Changeset 80
- Timestamp:
- 06/05/07 22:49:10
- Files:
Legend:
- Unmodified
- Added
- Removed
- Modified
- Copied
- Moved
AuthKit/branches/0.4/authkit/authenticate/cookie.py
r68 r80 106 106 """ 107 107 108 def __init__( 109 self, 110 secret, 111 userid, 112 ip, 113 tokens=(), 114 user_data='', 115 time=None, 116 cookie_name='authkit', 117 cookie_params=None 118 ): 108 def __init__(self, secret, userid, ip, tokens=(), user_data='', time=None, 109 cookie_name='authkit', cookie_params=None): 119 110 secure = False 120 111 if cookie_params is None: … … 131 122 else: 132 123 self.cookie_params = cookie_params.copy() 133 AuthTicket.__init__( 134 self, 135 secret, 136 userid, 137 ip, 138 tokens=tokens, 139 user_data=user_data, 140 time=time, 141 cookie_name=cookie_name, 142 secure=secure 143 ) 124 AuthTicket.__init__(self, secret, userid, ip, tokens=tokens, 125 user_data=user_data, time=time, 126 cookie_name=cookie_name, secure=secure) 144 127 145 128 def digest(self): 146 digest_ = calculate_digest( 147 self.ip, self.time, self.secret, self.userid, self.tokens, 148 self.user_data) 129 digest_ = calculate_digest(self.ip, self.time, self.secret, 130 self.userid, self.tokens, self.user_data) 149 131 log.debug( 150 132 "Calculating the digest ip %r, time %r, secret %r, userid %r, " 151 "tokens %r, user_data %r, digest %r", 152 self.ip, 153 self.time, 154 self.secret, 155 self.userid, 156 self.tokens, 157 self.user_data, 158 digest_ 159 ) 133 "tokens %r, user_data %r, digest %r", self.ip, self.time, 134 self.secret, self.userid, self.tokens, self.user_data, digest_) 160 135 return digest_ 161 136 … … 216 191 user_data = data 217 192 218 expected = calculate_digest(ip, timestamp, secret, 219 user id, tokens, user_data)220 193 expected = calculate_digest(ip, timestamp, secret, userid, tokens, 194 user_data) 195 221 196 if expected != digest: 222 197 raise BadTicket('Digest signature is not correct', 223 198 expected=(expected, digest)) 224 199 225 200 tokens = tokens.split(',') 226 201 227 202 return (timestamp, userid, tokens, user_data) 228 203 … … 230 205 log.debug( 231 206 "calculate_digest(ip=%r, timestamp=%r, secret=%r, userid=%r, " 232 "tokens=%r, user_data=%r)", 233 ip, 234 timestamp, 235 secret, 236 userid, 237 tokens, 238 user_data 239 ) 240 digest0 = md5.new( 241 encode_ip_timestamp(ip, timestamp) + secret + userid + '\0' 242 + tokens + '\0' + user_data).hexdigest() 207 "tokens=%r, user_data=%r)", ip, timestamp, secret, userid, tokens, 208 user_data) 209 digest0 = md5.new(encode_ip_timestamp(ip, timestamp) + secret + userid 210 + '\0' + tokens + '\0' + user_data).hexdigest() 243 211 digest = md5.new(digest0 + secret).hexdigest() 244 212 return digest … … 248 216 ip_chars = ''.join(map(chr, map(int, ip.split('.')))) 249 217 t = int(timestamp) 250 ts = ((t & 0xff000000) >> 24, 251 (t & 0xff0000) >> 16, 252 (t & 0xff00) >> 8, 218 ts = ((t & 0xff000000) >> 24, (t & 0xff0000) >> 16, (t & 0xff00) >> 8, 253 219 t & 0xff) 254 220 ts_chars = ''.join(map(chr, ts)) … … 272 238 """ 273 239 274 def __init__( 275 self, 276 app, 277 secret, 278 name='authkit', 279 params=None, 280 includeip=True, 281 signoutpath=None, 282 enforce=False, 283 ticket_class=AuthKitTicket 284 ): 240 def __init__(self, app, secret, name='authkit', params=None, 241 includeip=True, signoutpath=None, enforce=False, 242 ticket_class=AuthKitTicket): 285 243 log.debug("Setting up the cookie middleware") 286 244 secure = False 287 245 if params.has_key('secure') and asbool(params['secure']) == True: 288 246 secure = True 289 AuthTKTMiddleware.__init__( 290 self, 291 app, 292 secret, 293 cookie_name=name, 294 # secure not needed! 295 secure=secure, 296 include_ip=asbool(includeip), 297 logout_path=signoutpath, 298 ) 299 #raise Exception(include_ip) 247 248 # secure not needed! 249 AuthTKTMiddleware.__init__(self, app, secret, cookie_name=name, 250 secure=secure, include_ip=asbool(includeip), 251 logout_path=signoutpath) 252 300 253 self.ticket_class = ticket_class 301 254 self.cookie_params = params and params.copy() or {} 302 255 self.cookie_enforce = enforce 303 256 if self.cookie_enforce and not self.cookie_params.has_key('expires'): 304 raise Exception( 305 "Cannot enforce cookie expiration since no cookie_params " 306 "'expires' has been set" 307 ) 257 raise Exception("Cannot enforce cookie expiration since no " 258 "cookie_params expires' has been set") 308 259 309 260 def __call__(self, environ, start_response): … … 314 265 else: 315 266 cookie_value = '' 316 log.debug( 317 "Our cookie %r value is therefore %r", 318 self.cookie_name, 319 cookie_value 320 ) 321 remote_addr = environ.get( 322 'HTTP_X_FORWARDED_FOR', 323 environ.get('REMOTE_ADDR','0.0.0.0') 324 ) 325 log.debug( 326 "Remote addr %r, value %r, include_ip %r", 327 remote_addr, 328 cookie_value, 329 self.include_ip, 330 ) 267 log.debug("Our cookie %r value is therefore %r", self.cookie_name, 268 cookie_value) 269 remote_addr = environ.get('HTTP_X_FORWARDED_FOR', 270 environ.get('REMOTE_ADDR','0.0.0.0')) 271 log.debug("Remote addr %r, value %r, include_ip %r", remote_addr, 272 cookie_value, self.include_ip) 331 273 if cookie_value: 332 274 if self.include_ip: … … 345 287 headers = self.logout_user_cookie(environ) 346 288 headers.append(('Content-type','text/plain')) 347 start_response( 348 '401 Not authenticated', 349 headers, 350 ) 289 start_response('401 Not authenticated', headers) 351 290 if not msg: 352 291 msg = 'Bad cookie, you have been signed out.\n If this' … … 355 294 return [msg] 356 295 try: 357 log.debug( 358 "Parsing ticket secret %r, cookie value %r, " 359 "remote address %s", 360 self.secret, 361 cookie_value, 362 remote_addr, 363 ) 364 timestamp, userid, tokens, user_data = parse_ticket( 365 self.secret, 366 cookie_value, 367 remote_addr 368 ) 296 log.debug("Parsing ticket secret %r, cookie value %r, " 297 "remote address %s", self.secret, cookie_value, 298 remote_addr) 299 timestamp, userid, tokens, user_data = \ 300 parse_ticket(self.secret, cookie_value, remote_addr) 369 301 except BadTicket, e: 370 302 if e.expected: … … 377 309 log.debug("Cookie enforce: %s", self.cookie_enforce) 378 310 log.debug("Time difference: %s", str(now-timestamp)) 379 log.debug( 380 "Cookie params expire: %s", 381 self.cookie_params.get('expires') 382 ) 311 log.debug("Cookie params expire: %s", 312 self.cookie_params.get('expires')) 383 313 if self.cookie_enforce and now - timestamp > \ 384 314 float(self.cookie_params['expires']) + 1: 385 return bad_ticket_app( 386 environ, 387 start_response, 388 msg="Cookie expired." 389 ) 315 return bad_ticket_app(environ, start_response, 316 msg="Cookie expired.") 390 317 else: 391 318 environ['paste.auth_tkt.timestamp'] = timestamp 319 # End changes from the default 392 320 393 #394 # End changes from the default395 #396 397 321 tokens = ','.join(tokens) 398 322 environ['REMOTE_USER'] = userid … … 404 328 environ['AUTH_TYPE'] = 'cookie' 405 329 set_cookies = [] 330 406 331 def set_user(userid, tokens='', user_data=''): 407 set_cookies.extend(self.set_user_cookie( 408 environ, userid, tokens,user_data))332 set_cookies.extend(self.set_user_cookie(environ, userid, tokens, 333 user_data)) 409 334 def logout_user(): 410 335 set_cookies.extend(self.logout_user_cookie(environ)) 336 411 337 environ['paste.auth_tkt.set_user'] = set_user 412 338 environ['paste.auth_tkt.logout_user'] = logout_user 413 339 if self.logout_path and environ.get('PATH_INFO') == self.logout_path: 414 340 logout_user() 341 415 342 def cookie_setting_start_response(status, headers, exc_info=None): 416 343 headers.extend(set_cookies) … … 434 361 #~ 'we got here. This means the base class has changed ' 435 362 #~ 'since this class was written. %r %r'%self.secure, ) 436 ticket = self.ticket_class( 437 self.secret, 438 userid, 439 remote_addr, 440 tokens=tokens, 441 user_data=user_data, 442 cookie_name=self.cookie_name, 443 cookie_params = self.cookie_params 444 ) 363 ticket = self.ticket_class(self.secret, userid, remote_addr, 364 tokens=tokens, user_data=user_data, 365 cookie_name=self.cookie_name, 366 cookie_params=self.cookie_params) 367 445 368 # @@: Should we set REMOTE_USER etc in the current 446 369 # environment right now as well? … … 454 377 path = '/' 455 378 if not domain: 456 cookies = [ 457 ( 458 'Set-Cookie', '%s=""; Path=%s' % ( 459 self.cookie_name, 460 path 461 ) 462 ), 463 ] 464 else: 465 cookies = [ 466 ( 467 'Set-Cookie', 468 '%s=""; Path=%s; Domain=%s' % ( 469 self.cookie_name, 470 path, 471 domain 472 ) 473 ), 474 ] 379 cookies = [('Set-Cookie', '%s=""; Path=%s' % (self.cookie_name, 380 path))] 381 else: 382 cookies = [('Set-Cookie', '%s=""; Path=%s; Domain=%s' % 383 (self.cookie_name, path, domain))] 475 384 return cookies 476 385 477 def make_cookie_handler( 478 app, 479 auth_conf, 480 app_conf=None, 481 global_conf=None, 482 prefix='authkit.cookie.', 483 ): 386 def make_cookie_handler(app, auth_conf, app_conf=None, global_conf=None, 387 prefix='authkit.cookie.'): 484 388 param_conf = strip_base(auth_conf, 'params.') 485 389 cookie_args = {} … … 491 395 'No cookie secret specified under %r'%(prefix+'secret') 492 396 ) 493 app = AuthKitCookieMiddleware( 494 app, 495 params=param_conf, 496 ticket_class=AuthKitTicket, 497 **cookie_args 498 ) 397 app = AuthKitCookieMiddleware(app, params=param_conf, 398 ticket_class=AuthKitTicket, cookie_args) 499 399 return app 500
