Produits Entr'ouvert » Larpe

import libxml2

import urllib

import urlparse

import httplib

import re

import os

from quixote import get_field, get_request, get_response, get_session, get_session_manager, redirect

from quixote.directory import Directory

from quixote.http_request import parse_header

import lasso

import logger

import misc

import storage

from form import *

from template import *

from users import User

class Liberty(Directory):

    _q_exports = ["", "login", "assertionConsumer", "soapEndpoint",

            "singleLogout", "singleLogoutReturn",

            "federationTermination", "federationTerminationReturn",

            ('metadata.xml', 'metadata'), 'public_key',

            'local_auth', 'local_auth_check', 'local_logout']

    def perform_login(self, idp = None):

        server = misc.get_lasso_server()

        login = lasso.Login(server)

        login.initAuthnRequest(idp, lasso.HTTP_METHOD_REDIRECT)

        login.request.nameIdPolicy = "federated"

        login.request.forceAuthn = False

        login.request.isPassive = False

        login.request.consent = "urn:liberty:consent:obtained"

        login.buildAuthnRequestMsg()

        return redirect(login.msgUrl)

    def assertionConsumer(self):

        server = misc.get_lasso_server()

        if not server:

            return error_page(_('Liberty support is not yet configured'))

        login = lasso.Login(server)

        request = get_request()

        if request.get_method() == 'GET' or get_field('LAREQ'):

            if request.get_method() == 'GET':

                login.initRequest(request.get_query(), lasso.HTTP_METHOD_REDIRECT)

            else:

                login.initRequest(get_field('LAREQ'), lasso.HTTP_METHOD_POST)

            login.buildRequestMsg()

            try:

                soap_answer = soap_call(login.msgUrl, login.msgBody)

            except SOAPException:

                return error_page(_("Failure to communicate with identity provider"))

            try:

                login.processResponseMsg(soap_answer)

            except lasso.Error, error:

                if error[0] == lasso.LOGIN_ERROR_STATUS_NOT_SUCCESS:

                    return error_page(_('Unknown authentication failure'))

                if hasattr(lasso, 'LOGIN_ERROR_UNKNOWN_PRINCIPAL'):

                    if error[0] == lasso.LOGIN_ERROR_UNKNOWN_PRINCIPAL:

                        return error_page(_('Authentication failure; unknown principal'))

                return error_page(_("Identity Provider didn't accept artifact transaction."))

        else:

            login.processAuthnResponseMsg(get_field('LARES'))

        login.acceptSso()

        session = get_session()

        if login.isSessionDirty:

            if login.session:

                session.lasso_session_dump = login.session.dump()

            else:

                session.lasso_session_dump = None

        user = self.lookup_user(session, login)

        if user:

            session.set_user(user.id)

        else:

            session.set_user('anonymous-%s' % login.nameIdentifier.content)

            session.lasso_anonymous_identity_dump = login.identity.dump()

        user = session.get_user()

        user_dir = misc.get_abs_path(os.path.join(misc.get_proxied_site_path(), 'users'))

        federation_file_name = os.path.join(user_dir, user.name_identifiers[0])

        if os.path.isdir(user_dir) and os.path.isfile(federation_file_name):

            self.sso_local_login(user.name_identifiers[0])

            return redirect('/' + misc.get_proxied_site_name() + '/')

        else:

            response = get_response()

            if session.after_url:

                after_url = session.after_url

                session.after_url = None

                return redirect(after_url)

            response.set_status(303)

            response.headers['location'] = urlparse.urljoin(request.get_url(), str('local_auth'))

            response.content_type = 'text/plain'

            return "Your browser should redirect you"

    def lookup_user(self, session, login):

        ni = login.nameIdentifier.content

        session.name_identifier = ni

        nis = list(User.select(lambda x: ni in x.name_identifiers))

        if nis:

            user = nis[0]

        else:

            if lasso.WSF_SUPPORT and misc.cfg.get('misc', {}).get('grab-user-with-wsf', False):

                disco = lasso.Discovery(login.server)

                disco.setSessionFromDump(session.lasso_session_dump)

                try:

                    disco.initQuery()

                except lasso.Error, error:

                    pass # XXX: there is no defined error code on lasso side

                    service = None

                else:

                    disco.addRequestedServiceType(lasso.PP_HREF)

                    disco.buildRequestMsg()

                    soap_answer = soap_call(disco.msgUrl, disco.msgBody)

                    disco.processQueryResponseMsg(soap_answer)

                    service = disco.getService()

                if not service:

                    return None

                service.initQuery('/pp:PP/pp:InformalName', 'name')

                service.addQueryItem('/pp:PP/pp:MsgContact', 'email')

                service.buildRequestMsg()

                try:

                    soap_answer = soap_call(service.msgUrl, service.msgBody)

                except SOAPException:

                    # it was advertised, it didn't work, too bad.

                    return None

                service.processQueryResponseMsg(soap_answer)

                email, name = None, None

                emailNode = service.getAnswer('/pp:PP/pp:MsgContact')

                if emailNode:

                    # horrible <MsgContact>; rebuild email

                    doc = libxml2.parseDoc(emailNode)

                    node = doc.children.children

                    account, provider = None, None

                    while node:

                        if node.name == 'MsgAccount':

                            account = node.getContent()

                        if node.name == 'MsgProvider':

                            provider = node.getContent()

                        node = node.next

                    if account and provider:

                        email = '%s@%s' % (account, provider)

                    else:

                        email = ''

                nameNode = service.getAnswer('/pp:PP/pp:InformalName')

                if nameNode:

                    doc = libxml2.parseDoc(nameNode)

                    name = unicode(doc.getContent(), 'utf-8').encode('iso-8859-1')

                if email and name:

                    user = User()

                    user.email = email

                    user.name = name

                    user.name_identifiers.append(login.nameIdentifier.content)

                    user.lasso_dump = login.identity.dump()

                    user.store()

                    return user

            return None

        user.lasso_dump = login.identity.dump()

        user.store()

        return user

    def singleLogout(self):

        self.local_logout()

        request = get_request()

        logout = lasso.Logout(misc.get_lasso_server())

        if lasso.isLibertyQuery(request.get_query()):

            request = get_request()

            try:

                logout.processRequestMsg(request.get_query())

            except lasso.Error, error:

                if error[0] == lasso.DS_ERROR_INVALID_SIGNATURE:

                    return error_page(_('Failed to check single logout request signature.'))

                raise

            return self.slo_idp(logout, get_session())

        else:

            return self.slo_sp(logout, get_session())

    def local_logout(self):

        get_response().expire_cookie('dc_admin', path='/')

        get_response().expire_cookie('dc_xd', path='/')

        #misc.get_html_page('http://localhost/~heretik/dotclear/ecrire/index.php?logout=1')

#        host = 'localhost'

#        query = '/~heretik/dotclear/ecrire/index.php?logout=1'

#        conn = httplib.HTTPConnection(host)

#        conn.request('GET', query, headers = { 'Cookie': 'dc_xd=cbec5e7951856e94d3878c68df6e575a; dc_admin=a%3A3%3A%7Bs%3A7%3A%22user_id%22%3Bs%3A7%3A%22heretik%22%3Bs%3A8%3A%22user_pwd%22%3Bs%3A32%3A%#22cc414bfc9c00475b59c87595299ff31d%22%3Bs%3A8%3A%22remember%22%3Bb%3A0%3B%7D', 'Referer': 'http://localhost/~heretik/dotclear/ecrire/',  })

#        response = conn.getresponse()

#        conn.close()

    def singleLogoutReturn(self):

        returnUrl = '/' + misc.get_proxied_site_name() + '/'

        logout = lasso.Logout(misc.get_lasso_server())

        try:

            logout.processResponseMsg(get_request().get_query())

        except lasso.Error, error:

            if error[0] == lasso.PROFILE_ERROR_INVALID_QUERY:

                raise AccessError()

            if error[0] == lasso.DS_ERROR_INVALID_SIGNATURE:

                return error_page(_('Failed to check single logout request signature.'))

            if hasattr(lasso, 'LOGOUT_ERROR_REQUEST_DENIED') and \

                    error[0] == lasso.LOGOUT_ERROR_REQUEST_DENIED:

                return redirect(returnUrl) # ignore silently

            elif error[0] == lasso.ERROR_UNDEFINED:

                # XXX: unknown status; ignoring for now.

                return redirect(returnUrl) # ignore silently

            raise

        return redirect(returnUrl)

    def slo_idp(self, logout, session):

        # Single Logout initiated by IdP

        if session.lasso_session_dump:

            logout.setSessionFromDump(session.lasso_session_dump)

        #user = get_request().user

        user = get_session().get_user()

        if user and user.lasso_dump:

            logout.setIdentityFromDump(user.lasso_dump)

        if logout.nameIdentifier.content != session.name_identifier:

            raise "no appropriate name identifier in session (%s and %s)" % (

                    logout.nameIdentifier.content, session.name_identifier)

        try:

            logout.validateRequest()

        except lasso.Error, error:

            if error[0] != lasso.PROFILE_ERROR_SESSION_NOT_FOUND:

                raise

        else:

            del get_session_manager()[session.id]

            get_session_manager().expire_session() 

        logout.buildResponseMsg()

        if logout.msgBody: # soap answer

            return logout.msgBody

        else:

            return redirect(logout.msgUrl)

    def slo_sp(self, logout, session):

        rootUrl = '/' + misc.get_proxied_site_name() + '/'

        if not session.user:

            get_session_manager().expire_session()

            return redirect(rootUrl)

        if session.lasso_session_dump:

            logout.setSessionFromDump(session.lasso_session_dump)

        #user = get_request().user

        user = get_session().get_user()

        if user and user.lasso_dump:

            logout.setIdentityFromDump(user.lasso_dump)

        return self.slo_sp_redirect(logout)

    def slo_sp_redirect(self, logout):

        rootUrl = '/' + misc.get_proxied_site_name() + '/'

        try:

            logout.initRequest(None, lasso.HTTP_METHOD_REDIRECT)

        except lasso.Error, error:

            if error[0] == lasso.PROFILE_ERROR_NAME_IDENTIFIER_NOT_FOUND:

                get_session_manager().expire_session() 

                return redirect(rootUrl)

            raise

        logout.buildRequestMsg()

        get_session_manager().expire_session() 

        return redirect(logout.msgUrl)

    def soapEndpoint(self):

        request = get_request()

        ctype = request.environ.get("CONTENT_TYPE")

        if not ctype:

            return

        ctype, ctype_params = parse_header(ctype)

        if ctype != 'text/xml':

            return

        response = get_response()

        response.set_content_type('text/xml')

        length = int(request.environ.get('CONTENT_LENGTH'))

        soap_message = request.stdin.read(length)

        request_type = lasso.getRequestTypeFromSoapMsg(soap_message) 

        if request_type == lasso.REQUEST_TYPE_LOGOUT:

            logout = lasso.Logout(misc.get_lasso_server())

            logout.processRequestMsg(soap_message)

            name_identifier = logout.nameIdentifier.content

            for session in get_session_manager().values():

                if name_identifier == session.name_identifier:

                    break

            else:

                raise "session not found"

            return self.slo_idp(logout, session)

        if request_type == lasso.REQUEST_TYPE_DEFEDERATION:

            defederation = lasso.Defederation(misc.get_lasso_server())

            defederation.processNotificationMsg(soap_message)

            name_identifier = defederation.nameIdentifier.content

            for session in get_session_manager().values():

                if name_identifier == session.name_identifier:

                    break

            else:

                # XXX: lookup user, not session!

                raise "session not found"

            return self.fedterm(defederation, session)

    def defederate(self, idp = None):

        session = get_session()

        user = session.get_user()

        self.local_defederate(session)

        defederation = lasso.Defederation(misc.get_lasso_server())

        defederation.setSessionFromDump(session.lasso_session_dump)

        if user and user.lasso_dump:

            defederation.setIdentityFromDump(user.lasso_dump)

        defederation.initNotification(idp, lasso.HTTP_METHOD_SOAP);

        defederation.buildNotificationMsg();

        try:

            soap_call(defederation.msgUrl, defederation.msgBody);

        except SOAPException:

            return error_page(_("Failure to communicate with identity provider"))

        rootUrl = '/' + misc.get_proxied_site_name() + '/'

        return redirect(rootUrl)

    def local_defederate(self, session):

        user = session.get_user()

        self.local_logout()

        if user is not None:

            user_dir = misc.get_abs_path(os.path.join(misc.get_proxied_site_path(), 'users'))

            federation_file_name = os.path.join(user_dir, user.name_identifiers[0])

            if os.path.isfile(federation_file_name):

                os.remove(federation_file_name)

#        if hasattr(session, 'auth_cookie'):

#            cookies_file_name = misc.get_abs_path(os.path.join(misc.get_proxied_site_path(), 'cookies_to_delete'))

#            cookies_file = open(cookies_file_name, 'a')

#            cookies_file.write(session.auth_cookie + '\n')

#            cookies_file.close()

    def federationTermination(self):

        request = get_request()

        if not lasso.isLibertyQuery(request.get_query()):

            return redirect('.')

        defederation = lasso.Defederation(misc.get_lasso_server())

        defederation.processNotificationMsg(request.get_query())

        session = get_session()

        return self.fedterm(defederation, session)

    def fedterm(self, defederation, session):

        self.local_defederate(session)

        defederation.setSessionFromDump(session.lasso_session_dump)

        #user = get_request().user

        user = get_session().get_user()

        if user and user.lasso_dump:

            defederation.setIdentityFromDump(user.lasso_dump)

        try:

            defederation.validateNotification()

        except lasso.Error, error:

            pass # ignore failure (?)

        else:

            if not defederation.identity:

                # if it was the last federation the whole identity dump collapsed

                user.lasso_dump = None

            else:

                user.lasso_dump = defederation.identity.dump()

            user.store()

        if defederation.isSessionDirty:

            if defederation.session:

                session.lasso_session_dump = defederation.session.dump()

            else:

                session.lasso_session_dump = None

        if defederation.msgUrl:

            return redirect(defederation.msgUrl)

        else:

            get_session_manager().commit_changes(session)

            response = get_response()

            response.set_status(204)

            return ''

    def federationTerminationReturn(self):

        rootUrl = '/' + misc.get_proxied_site_name() + '/'

        return redirect(rootUrl)

    def metadata(self):

        response = get_response()

        response.set_content_type('text/xml', 'utf-8')

        metadata = unicode(open(misc.get_abs_path(

                        misc.cfg['sp']['metadata'])).read(), 'utf-8')

        return metadata

    def public_key(self):

        response = get_response()

        response.set_content_type('application/octet-stream')

        publickey = file(misc.get_abs_path(misc.cfg['sp']['publickey'])).read()

        return publickey

    def local_auth [html] (self):

        response = get_response()

        response.set_content_type('text/html')

        page = misc.get_html_page(misc.cfg['auth_url'])

        old_url = re.compile(str('(form action=")[^"]*"'))

        page = old_url.sub(str(r'\1local_auth_check"'), page)

        htmltext(page)

    def local_auth_check (self):

        request = get_request()

        user_id = request.get_field('user_id')

        user_password = request.get_field('user_pwd')

        status = self.local_auth_check_post(user_id, user_password)

        if status == 302:

            self.federate(user_id, user_password)

            return redirect('/' + get_request().get_path().split('/')[2] + '/')

        else:

            return self.local_auth()

    def local_auth_check_post (self, user_id, user_password):

        url = misc.cfg['auth_url']

        if url.startswith('http://'):

            host, query = urllib.splithost(url[5:])

            conn = httplib.HTTPConnection(host)

        else:

            host, query = urllib.splithost(url[6:])

            conn = httplib.HTTPSConnection(host)

        body = 'user_id=%s&user_pwd=%s' % (user_id, user_password)

        conn.request("POST", query, body, {'Content-Type': 'application/x-www-form-urlencoded'})

        response = conn.getresponse()

        conn.close()

        cookies = response.getheader('Set-Cookie', None)

        cookies_match =  re.findall('dc_admin=([^;]+)', cookies)

        if len(cookies_match) > 0:

            # Can't use get_response().set_cookie('dc_admin', cookie, path='/') from quixote because

            # it adds double quotes

            set_cookie = 'dc_admin=%s; path=/' % cookies_match[0]

            get_response().set_header('Set-Cookie', set_cookie)

#            get_session().auth_cookie = set_cookie

        return response.status

    def local_auth_check_form [html] (self):

        request = get_request()

        user_id = request.get_field('user_id')

        user_password = request.get_field('user_pwd')

        session = get_session()

        session.local_user_id = user_id

        session.local_user_password = user_password

        """<html><head>

        </head>

        <body onload="test()">

        <script type="text/javascript">

        function test() {

            document.myform.submit();

        }

        </script>

        <form name="myform" action="%s" method="post">

        <input type="text" name="user_id" value="%s" />

        <input type="password" name="user_pwd" value="%s" />

        </form>

        </body></html>""" % (misc.cfg['auth_url'], user_id, user_password)

    def federate(self, user_id, user_password):

        liberty_user = get_session().get_user()

        if liberty_user is not None:

            user_dir = misc.get_abs_path(os.path.join(misc.get_proxied_site_path(), 'users'))

            if not os.path.isdir(user_dir):

                os.mkdir(user_dir)

            federation_file_name = os.path.join(user_dir, liberty_user.name_identifiers[0])

            if not os.path.isfile(federation_file_name):

                federation_file = open(federation_file_name, 'w')

                federation_file.write(user_id + '\n' + user_password)

                federation_file.close()

    def sso_local_login(self, name_id):

        #proxied_site_dir = get_request().get_path().split('/')[2]

        user_dir = misc.get_abs_path(os.path.join(misc.get_proxied_site_path(), 'users'))

        federation_file_name = os.path.join(user_dir, name_id)

        federation_file = open(federation_file_name, 'r')

        data = federation_file.read().split()

        user_id = data[0]

        user_password = data[1]

        federation_file.close()

        self.local_auth_check_post(user_id, user_password)

class SOAPException(Exception):

    pass

def soap_call(url, msg):

    if url.startswith('http://'):

        host, query = urllib.splithost(url[5:])

        conn = httplib.HTTPConnection(host)

    else:

        host, query = urllib.splithost(url[6:])

        conn = httplib.HTTPSConnection(host)

    conn.request("POST", query, msg, {'Content-Type': 'text/xml'})

    response = conn.getresponse()

    data = response.read()

    conn.close()

    if response.status not in (200, 204): # 204 ok for federation termination

        logger.warn('SOAP error (%s) (on %s)' % (response.status, url))

        raise SOAPException()

    return data