web/views/authentication.py
author Sylvain Thénault <sylvain.thenault@logilab.fr>
Mon, 26 Jul 2010 12:08:24 +0200
changeset 6012 d56fd78006cd
parent 5992 5f9a9086c171
child 6389 72ba82a26e05
permissions -rw-r--r--
[session] cleanup session-time / cleanup-session-time... which are hard to grasp while there is no actual benefit to handle both. Now repo will close session without any activity since cleanup-session-time (24h by default), and the web authentication chain won't reconnect automatically anymore. I don't think there is a big deal in keeping repo session for such time. Also, ask the repo for latest session usage time, we can't know it for real on the web side (think of long running transactions). Closes #1083245.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
5421
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     1
# copyright 2003-2010 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     2
# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     3
#
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     4
# This file is part of CubicWeb.
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     5
#
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     6
# CubicWeb is free software: you can redistribute it and/or modify it under the
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     7
# terms of the GNU Lesser General Public License as published by the Free
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     8
# Software Foundation, either version 2.1 of the License, or (at your option)
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
     9
# any later version.
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    10
#
5424
8ecbcbff9777 replace logilab-common by CubicWeb in disclaimer
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5421
diff changeset
    11
# CubicWeb is distributed in the hope that it will be useful, but WITHOUT
5421
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    12
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    13
# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    14
# details.
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    15
#
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    16
# You should have received a copy of the GNU Lesser General Public License along
8167de96c523 proper licensing information (LGPL-2.1). Hope I get it right this time.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5417
diff changeset
    17
# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.
5992
5f9a9086c171 cleanup
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5426
diff changeset
    18
"""user authentication component"""
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    19
5251
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
    20
from __future__ import with_statement
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
    21
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    22
__docformat__ = "restructuredtext en"
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    23
5251
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
    24
from threading import Lock
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
    25
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    26
from logilab.common.decorators import clear_cache
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    27
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    28
from cubicweb import AuthenticationError, BadConnectionId
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    29
from cubicweb.view import Component
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    30
from cubicweb.dbapi import repo_connect, ConnectionProperties
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    31
from cubicweb.web import InvalidSession
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    32
from cubicweb.web.application import AbstractAuthenticationManager
1668
d2ac1d681d70 delete-trailing-whitespaces
sylvain.thenault@logilab.fr
parents: 1490
diff changeset
    33
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    34
class NoAuthInfo(Exception): pass
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    35
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    36
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    37
class WebAuthInfoRetreiver(Component):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    38
    __registry__ = 'webauth'
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    39
    order = None
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    40
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    41
    def authentication_information(self, req):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    42
        """retreive authentication information from the given request, raise
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    43
        NoAuthInfo if expected information is not found.
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    44
        """
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    45
        raise NotImplementedError()
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    46
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    47
    def authenticated(self, retreiver, req, cnx, login, authinfo):
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    48
        """callback when return authentication information have opened a
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    49
        repository connection successfully. Take care req has no session
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    50
        attached yet, hence req.execute isn't available.
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    51
        """
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    52
        pass
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    53
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    54
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    55
class LoginPasswordRetreiver(WebAuthInfoRetreiver):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    56
    __regid__ = 'loginpwdauth'
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    57
    order = 10
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    58
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    59
    def authentication_information(self, req):
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    60
        """retreive authentication information from the given request, raise
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    61
        NoAuthInfo if expected information is not found.
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    62
        """
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    63
        login, password = req.get_authorization()
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    64
        if not login:
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
    65
            raise NoAuthInfo()
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    66
        return login, {'password': password}
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    67
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    68
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    69
class RepositoryAuthenticationManager(AbstractAuthenticationManager):
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    70
    """authenticate user associated to a request and check session validity"""
1668
d2ac1d681d70 delete-trailing-whitespaces
sylvain.thenault@logilab.fr
parents: 1490
diff changeset
    71
2887
1282dc6525c5 give vreg where we need it (eg no bound request)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2267
diff changeset
    72
    def __init__(self, vreg):
1282dc6525c5 give vreg where we need it (eg no bound request)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2267
diff changeset
    73
        super(RepositoryAuthenticationManager, self).__init__(vreg)
1282dc6525c5 give vreg where we need it (eg no bound request)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2267
diff changeset
    74
        self.repo = vreg.config.repository(vreg)
1282dc6525c5 give vreg where we need it (eg no bound request)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 2267
diff changeset
    75
        self.log_queries = vreg.config['query-log-file']
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
    76
        self.authinforetreivers = sorted(vreg['webauth'].possible_objects(vreg),
6012
d56fd78006cd [session] cleanup session-time / cleanup-session-time...
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5992
diff changeset
    77
                                         key=lambda x: x.order)
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    78
        # 2-uple login / password, login is None when no anonymous access
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    79
        # configured
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
    80
        self.anoninfo = vreg.config.anonymous_user()
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    81
        if self.anoninfo[0]:
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    82
            self.anoninfo = (self.anoninfo[0], {'password': self.anoninfo[1]})
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    83
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    84
    def validate_session(self, req, session):
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    85
        """check session validity, reconnecting it to the repository if the
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    86
        associated connection expired in the repository side (hence the
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    87
        necessity for this method). Return the connected user on success.
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    88
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    89
        raise :exc:`InvalidSession` if session is corrupted for a reason or
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    90
        another and should be closed
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    91
        """
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    92
        # with this authentication manager, session is actually a dbapi
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    93
        # connection
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    94
        login = req.get_authorization()[0]
5251
b675edd05c19 [web session] fix web session id bug on automatic reconnection. The web session id should keep the first connection id, then differ of the repo connection id once some reconnection has been done (since the session cookie isn't updated in such cases). Also, use a lock to avoid potential race condition on reconnection.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5223
diff changeset
    95
        # check session.login and not user.login, since in case of login by
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    96
        # email, login and cnx.login are the email while user.login is the
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    97
        # actual user login
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    98
        if login and session.login != login:
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
    99
            raise InvalidSession('login mismatch')
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   100
        try:
6012
d56fd78006cd [session] cleanup session-time / cleanup-session-time...
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5992
diff changeset
   101
            # calling cnx.user() check connection validity, raise
d56fd78006cd [session] cleanup session-time / cleanup-session-time...
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5992
diff changeset
   102
            # BadConnectionId on failure
d56fd78006cd [session] cleanup session-time / cleanup-session-time...
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5992
diff changeset
   103
            user = session.cnx.user(req)
d56fd78006cd [session] cleanup session-time / cleanup-session-time...
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5992
diff changeset
   104
        except BadConnectionId:
d56fd78006cd [session] cleanup session-time / cleanup-session-time...
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 5992
diff changeset
   105
            raise InvalidSession('bad connection id')
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   106
        return user
1488
6da89a703c5a add ability to login with a primary email address - no tests for now are unittest_application.py are now broken
Florent <florent@secondweb.fr>
parents: 0
diff changeset
   107
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   108
    def authenticate(self, req):
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   109
        """authenticate user using connection information found in the request,
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   110
        and return corresponding a :class:`~cubicweb.dbapi.Connection` instance,
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   111
        as well as login and authentication information dictionary used to open
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   112
        the connection.
1488
6da89a703c5a add ability to login with a primary email address - no tests for now are unittest_application.py are now broken
Florent <florent@secondweb.fr>
parents: 0
diff changeset
   113
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   114
        raise :exc:`cubicweb.AuthenticationError` if authentication failed
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   115
        (no authentication info found or wrong user/password)
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   116
        """
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   117
        for retreiver in self.authinforetreivers:
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   118
            try:
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   119
                login, authinfo = retreiver.authentication_information(req)
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   120
            except NoAuthInfo:
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   121
                continue
4855
e69b2f2f2d61 when some authentication plugin fail, we may try another one
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4252
diff changeset
   122
            try:
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   123
                cnx = self._authenticate(login, authinfo)
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   124
            except AuthenticationError:
4855
e69b2f2f2d61 when some authentication plugin fail, we may try another one
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4252
diff changeset
   125
                continue # the next one may succeed
4910
f40fddaa79ad [web auth] fix authentication pb when anonymous are allowed, avoiding the first authentifier to return an anon connection while a following one may find correct authentication info. This make things simpler (eventually)
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4856
diff changeset
   126
            for retreiver_ in self.authinforetreivers:
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   127
                retreiver_.authenticated(retreiver, req, cnx, login, authinfo)
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   128
            return cnx, login, authinfo
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   129
        # false if no authentication info found, eg this is not an
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   130
        # authentication failure
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   131
        if 'login' in locals():
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   132
            req.set_message(req._('authentication failure'))
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   133
        login, authinfo = self.anoninfo
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   134
        if login:
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   135
            cnx = self._authenticate(login, authinfo)
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   136
            cnx.anonymous_connection = True
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   137
            return cnx, login, authinfo
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   138
        raise AuthenticationError()
3658
d8f2ec7e91fa pluggable authentication information retreiver
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 3647
diff changeset
   139
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   140
    def _authenticate(self, login, authinfo):
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   141
        cnxprops = ConnectionProperties(self.vreg.config.repo_method,
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   142
                                        close=False, log=self.log_queries)
5223
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   143
        cnx = repo_connect(self.repo, login, cnxprops=cnxprops, **authinfo)
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   144
        # decorate connection
6abd6e3599f4 #773448: refactor session and 'no connection' handling, by introducing proper web session. We should now be able to see page even when no anon is configured, and be redirected to the login form as soon as one tries to do a query.
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 4916
diff changeset
   145
        cnx.vreg = self.vreg
0
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   146
        return cnx
b97547f5f1fa Showtime !
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
   147