Changeset 1098 for trunk/rp/trac

Timestamp:

11/16/07 14:18:30 (14 months ago)

Author:

dbuss

Message:

Update Trac RP,

Location:

trunk/rp/trac

Files:

• infocard_acct.tar (modified) (previous)
• infocard_acct/0.11/infocard_acct/groups.py (added)
• infocard_acct/0.11/infocard_acct/infocard/infocardlib.py (modified) (11 diffs)
• infocard_acct/0.11/infocard_acct/ldapstore.py (modified) (2 diffs)
• infocard_acct/0.11/infocard_acct/templates/infocard-detail.html (modified) (2 diffs)
• infocard_acct/0.11/infocard_acct/templates/infocard-session-detail.html (added)
• infocard_acct/0.11/infocard_acct/web_ui.py (modified) (13 diffs)
• infocard_acct/0.11/setup.py (modified) (1 diff)

trunk/rp/trac/infocard_acct/0.11/infocard_acct/infocard/infocardlib.py

@@ -63 +63 @@
 import xmlseclibs, cookielib, datetime
 import hashlib
+import urlparse
 from xml.dom import minidom
 from xml import xpath
@@ -227 +228 @@
                                                 else:
                                                         #do validity checking
-                                                        self.isValid = self._isValid()
+                                                        self.isValid = self._isValid(options)
                                                         #grab assertions/claims
-                                                        self.assertions = self._getAssertions()
+                                                        self._setupAssertions(options)
                                                         #set up metadata about the token for later use
-                                                        self._getMiscData()
+                                                        self._setupMiscData(options)
                                         else:
                                                 self.eventLog.add_event('Unable to decrypt token',
@@ -247 +248 @@
         """Setup all of the data about the token we can 
         """
-        def _getMiscData(self):
+        def _setupMiscData(self, options):
                 rootNode = self.decrypted.documentElement
                 if rootNode:
@@ -255 +256 @@
                         self.metadata[META_MajorVersion] = rootNode.getAttribute('MajorVersion')
                         self.metadata[META_MinorVersion] = rootNode.getAttribute('MinorVersion')
-                self.metadata[META_CardKeyHash] = self.getCardKeyHash()
-
-        def _isValid(self):
+                self.metadata[META_CardKeyHash] = self._getCardKeyHash()
+
+        def _isValid(self, options):
                 """ Validate the SAML token
                 """
@@ -266 +267 @@
                         self.eventLog.add_event("SAML Signature Location Failed",
                                 event.ERROR, 'locate-saml-signature')
-                                
+
                 # Canonicalize the signed info
                 objXMLSecDSig.canonicalizeSignedInfo()
@@ -297 +298 @@
                                 event.ERROR, 'verify-signature')
                         return False
-                
+
                 #validate Conditions, both Audience and Time
                 xPath = xpath.CreateContext(self.decrypted)
                 xPath.setNamespaces({'mysaml' : SAML_1_0_ASSERT_NS})
-                
+
                 query = '/mysaml:Assertion/mysaml:Conditions/mysaml:AudienceRestrictionCondition/mysaml:Audience'
                 nodelist = xpath.Evaluate(query, context=xPath)
@@ -313 +314 @@
                         self.metadata[META_NotBefore] = node.getAttribute('NotBefore')
                         self.metadata[META_NotOnOrAfter] = node.getAttribute('NotOnOrAfter')
-                        
+
                         if ((not self.metadata[META_NotBefore]) or 
                                 (not self.metadata[META_NotOnOrAfter])):
@@ -330 +331 @@
                 if self.eventLog.has_severity(event.ERROR):
                         return False
-                        
+
                 return True
-                
-                
+
+
         #TODO handle namespaces, claim name mapping, multiple values!
-        def _getAssertions(self):
+        def _setupAssertions(self, options):
                 if not self.assertions or len(self.assertions) == 0:
+                        mvClaims = []
+                        temp = self._option(options, OPTION_multivalued_claims)
+                        if temp:
+                                mvClaims = temp.rsplit(' ')
                         xPath = xpath.CreateContext(self.decrypted)
                         xPath.setNamespaces({'mysaml' : SAML_1_0_ASSERT_NS})
                         query = '/mysaml:Assertion/mysaml:AttributeStatement/mysaml:Attribute'
                         nodelist = xpath.Evaluate(query, context=xPath)
-                        
+
                         for node in nodelist:
+                                ns = node.getAttribute('AttributeNamespace')
                                 name = node.getAttribute('AttributeName')
                                 if (name):
@@ -349 +355 @@
                                                 if (child.localName == 'AttributeValue'):
                                                         value = child.firstChild.data
-                                                        break
-                                        self.assertions[name] = value
-                return self.assertions
-
-        def getCardKeyHash(self):
+                                                        try:
+                                                                nsDict = self.assertions[ns]
+                                                                try:
+                                                                        if nsDict[name]:
+                                                                                #TODO multivalued check
+                                                                                pass
+                                                                        else:
+                                                                                nsDict[name] = value
+                                                                except Exception:
+                                                                        nsDict[name] = value
+                                                        except Exception:
+                                                                self.assertions[ns] = {name:value}
+
+        def getAssertion(self, identifier=None):
+                """Allows retrivial of any claim or assertion associated with the security token
+                Returns either the data or None
+                visit and finish this function!
+                """
+                #is the identifier a URI or just a short name?
+                ns = None
+                claim =None
+                try:
+                        s = identifier.rsplit('/', 1)
+                        if s.items() > 1:
+                                ns = s[0]
+                        claim = s[-1]
+                except Exception:
+                        claim = identifier
+
+                claims = dict()
+                for nsElem in self.assertions.keys():
+                        if not ns or (ns and ns == nsElem):
+                                nsDict = self.assertions[nsElem]
+                                for key in nsDict.keys():
+                                        if claim and claim == key:
+                                                return nsDict[key]
+                                        elif not claim:
+                                                if ns:
+                                                        claims[ns+'//'+key] = nsDict[key]
+                                                else:
+                                                        claims[key] = nsDict[key]
+                                                break
+                if claims.items():
+                        return claims
+                else:
+                        return None
+
+
+        def getMetaData(self, identifier=None):
+                """Allows retrivial of any meta data associated with the security token
+                Pass a specific string for the identifier and receive either a 
+                string or None
+                If the identifier is None then a dictionary of all meta data is returned
+                Currently all meta data is single valued!
+                """
+                if identifier:
+                        try:
+                                return self.metadata[identifier]
+                        except Exception:
+                                return None
+                else:
+                        return self.metadata
+                
+        def _getCardKeyHash(self):
                 try:
                         return self.metadata[META_CardKeyHash]
@@ -359 +424 @@
                         m = hashlib.md5()
                         signer = None
-                        if 'privatepersonalidentifier' in self.assertions:
-                                m.update(self.assertions['privatepersonalidentifier'])
+                        ppid = self.getAssertion('privatepersonalidentifier')
+                        if ppid:
+                                m.update(ppid)
                         if self.objKeyInfo and self.objKeyInfo.isEncrypted:
                                 if self.objKeyInfo.modulus:
@@ -366 +432 @@
                                 if self.objKeyInfo.exponent:
                                         m.update(self.objKeyInfo.exponent)
-#                               if self.objKeyInfo.encryptedCtx:
-#                                       m.update(self.objKeyInfo.encryptedCtx)                          
                         self.metadata[META_CardKeyHash] = m.hexdigest()
                         return self.metadata[META_CardKeyHash]

trunk/rp/trac/infocard_acct/0.11/infocard_acct/ldapstore.py

@@ -130 +130 @@
 #               if self._user_is_invalid(user):
 #                       return False
-#               try:
+                try:
                         search_url = self._setup_search_url()
                         if search_url:
@@ -136 +136 @@
                                 l.simple_bind_s(search_url.who, search_url.cred)
                                 searchfilter = '(& ' + search_url.filterstr + '('+ self._get_attr(search_url)+'='+ user +'))'
-                                self.log.debug('LDAPUserStore:check_password: searching \"%s\" '
-                                        + 'for \"%s\"', search_url.dn, searchfilter)
+#                               self.log.debug('LDAPUserStore:check_password: searching \"%s\" '
+#                                       + 'for \"%s\"', search_url.dn, searchfilter)
                                 results = l.search_s(search_url.dn, search_url.scope, searchfilter)
                                 if len(results) == 1:
-                                        self.log.debug('LDAPUserStore:check_password \"%s\" for \"%s\"',
-                                                password, (results[0])[0])
-                                        for entry in results:
-                                                self.log.debug('LDAPUserStore:check_password \"%s\"', entry[0])
-                                                self.log.debug('LDAPUserStore:check_password \"%s\"', entry[1])
+#                                       self.log.debug('LDAPUserStore:check_password \"%s\" for \"%s\"',
+#                                               password, (results[0])[0])
+#                                       for entry in results:
+#                                               self.log.debug('LDAPUserStore:check_password \"%s\"', entry[0])
+#                                               self.log.debug('LDAPUserStore:check_password \"%s\"', entry[1])
                                         l.simple_bind_s(results[0][0], password)
-                                        self.log.debug('LDAPUserStore:check_password succeeded')
+#                                       self.log.debug('LDAPUserStore:check_password succeeded')
                                         return True
-                                elif len(results) == 0:
-                                        self.log.debug('LDAPUserStore:check_password search failed')
-                                else:
-                                        for entry in results:
-                                                self.log.debug('LDAPUserStore:check_password \"%s\"', entry[0])
-                                                self.log.debug('LDAPUserStore:check_password \"%s\"', entry[1])
-#               except:
+#                               elif len(results) == 0:
+#                                       self.log.debug('LDAPUserStore:check_password search failed')
+#                               else:
+#                                       for entry in results:
+#                                               self.log.debug('LDAPUserStore:check_password \"%s\"', entry[0])
+#                                               self.log.debug('LDAPUserStore:check_password \"%s\"', entry[1])
+                except:
                         #on error just return the password failed
-#                       nop=1   
                         self.log.debug('LDAPUserStore:check_password failed')
                         return False

trunk/rp/trac/infocard_acct/0.11/infocard_acct/templates/infocard-detail.html

@@ -69 +69 @@
         </table>
         
-         <table py:if="infocard.assertions" class="listing" id="claims">
+        <py:with vars="claims =infocard.getAssertion()">
+         <table py:if="claims" class="listing" id="claims">
                 <thead>
           <tr>                                                                         
@@ -76 +77 @@
         </thead>
         <tbody>
-                 <div py:for="name in infocard.assertions.keys()">
+                 <div py:for="name in claims.keys()">
                         <tr>
                                 <td><pre>${name}</pre></td>
-                                <td><pre>${infocard.assertions[name]}</pre></td>
+                                <td><pre>${claims[name]}</pre></td>
                         </tr>
                  </div>
                 </tbody>
          </table>
-        
+        </py:with>
 
   </body>

trunk/rp/trac/infocard_acct/0.11/infocard_acct/web_ui.py

@@ -48 +48 @@
 
 from acct_mgr.api import AccountManager
+from acct_mgr import web_ui
 from acct_mgr.web_ui import AccountModule
 
 from association import AssociationManager
 
-#for infocard functions
 import infocard.xmlseclibs, infocard.infocardlib
+from infocard import infocardlib
 from infocard.infocardlib import SecToken, InfoCardProcessor
 
@@ -81 +82 @@
                 privacyPolicyVer = Option('infocard_acct', 'privacy_version', '')
                 issuer = Option('infocard_acct', 'privacy_issuer', '')
-                displayDebug = BoolOption('infocard_acct', 'debug', False)
                 
                 self.privateKey = self.env.config['infocard_acct'].get('private_key_path')
@@ -89 +89 @@
                 self.privacyPolicyVer = self.env.config['infocard_acct'].get('privacy_version')
                 self.issuer = self.env.config['infocard_acct'].get('issuer')
-                self.displayDebug = self.env.config['infocard_acct'].get('debug')
+                self.displayDebug = self.config.getbool('infocard_acct', 'debug', False)
         
                 #append all hard coded mandatory claims to the required claims 
@@ -115 +115 @@
         authenticate = if_enabled(authenticate)
 
-        match_request = if_enabled(auth.LoginModule.match_request)
+        def match_request(self, req):
+                if if_enabled(auth.LoginModule.match_request) \
+                        and ( (re.match(r'/login/?$', req.path_info) is not None) \
+                                or (re.match(r'/logout/?$', req.path_info) is not None)):
+                        return True
+
+                if re.match(r'/iinfo/?$', req.path_info) is not None:
+                        return True
+                        
+                return False
 
         def process_request(self, req):
-                #self.log.debug('web_ui:LoginModule:process_request : %s for %s', req.path_info, req.authname )
+#               self.log.debug('web_ui:LoginModule:process_request : '+req.path_info)
+                if req.path_info.startswith('/logout'):
+                        self._cleanup_session(req)
+                if req.path_info.startswith('/iinfo'):
+                        data = {
+                                'title': 'Infocard Session Debug',
+                                'session': req.session,
+                                'tok_claims': req.session.get('tok_claims'),
+                                'tok_meta': req.session.get('tok_meta')
+                        }
+                        return 'infocard-session-detail.html', data, None
                 if req.path_info.startswith('/login'):
                         if req.authname == 'anonymous':
@@ -146 +165 @@
                                         elif secToken:
                                                 if secToken and secToken.isValid:
-                                                        cardkeyhash = secToken.getCardKeyHash()
+                                                        cardkeyhash = secToken.getMetaData(infocard.infocardlib.META_CardKeyHash)
+                                                        self._setup_session(req)
                                                 elif secToken:
                                                         #invalid security token, handle error
@@ -165 +185 @@
                         elif req.args.get('xmlToken') and self.displayDebug:
                                 self._do_debug_login(req)
+                                self._setup_session(req)
                                 secToken = self._get_token(req)
                                 data = {
@@ -173 +194 @@
                                         data['events'] = secToken.eventLog.events
                                 return 'infocard-detail.html', data, None
+                                
                         self.log.debug("%s",  self.displayDebug)
+                        self._setup_session(req)
                 return auth.LoginModule.process_request(self, req)
                 
+        def _cleanup_session(self, req):
+                """We need to delete session attributes here
+                """
+                pass
+
+        def _setup_session(self, req):
+                """setup session with infocard variables so we can get back to them
+                the infocard must be parsed and availible on this request
+                """
+                secToken = self._get_token(req)
+                if secToken:
+                        metaData = secToken.getMetaData()
+                        if metaData:
+                                tok_meta=''
+                                for key in metaData.keys():
+                                        req.session['tok_meta_'+key] = metaData[key]
+                                        tok_meta += ' tok_meta_'+key
+                                req.session['tok_meta'] = tok_meta
+                                #self.log.debug("tok_meta : %s", tok_meta)
+                        claims = secToken.getAssertion()
+                        if claims and claims.keys():
+                                tok_claims=''
+                                for key in claims.keys():
+                                        req.session['tok_claim_'+key] = claims[key]
+                                        tok_claims += ' tok_claim_'+key
+                                req.session['tok_claims'] = tok_claims
+                                #self.log.debug("tok_claims : %s", tok_claims)
+
         def _do_debug_login(self, req):
                 """this emulates the code in trac.web.auth.py, but doesn't do the redirect
+                It should be only used for the debug login.
                 """
                 ignore_case = BoolOption('trac', 'ignore_auth_case', 'false',
                 """Whether case should be ignored for login names (''since 0.9'').""")
+                
                 remote_user = req.remote_user
                 if self.ignore_case:
@@ -196 +249 @@
                 req.outcookie['trac_auth']['path'] = req.href()
                 
-        # Manage the singletons for proecessors  
         def _get_processor(self, req):
+                """Manage the singletons for proecessors  
+                """
                 processor = None
                 processorTag = req.args.get('blockID')
@@ -214 +268 @@
                 
                 
-        # get the security token, cache it on the request so it isn't reparsed
         def _get_token(self, req):
+                """get the security token, cache it on the request so it isn't reparsed
+                """
+                
                 secToken = None
                 try:
@@ -253 +309 @@
                                 secToken = self._get_token(req)
                                 if secToken and secToken.isValid:
-                                        user = AssociationManager(self.env).check_association(secToken.getCardKeyHash())
+                                        user = AssociationManager(self.env).check_association(secToken.getMetaData(infocard.infocardlib.META_CardKeyHash))
                                         if user:
                                                 #self.log.debug('web_user:LoginModule:_remote_user:check_association returned : \"%s\"', user)
@@ -275 +331 @@
         def enabled(self):
                 # Users should disable the built-in authentication to use this one
-                return not self.env.is_component_enabled(auth.LoginModule)
+                return not (self.env.is_component_enabled(auth.LoginModule) \
+                or self.env.is_component_enabled(web_ui.LoginModule))
         enabled = property(enabled)
 
@@ -285 +342 @@
                 """
                 from pkg_resources import resource_filename
-                self.log.debug('LoginModule:get_htdocs_dirs: %s', resource_filename(__name__, 'htdocs'))
+#               self.log.debug('LoginModule:get_htdocs_dirs: %s', resource_filename(__name__, 'htdocs'))
                 return [('infocard_acct', resource_filename(__name__, 'htdocs')),
                    ('site', self.env.get_htdocs_dir())]
@@ -294 +351 @@
                 """
                 from pkg_resources import resource_filename
-                self.log.debug('LoginModule:get_templates_dirs: %s', resource_filename(__name__, 'templates'))
+#               self.log.debug('LoginModule:get_templates_dirs: %s', resource_filename(__name__, 'templates'))
                 return [resource_filename(__name__, 'templates')]
 

trunk/rp/trac/infocard_acct/0.11/setup.py

@@ -143 +143 @@
                 infocard_acct.ldapstore = infocard_acct.ldapstore
         infocard_acct.web_ui = infocard_acct.web_ui
+                infocard_acct.groups = infocard_acct.groups
      """,