Current File : //opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyo
�
a�Nc @ s d Z d d l Z y d d l m Z Wn! e k
rI d d l m Z n Xd d l Z d d l m Z d d l m
Z d d l m Z
d e f d � � YZ d e f d
� � YZ d � Z d � Z d
� Z d d � Z d e f d � � YZ d d e e d d � Z d S( s'
Implementation of cookie signing as done in `mod_auth_tkt
<http://www.openfusion.com.au/labs/mod_auth_tkt/>`_.
mod_auth_tkt is an Apache module that looks for these signed cookies
and sets ``REMOTE_USER``, ``REMOTE_USER_TOKENS`` (a comma-separated
list of groups) and ``REMOTE_USER_DATA`` (arbitrary string data).
This module is an alternative to the ``paste.auth.cookie`` module;
it's primary benefit is compatibility with mod_auth_tkt, which in turn
makes it possible to use the same authentication process with
non-Python code run under Apache.
i����N( t md5( t request( t quote( t unquotet
AuthTicketc B sA e Z d Z d d d d e d � Z d � Z d � Z d � Z RS( s�
This class represents an authentication token. You must pass in
the shared secret, the userid, and the IP address. Optionally you
can include tokens (a list of strings, representing role names),
'user_data', which is arbitrary data available for your own use in
later scripts. Lastly, you can override the cookie name and
timestamp.
Once you provide all the arguments, use .cookie_value() to
generate the appropriate authentication ticket. .cookie()
generates a Cookie object, the str() of which is the complete
cookie header to be sent.
CGI usage::
token = auth_tkt.AuthTick('sharedsecret', 'username',
os.environ['REMOTE_ADDR'], tokens=['admin'])
print 'Status: 200 OK'
print 'Content-type: text/html'
print token.cookie()
print
... redirect HTML ...
Webware usage::
token = auth_tkt.AuthTick('sharedsecret', 'username',
self.request().environ()['REMOTE_ADDR'], tokens=['admin'])
self.response().setCookie('auth_tkt', token.cookie_value())
Be careful not to do an HTTP redirect after login; use meta
refresh or Javascript -- some browsers have bugs where cookies
aren't saved when set on a redirect.
t t auth_tktc C ss | | _ | | _ | | _ d j | � | _ | | _ | d k rT t j � | _ n | | _ | | _ | | _
d S( Nt ,( t secrett useridt ipt joint tokenst user_datat Nonet time_modt timet cookie_namet secure( t selfR R R
R R
R R R ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyt __init__W s c C s+ t | j | j | j | j | j | j � S( N( t calculate_digestR
R R R R R
( R ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyt digestf s c C sY d | j � t | j � t | j � f } | j rH | | j d 7} n | | j 7} | S( Ns %s%08x%s!t !( R t intR t url_quoteR R R
( R t v( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyt cookie_valuek s
+
c C sl t j � } | j � j d � j � j d d � | | j <d | | j d <| j rh d | | j d <n | S( Nt base64s
R t /t patht trueR ( t Cookiet SimpleCookieR t encodet stript replaceR R ( R t c( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyt cookier s . ( N( t __name__t
__module__t __doc__R t FalseR R R R& ( ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyR 3 s "
t BadTicketc B s e Z d Z d d � Z RS( s�
Exception raised when a ticket can't be parsed. If we get
far enough to determine what the expected digest should have
been, expected is set. This should not be shown by default,
but can be useful for debugging.
c C s | | _ t j | | � d S( N( t expectedt ExceptionR ( R t msgR, ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyR � s N( R' R( R) R R ( ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyR+ { s c C s9 | j d � } | d } y t | d d !d � } Wn# t k
rX } t d | � � n Xy | d j d d � \ } } Wn t k
r� t d � � n Xt | � } d | k r� | j d d � \ } } n d } | } t | | | | | | � }
|
| k rt d
d |
| f �� n | j d � } | | | | f S(
s�
Parse the ticket, returning (timestamp, userid, tokens, user_data).
If the ticket cannot be parsed, ``BadTicket`` will be raised with
an explanation.
t "i i( i s" Timestamp is not a hex integer: %sR i s userid is not followed by !R s Digest signature is not correctR, R ( R# R t
ValueErrorR+ t splitt url_unquoteR ( R t ticketR
R t timestampt eR t dataR R
R, ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyt parse_ticket� s,
c C s} t | � } t | � } t | � } t | � } t t | | � | | d | d | � j � } t | | � j � } | S( Nt ( t maybe_encodeR t encode_ip_timestampt hexdigest( R
R4 R R R R
t digest0R ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyR � s 0c C s� d j t t t t | j d � � � � } t | � } | d @d ?| d @d ?| d @d ?| d @f } d j t t | � � } | | S(
NR t .I � i i � i i � i i� ( R t mapt chrR R1 ( R
R4 t ip_charst tt tst ts_chars( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyR: � s *
t utf8c C s% t | t � r! | j | � } n | S( N( t
isinstancet unicodeR" ( t st encoding( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyR9 � s t AuthTKTMiddlewarec B sJ e Z d Z d e e d e e e e d � Z d � Z d � Z d � Z RS( s�
Middleware that checks for signed cookies that match what
`mod_auth_tkt <http://www.openfusion.com.au/labs/mod_auth_tkt/>`_
looks for (if you have mod_auth_tkt installed, you don't need this
middleware, since Apache will set the environmental variables for
you).
Arguments:
``secret``:
A secret that should be shared by any instances of this application.
If this app is served from more than one machine, they should all
have the same secret.
``cookie_name``:
The name of the cookie to read and write from. Default ``auth_tkt``.
``secure``:
If the cookie should be set as 'secure' (only sent over SSL) and if
the login must be over SSL. (Defaults to False)
``httponly``:
If the cookie should be marked as HttpOnly, which means that it's
not accessible to JavaScript. (Defaults to False)
``include_ip``:
If the cookie should include the user's IP address. If so, then
if they change IPs their cookie will be invalid.
``logout_path``:
The path under this middleware that should signify a logout. The
page will be shown as usual, but the user will also be logged out
when they visit this page.
If used with mod_auth_tkt, then these settings (except logout_path) should
match the analogous Apache configuration settings.
This also adds two functions to the request:
``environ['paste.auth_tkt.set_user'](userid, tokens='', user_data='')``
This sets a cookie that logs the user in. ``tokens`` is a
string (comma-separated groups) or a list of strings.
``user_data`` is a string for your own use.
``environ['paste.auth_tkt.logout_user']()``
Logs out the user.
R c C s^ | | _ | | _ | | _ | | _ | | _ | | _ | | _ | | _ | | _ |
| _ d S( N(
t appR R R t httponlyt
include_ipt logout_patht no_domain_cookiet current_domain_cookiet wildcard_cookie( R RJ R R R RL RM RK RN RO RP ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyR � s c
s� t j � � } � j | k r1 | � j j } n d } | r� � j rS � d } n d } y� t � j | | � \ } } } } d j | � } | � d <� j d � r� � d d | } n | � d <| � d <d � d <Wq� t k
r� q� Xn g � d d � � � f d
� }
� � � f d � } |
� d <| � d
<� j
re� j d � � j
k re| � n d � � f d � } � j � | � S( NR t REMOTE_ADDRs 0.0.0.0R t REMOTE_USERt REMOTE_USER_TOKENSt REMOTE_USER_DATAR& t AUTH_TYPEc s# � j � j � | | | � � d S( N( t extendt set_user_cookie( R R R
( t environR t set_cookies( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyt set_user, s c s � j � j � � � d S( N( RV t logout_user_cookie( ( RX R RY ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyt logout_user0 s s paste.auth_tkt.set_users paste.auth_tkt.logout_usert PATH_INFOc s | j � � � | | | � S( N( RV ( t statust headerst exc_info( RY t start_response( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyt cookie_setting_start_response8 s
(
R t get_cookiesR t valueRL R7 R R t getR+ RM R RJ (
R RX Ra t cookiesR t remote_addrR4 R R R
RZ R\ Rb ( ( RX R RY Ra sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyt __call__ s:
!
c C sv t | t � s! d j | � } n | j r7 | d } n d } t | j | | d | d | d | j d | j �} | j d | j d � � } d
| } d } | j r� | d 7} n | j r� | d
7} n g }
| j
r|
j d d | j | j � | f f � n | j
r:|
j d d | j | j � | | f f � n | j rr|
j d d | j | j � | | f f � n |
S( NR RQ s 0.0.0.0R R
R R t HTTP_HOSTt SERVER_NAMER= R s ; secures
; HttpOnlys
Set-Cookies %s=%s; Path=/%ss %s=%s; Path=/; Domain=%s%s( RE t
basestringR RL R R R R Re RK RN t appendR RO RP ( R RX R R R
Rg R3 t
cur_domaint wild_domaint cookie_optionsRf ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyRW > sB
c C s} | j d | j d � � } d | } d } d d | j | f f d d | j | | f f d d | j | | f f g } | S( NRi Rj R= s Sat, 01-Jan-2000 12:00:00 GMTs
Set-Cookies %s=""; Expires="%s"; Path=/s& %s=""; Expires="%s"; Path=/; Domain=%s( Re R ( R RX Rm Rn t expiresRf ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyR[ g s
N(
R' R( R) R* t TrueR R Rh RW R[ ( ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyRI � s 2 2 )R c C sz d d l m } | | � } | | � } | d k rF | j d � } n | s[ t d � � n t | | | | | | pv d � S( s�
Creates the `AuthTKTMiddleware
<class-paste.auth.auth_tkt.AuthTKTMiddleware.html>`_.
``secret`` is requird, but can be set globally or locally.
i����( t asboolR s> You must provide a 'secret' (in global or local configuration)N( t paste.deploy.convertersRr R Re R0 RI ( RJ t global_confR R R RL RM Rr ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyt make_auth_tkt_middlewareu s ( R) R R t hashlibR t ImportErrorR t pasteR t urllibR R R R2 t objectR R- R+ R7 R R: R9 RI R R* Rq Ru ( ( ( sD /opt/alt/python27/lib/python2.7/site-packages/paste/auth/auth_tkt.pyt <module>& s*
H % �
Mini Shell