root/trunk/rp/trac/infocard_acct/0.11/infocard_acct/web_ui.py

#  Copyright (c) 2007 Novell, Inc.
#  All Rights Reserved.
 
#  This library is free software; you can redistribute it and/or
#  modify it under the terms of the GNU Lesser General Public License as
#  published by the Free Software Foundation; version 2.1 of the license.
 
#  This library is distributed in the hope that it will be useful,
#  but WITHOUT ANY WARRANTY; without even the implied warranty of
#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#  GNU Lesser General Public License for more details.
 
#  You should have received a copy of the GNU Lesser General Public License
#  along with this library; if not, contact Novell, Inc.
 
#  To contact Novell about this file by physical or electronic mail,
#  you may find current contact information at www.novell.com
#
#  This file incorporates work covered by the following copyright and  
#   permission notice:  
#
#     -*- coding: utf8 -*-
#
#     Copyright (C) 2007 Matthew Good <trac@matt-good.net>
#
#     "THE BEER-WARE LICENSE" (Revision 42):
#     <trac@matt-good.net> wrote this file.  As long as you retain this notice you
#     can do whatever you want with this stuff. If we meet some day, and you think
#     this stuff is worth it, you can buy me a beer in return.   Matthew Good
#
#     Author: Matthew Good <trac@matt-good.net>

import random
import string
import re
import time
import urlparse

from trac import perm, util
from trac.core import *
from trac.config import BoolOption, IntOption, Option, PathOption
from trac.notification import NotificationSystem, NotifyEmail
from trac.prefs import IPreferencePanelProvider
from trac.web import auth
from trac.web.api import IAuthenticator
from trac.web.main import IRequestHandler
from trac.web.chrome import INavigationContributor, ITemplateProvider
from trac.util import Markup, hex_entropy

from acct_mgr.api import AccountManager
from acct_mgr import web_ui
from acct_mgr.web_ui import AccountModule

from association import AssociationManager
from session import SecTokenSessionModule

import infocard.xmlseclibs, infocard.infocardlib
from infocard import infocardlib, event
from infocard.infocardlib import SecToken, InfoCardProcessor

def if_enabled(func):
    def wrap(self, *args, **kwds):
        if not self.enabled:
            return None
        return func(self, *args, **kwds)
    return wrap

class LoginModule(auth.LoginModule):

    implements(ITemplateProvider)

    privateKey = '/'
    privateKeyPassPhrase = ''
    mandatoryClaims = ('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier',)

    def __init__(self):
        self.processors = {}

        self.privateKey = self.config.get('infocard_acct', 'private_key_path')
        self.privateKeyPassPhrase = self.config.get('infocard_acct', 'private_key_pass_phrase')
        self.processors['infocard_acct'] = self._process_options('infocard_acct')
        
        #read any sets of infocard options
        Sets =  self.config.getlist('infocard_acct', 'infocard_definitions')
        if Sets:
            for element in Sets:
                name = element.strip()  #remove any unsightly spaces
                self.processors[name] = self._process_options(name)
        
        scheme, host = urlparse.urlparse(self.env.abs_href())[:2]
        if not scheme or not host:
            self.log.error('Trac configuration for \'base_url\' option '\
            'doesn\'t contain host and scheme information.')
            
    def _process_options(self, tag):
        """read a block of options from the configuration and store them in a 
        local structure for later use.
        """
        options = {}
        #uniquely name this block of options using it's tag from trac.ini
        options['blockID'] = tag

        #process basic options with no defaults
        config_fields = ['required_claims', 'optional_claims', 
            'privacy_url', 'privacy_version', 'issuer', 'associated_user', 
            'Audience']
        for field in config_fields:
            data =  self.config.get(tag, field)
            if data:
                options[field] = data

        #process warning levels and debug options, these may result in upgrades
        #or downgrades in error reporting
        for field in event.config_fields:
            data = self.config.get(tag, field)
            if data:
                options[field] = data

        #process options which have defaults and need to be 
        options['debug_page'] = self.config.getbool(tag, 'debug_page', False)
        options['header_text'] = self.config.get(tag, 'header_text', 'InfoCard Login')
        options['help_text'] = self.config.get(tag, 'help_text', 'Use any InfoCard to login to your existing account')
        options['token_type'] = self.config.get(tag, 'token_type', 'http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1')

        #append all hard coded mandatory claims to the required claims 
        if options.has_key('required_claims'):
            options['required_claims'] = options['required_claims'] + " " + " ".join(self.mandatoryClaims)
        else:
            options['required_claims'] = " " + ' '.join(self.mandatoryClaims)

        Audience = self.env.abs_href().replace('http:', '(http|https):', 1)
        options['Audience'] = Audience + '/login/?$'
         
        #setup basic infocard processor for duty
        processor = InfoCardProcessor()
        if processor:
            processor.setDecode(self.privateKey, self.privateKeyPassPhrase, True, False)
            processor.setClaims(
                self._get_option_from_options(options, 'required_claims'), 
                self._get_option_from_options(options, 'optional_claims'))
            processor.setOptions(options)
            options['processorTag'] = processor
#       self.log.debug("For %s required: %s, optional: %s" % 
#           (tag, self._get_option_from_options(options, 'required_claims'), 
#               self._get_option_from_options(options, 'optional_claims')))
        return options

    def authenticate(self, req):
        """called when req.authname is accessed, since this is actually called 
        by many processes in trac, it will often be the time when the security
        token is read and processed.  """
        #self.log.debug('web_ui:LoginModule:authenticate' )
        authnanme = None
        if req.method == 'POST' and req.path_info.startswith('/login'):
            #try:
            #   self.log.debug('web_ui:LoginModule:authenticate:: posted request to login for \"%s\"', req.environ['REMOTE_USER'])
            #except (NameError, KeyError):
                req.environ['REMOTE_USER'] = self._remote_user(req)
                #self.log.debug('web_ui:LoginModule:authenticate:: remote: \"%s\", req.environ[\'REMOTE_USER\']: \"%s\"', req.remote_user, req.environ['REMOTE_USER'])              
        authname = auth.LoginModule.authenticate(self, req)
        #self.log.debug('web_ui:LoginModule:authenticate:: authname = \"%s\"', authname) 
        return authname

    authenticate = if_enabled(authenticate)

    def match_request(self, req):
        """See if we handle the request, we watch for login/logout"""
        if if_enabled(auth.LoginModule.match_request) \
            and ( (re.match(r'/login/?$', req.path_info) is not None) \
                or (re.match(r'/logout/?$', req.path_info) is not None)):
            return True

        return False

    def process_request(self, req):
        """ handle display of the login page, display of login results, 
        and logout requests"""

#       self.log.debug('web_ui:LoginModule:process_request : %s' % 
#           (req.path_info))
        if req.path_info.startswith('/logout'):
            self._cleanup_session(req)
        if req.path_info.startswith('/login'):
            if req.authname == 'anonymous':

                data = {
                    'title': 'Login',
                    'login_header': 'Login',
                    'error_header': 'Error',
                    'referer': self._referer(req),
                    'reset_password_enabled': AccountModule(self.env).reset_password_enabled,
                    'submit_text': 'Login',
                    'display_infocard': True,
                    'infocards': self.processors,
                    'help_text': self.config.get('infocard_acct', 'up_help_text', 'Use existing credentials to authenticate to your account'),
                    'up_show': self.config.getbool('infocard_acct', 'up_show', True)
                }

                if not req.args.get('xmlToken') and not req.args.get('cardkeyhash'):
                    data['display_infocard'] = True
                    if req.method == 'POST':
                        data['login_error'] = 'Invalid username or password'
                else:
                    secToken = self._get_token(req)
                    cardkeyhash = None
                    if req.args.get('cardkeyhash'):
                        cardkeyhash = req.args.get('cardkeyhash')
                    elif secToken:
                        if secToken and secToken.isValid:
                            cardkeyhash = secToken.getMetaDataValues(infocard.infocardlib.META_CardKeyHash)
                            self.log.debug('setup session: pre associate')
                            self._setup_session(req)
                        elif secToken:
                            #invalid security token, handle error
                            data['infocard'] = secToken
                            data['title'] = 'Invalid Infocard Detail'
                            if secToken.eventLog:
                                data['events'] = secToken.eventLog.events
                            return 'infocard-detail.html', data, None

                    data['cardkeyhash'] = cardkeyhash
                    data['title'] = 'Associate'
                    data['login_header'] = 'Login to associate an InfoCard with an Account'
                    data['error_header'] = 'Warning',
                    data['login_error'] = 'Credentials have not been associated with your account'
                    data['submit_text'] = 'Associate'
                    data['blockID'] = 'infocard_acct'
                    data['display_infocard'] = False
                    data['help_text'] = self.config.get('infocard_acct', 'associate_help_text')
                    data['up_show'] = True
                return 'authenticate.html', data, None
            elif req.args.get('xmlToken'):
                secToken = self._get_token(req)
                data = {'infocard': secToken}

                if self._get_option(req, 'debug_page'):
                    self.log.debug('debug_page %s', req.remote_user)
                    self._do_debug_login(req)
                    self._setup_session(req)
                    data['title'] = 'Infocard Debug'
                if not secToken.isValid:
                    data['title'] = 'Invalid Infocard Detail'
                if secToken.eventLog:
                    data['events'] = secToken.eventLog.events
                if (not secToken.isValid) or self._get_option(req, 'debug_page'):
                    return 'infocard-detail.html', data, None
                if not req.remote_user:
                    self._remote_user(req)
                self._setup_session(req)
            elif not self._remote_user(req):
                self._redirect_back(req)
        return auth.LoginModule.process_request(self, req)

    def _cleanup_session(self, req):
        """We need to delete session attributes here, allow all people who 
        potentially cached information from the login to act on the logout
        """
        SecTokenSessionModule(self.env).logout(req)

    def _setup_session(self, req):
        """setup session with infocard variables so we can get back to them
        the infocard must be parsed and availible on this request
        """
        SecTokenSessionModule(self.env).login(req, self._get_token(req))

    def _do_debug_login(self, req):
        """this emulates the code in trac.web.auth.py, but doesn't do the redirect
        It should be only used for the debug login.
        """

        ignore_case = BoolOption('trac', 'ignore_auth_case', 'false',
        """Whether case should be ignored for login names (''since 0.9'').""")

        remote_user = req.remote_user
        if self.ignore_case:
            remote_user = remote_user.lower()
        cookie = hex_entropy()
        db = self.env.get_db_cnx()
        cursor = db.cursor()
        cursor.execute("INSERT INTO auth_cookie (cookie,name,ipnr,time) "
            "VALUES (%s, %s, %s, %s)", (cookie, remote_user,
            req.remote_addr, int(time.time())))
        db.commit()

        req.authname = remote_user
        req.outcookie['trac_auth'] = cookie
        req.outcookie['trac_auth']['path'] = req.href()

    def _get_option_from_options(self, options, tag):
        if options and options.has_key(tag):
            return options[tag]
        return None

    def _get_option(self, req, tag):
        """Manage the options lists for all infocard login configs  
        """
        block = req.args.get('blockID')
        if not block:
            block = 'infocard_acct'
        try:
            options = self.processors[block]
            return self._get_option_from_options(options, tag)
        except (NameError, KeyError):
            pass

    def _get_token(self, req):
        """get the security token, cache it on the request so it isn't reparsed
        """

        secToken = None
        try:
            secToken = req.environ['Security_Token']
        except (NameError, KeyError):
            processor = self._get_option(req, 'processorTag')
            transport = 'http'
            referer = self._referer(req)
            if referer and referer.startswith('https'):
                transport = 'https'
            secToken = processor.processToken(req.args.get('xmlToken'), transport)
            req.environ['Security_Token'] = secToken
        return secToken

    def _remote_user(self, req):
        """ Called to determine the name of the user, it's poorly named.  It has
        the side effect of actually verifying username/password or credentials
        """

#        self.log.debug('web_ui:LoginModule:_remote_user' )
        user = req.args.get('user')
        password = req.args.get('password')
        #if user and password:
        #   self.log.debug('web_ui:LoginModule:_remote_user :' + user + ' : ' + password)
        if user or req.args.get('xmlToken'):
            if user and AccountManager(self.env).check_password(user, password):
                if req.args.get('cardkeyhash'):
                    associateduser = AssociationManager(self.env).check_association(req.args.get('cardkeyhash'))
                    if associateduser: 
                        if associateduser != user:
                            self.log.debug('web_ui:LoginModule:_remote_user'
                                '\"%s\" != \"%s\"', user, associateduser)
                            return None
                    else :
                        self.log.debug('web_user:LoginModule:_remote_user:set_association for \"%s\"', user)
                        AssociationManager(self.env).set_association(user, req.args.get('cardkeyhash'))
#                self.log.debug('web_ui:LoginModule:_remote_user check_password worked returning '
#                                '\"%s\"', user)
                return user
            elif req.args.get('xmlToken') and req.path_info.startswith('/login'):
                #self.log.debug('web_user:LoginModule:_remote_user parsing token')
                secToken = self._get_token(req)
                if secToken and secToken.isValid:
                    user = AssociationManager(self.env).check_association(secToken.getMetaDataValues(infocard.infocardlib.META_CardKeyHash))
                    if user:
#                        self.log.debug('web_user:LoginModule:_remote_user:check_association returned : \"%s\"', user)
                        return user
                    else:
                        associateduser = self._get_option(req, 'associated_user')
                        if associateduser:
                            return associateduser
                        self.log.debug('web_ui:LoginModule:_remote_user:check_association failed')
        self.log.debug('web_ui:LoginModule:_remote_user: -> None')
        return None

    def _redirect_back(self, req):                                                          
        """Redirect the user back to the URL she came from, only used during 
        debug logins, otherwise we allow trac to handle the request redirect."""
        referer = self._referer(req)
        if referer and ((not referer.startswith(req.base_url)) 
            or (referer.endswith("login"))):
            # don't redirect to external sites
            referer = None
        req.redirect(referer or self.env.abs_href())

    def _referer(self, req):
        return req.args.get('referer') or req.get_header('Referer')

    def enabled(self):
        # Users should disable the built-in authentication to use this one
        return not (self.env.is_component_enabled(auth.LoginModule) \
        or self.env.is_component_enabled(web_ui.LoginModule))
    enabled = property(enabled)

    # ITemplateProvider

    def get_htdocs_dirs(self):
        """Return the absolute path of a directory containing additional
        static resources (such as images, style sheets, etc).
        """
        from pkg_resources import resource_filename
        return [('infocard_acct', resource_filename(__name__, 'htdocs')),
           ('site', self.env.get_htdocs_dir())]

    def get_templates_dirs(self):
        """Return the absolute path of the directory containing the provided
        templates.
        """
        from pkg_resources import resource_filename
        return [resource_filename(__name__, 'templates')]