Produits Entr'ouvert » Mandaye

# mandayejs - saml reverse proxy

# Copyright (C) 2015  Entr'ouvert

#

# This program is free software: you can redistribute it and/or modify it

# under the terms of the GNU Affero General Public License as published

# by the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU Affero General Public License for more details.

#

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import base64

from hashlib import sha256

from Crypto.Cipher import AES

from Crypto import Random

from django.db import models

from django.conf import settings

from django.utils.translation import ugettext_lazy as _

from django.utils.encoding import force_bytes

from jsonfield import JSONField

from mandayejs.mandaye.utils import get_password_field

class UserCredentials(models.Model):

    user = models.ForeignKey('auth.User')

    locators = JSONField(_('locators'), default={}, blank=True)

    linked = models.BooleanField(_('associated'), default=False, blank=True)

    class Meta:

        unique_together = ('user',)

    def __unicode__(self):

        return self.user.get_full_name() \

            or self.user.email \

            or self.user.username

    def save(self, *args, **kwargs):

        self.encrypt()

        super(UserCredentials, self).save(*args, **kwargs)

    def _get_cipher(self, iv):

        """Return cipher object

        """

        secret = sha256(force_bytes(settings.SECRET_KEY)).digest()

        return AES.new(secret, AES.MODE_CFB, iv)

    def encrypt(self,):

        """Encrypt password

        """

        password_field_name = get_password_field()

        iv = Random.get_random_bytes(16)

        cipher = self._get_cipher(iv)

        password = self.locators.get(password_field_name, '').encode('utf-8')

        crypted = cipher.encrypt(password)

        self.locators[password_field_name] = '%s$%s' % (base64.b64encode(iv),

                                                        base64.b64encode(crypted))

        return self.locators

    def decrypt(self,):

        """Decrypt password

        """

        password_field_name = get_password_field()

        try:

            iv, crypted = self.locators.get(password_field_name, '').split('$')

        except (ValueError, TypeError):

            return None

        try:

            iv = base64.b64decode(iv)

            crypted = base64.b64decode(crypted)

        except TypeError:

            return None

        cipher = self._get_cipher(iv)

        self.locators[password_field_name] = \

            cipher.decrypt(crypted).decode('utf-8')

        return self.locators

    def to_login_info(self, decrypt=False):

        if decrypt:

            self.decrypt()

        return {'#' + k: v for k, v in self.locators.items()}