't available.
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    51
        """
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    52
        pass
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    53
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    54
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    55
class LoginPasswordRetreiver(WebAuthInfoRetreiver):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    56
    __regid__ = 'loginpwdauth'
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    57
    order = 10
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    58
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    59
    def authentication_information(self, req):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    60
        """retreive authentication information from the given request, raise
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    61
        NoAuthInfo if expected information is not found.
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    62
        """
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    63
        login, password = req.get_authorization()
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    64
        if not login:
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
    65
            raise NoAuthInfo()
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    66
        return login, {'password': password}
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    67
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    68
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    69
class RepositoryAuthenticationManager(AbstractAuthenticationManager):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    70
    """authenticate user associated to a request and check session validity"""
1668
d2ac1d681d70 delete-trailing-whitespaces
sylvain.thenault@logilab.fr
parents: 1490
diff changeset
    71
2887
1282dc6525c5 give vreg where we need it (eg no bound request)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2267
diff changeset
    72
    def __init__(self, vreg):
1282dc6525c5 give vreg where we need it (eg no bound request)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2267
diff changeset
    73
        super(RepositoryAuthenticationManager, self).__init__(vreg)
1282dc6525c5 give vreg where we need it (eg no bound request)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2267
diff changeset
    74
        self.repo = vreg.config.repository(vreg)
1282dc6525c5 give vreg where we need it (eg no bound request)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2267
diff changeset
    75
        self.log_queries = vreg.config['query-log-file']
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    76
        self.authinforetreivers = sorted(vreg['webauth'].possible_objects(vreg),
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    77
                                    key=lambda x: x.order)
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    78
        # 2-uple login / password, login is None when no anonymous access
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    79
        # configured
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
    80
        self.anoninfo = vreg.config.anonymous_user()
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    81
        if self.anoninfo[0]:
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    82
            self.anoninfo = (self.anoninfo[0], {'password': self.anoninfo[1]})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    83
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    84
    def validate_session(self, req, session):
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    85
        """check session validity, reconnecting it to the repository if the
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    86
        associated connection expired in the repository side (hence the
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    87
        necessity for this method). Return the connected user on success.
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    88
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    89
        raise :exc:`InvalidSession` if session is corrupted for a reason or
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    90
        another and should be closed
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    91
        """
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    92
        # with this authentication manager, session is actually a dbapi
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    93
        # connection
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    94
        login = req.get_authorization()[0]
5251
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
    95
        # check session.login and not user.login, since in case of login by
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    96
        # email, login and cnx.login are the email while user.login is the
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    97
        # actual user login
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    98
        if login and session.login != login:
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    99
            raise InvalidSession('login mismatch')
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   100
        try:
5251
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   101
            lock = session.reconnection_lock
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   102
        except AttributeError:
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   103
            lock = session.reconnection_lock = Lock()
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   104
        # need to be locked two avoid duplicated reconnections on concurrent
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   105
        # requests
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   106
        with lock:
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   107
            cnx = session.cnx
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   108
            try:
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   109
                # calling cnx.user() check connection validity, raise
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   110
                # BadConnectionId on failure
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   111
                user = cnx.user(req)
5251
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   112
            except BadConnectionId:
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   113
                # check if a connection should be automatically restablished
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   114
                if (login is None or login == session.login):
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   115
                    cnx = self._authenticate(session.login, session.authinfo)
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   116
                    user = cnx.user(req)
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   117
                    session.cnx = cnx
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   118
                else:
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
   119
                    raise InvalidSession('bad connection id')
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   120
        return user
1488
6da89a703c5a add ability to login with a primary email address - no tests for now are unittest_application.py are now broken
Florent <florent@secondweb.fr>
parents: 0
diff changeset
   121
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   122
    def authenticate(self, req):
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   123
        """authenticate user using connection information found in the request,
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   124
        and return corresponding a :class:`~cubicweb.dbapi.Connection` instance,
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   125
        as well as login and authentication information dictionary used to open
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   126
        the connection.
1488
6da89a703c5a add ability to login with a primary email address - no tests for now are unittest_application.py are now broken
Florent <florent@secondweb.fr>
parents: 0
diff changeset
   127
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   128
        raise :exc:`cubicweb.AuthenticationError` if authentication failed
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   129
        (no authentication info found or wrong user/password)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   130
        """
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   131
        for retreiver in self.authinforetreivers:
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   132
            try:
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   133
                login, authinfo = retreiver.authentication_information(req)
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   134
            except NoAuthInfo:
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   135
                continue
4855
e69b2f2f2d61 when some authentication plugin fail, we may try another one
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4252
diff changeset
   136
            try:
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   137
                cnx = self._authenticate(login, authinfo)
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   138
            except AuthenticationError:
4855
e69b2f2f2d61 when some authentication plugin fail, we may try another one
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4252
diff changeset
   139
                continue # the next one may succeed
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   140
            for retreiver_ in self.authinforetreivers:
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   141
                retreiver_.authenticated(retreiver, req, cnx, login, authinfo)
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   142
            return cnx, login, authinfo
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   143
        # false if no authentication info found, eg this is not an
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   144
        # authentication failure
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   145
        if 'login' in locals():
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   146
            req.set_message(req._('authentication failure'))
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   147
        login, authinfo = self.anoninfo
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   148
        if login:
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   149
            cnx = self._authenticate(login, authinfo)
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   150
            cnx.anonymous_connection = True
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   151
            return cnx, login, authinfo
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   152
        raise AuthenticationError()
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   153
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   154
    def _authenticate(self, login, authinfo):
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   155
        cnxprops = ConnectionProperties(self.vreg.config.repo_method,
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   156
                                        close=False, log=self.log_queries)
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   157
        cnx = repo_connect(self.repo, login, cnxprops=cnxprops, **authinfo)
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   158
        # decorate connection
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   159
        cnx.vreg = self.vreg
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   160
        return cnx
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   161