Ticket #210: MapFishAuthentication_v2.patch

server/python/mapfish/controllers/auth_proxy.py

@@ +1 @@
+from pylons import request, response
+from pylons.controllers import WSGIController
+
+from authkit.authorize.pylons_adaptors import authorized
+from authkit.authorize import NotAuthorizedError
+import re
+import cgi
+import urlparse
+import urllib2
+from urllib import urlencode
+
+def add_routes(map, url, controller):
+    """Add the pylons routes for a proxy
+    """
+    map.connect(url + "*more", controller=controller, action='get',
+                conditions=dict(method=['GET']))
+
+class Layer(object):
+    def __init__(self, alias, url, layers, **kwargs):
+        self.alias = alias
+        self.url = url
+        self.layers = layers
+        self.options = kwargs
+
+    def get_permissions(self):
+        return {
+            "url": self.url,
+            "layers": dict(((name, authorized(perm)) for (name, perm) in
+                            self.layers.iteritems()))
+        }
+
+    def check_permissions(self):
+        # Check layers
+        layers = self.get_requested_layers()
+        for layer in layers:
+            if self.layers.has_key(layer):
+                perm = self.layers[layer]
+            elif self.layers.has_key("DEFAULT"):
+                perm = self.layers["DEFAULT"]
+            else:
+                continue
+            if not authorized(perm):
+                return False, "Not allowed to access layer: %s" % cgi.escape(layer)
+
+        # TODO Check bbox
+
+        return True, "Access allowed"
+
+    def get_requested_layers(self):
+        raise NotImplementedError()
+
+    def get_requested_bbox(self):
+        raise NotImplementedError()
+
+class WMSLayer(Layer):
+    def get_param(self, name):
+        """Returns the request parameter given in argument, ignoring case.
+           If not found, None is returned.
+        """
+        for k in request.params.keys():
+            if k.lower() == name:
+                return request.params[k]
+        return None
+
+    def get_requested_layers(self):
+        layers = self.get_param("layers")
+        if not layers:
+            return []
+        return layers.split(",")
+
+class TileCacheLayer(Layer):
+    def get_requested_layers(self):
+        raise NotImplementedError("TODO TileCacheLayer::get_requested_layers")
+
+
+class AuthProxyController(WSGIController):
+    def __init__(self):
+        self.layers = []
+        self.alias_to_layer = {}
+
+    def set_layers(self, layers):
+        self.alias_to_layers = dict(((layer.alias, layer) for layer in layers))
+        self.layers = layers
+
+    def _get_permissions(self):
+        return {
+            "layer": [l.get_permissions() for l in self.layers]
+        }
+
+    def get(self, more):
+        """Proxy action
+        """
+        # extract the first segment of the url
+        m = re.match("/?([^/]+)(/?.*)$", more)
+        if not m:
+            response.status_code = 500
+            return "Invalid URL, missing alias in the path"
+        alias, more = m.groups()
+        
+        if not self.alias_to_layers.has_key(alias):
+            response.status_code = 500
+            return "Wrong alias %s" % cgi.escape(alias)
+        layer = self.alias_to_layers[alias]
+
+        allowed, msg = layer.check_permissions()
+        if not allowed:
+            # We don't use 403 to avoid triggering AuthKit login dialog
+            response.status_code = 406
+            return msg
+
+        url = layer.url + more
+        return self._proxy(url)
+
+    def _proxy(self, url):
+        """Do the actual action of proxying the call.
+        """
+        query = urlencode(request.params)
+        full_url = url
+        if query:
+            if not full_url.endswith("?"):
+                full_url += "?"
+            full_url += query
+
+        # build the request with its headers
+        print "full_url", full_url
+        req = urllib2.Request(url=full_url)
+        for header in request.headers:
+            if header.lower() == "host":
+                req.add_header(header, urlparse.urlparse(url)[1])
+            else:
+                req.add_header(header, request.headers[header])
+        res = urllib2.urlopen(req)
+
+        # add response headers
+        i = res.info()
+        response.status_code = res.code
+        got_content_length = False
+        for header in i:
+            response.headers[header] =i[header]
+            if header.lower() == "content-length":
+                got_content_length = True
+
+        # return the result
+        result = res.read()
+        res.close()
+
+        if not got_content_length:
+            response.headers['content-length'] = str(len(result))
+        return result
+

server/python/mapfish/controllers/security.py

@@ +1 @@
+import logging
+
+from pylons.controllers import WSGIController
+from pylons.decorators import jsonify
+from pylons import config
+from authkit.authorize.pylons_adaptors import authorize, authorized
+from authkit.permissions import ValidAuthKitUser
+from authkit.authorize import NotAuthorizedError
+import simplejson
+
+import sys
+import os
+import os.path
+import inspect
+
+
+log = logging.getLogger(__name__)
+
+class SecurityController(WSGIController):
+    def _get_master_permissions(self):
+        """Read the permissions in the config/permissions.json file and return
+           an object
+        """
+        perm_json = os.path.join(config.here, config['pylons.package'],
+                                 "config", "permissions.json")
+
+        permissions = {}
+        modulename = "%s.config.permissions" % config['pylons.package']
+        try:
+            mod = __import__(modulename)
+            for comp in modulename.split(".")[1:]:
+                mod = getattr(mod, comp)
+            permissions = mod.permissions
+        except ImportError:
+            log.debug("Couldn't find permission configuration module %s" % modulename)
+
+        # compute permissions
+        # TODO: calling authorized should be propagated inside nested dicts.
+        permissions = dict(((key, authorized(perm)) for (key, perm) in
+                            permissions.iteritems()))
+
+        return permissions
+
+    @jsonify
+    def permissions(self):
+        controllers_module_name = config['pylons.package'] + '.controllers'
+        __import__(controllers_module_name)
+        module = sys.modules[controllers_module_name]
+
+        permissions = self._get_master_permissions()
+        module_names = []
+
+        # Iterate through all the controllers to call the method "get_permissions"
+        # at the module level if available.
+        # The value returned is merged into the permission object.
+
+        if hasattr(module, '__path__'):
+            for file in os.listdir(module.__path__[0]):
+                if not file.endswith(".py"):
+                    continue
+                path = os.path.join(module.__path__[0], file)
+                module_name = inspect.getmodulename(file)
+                if not module_name or module_name == '__init__':
+                    continue
+
+                method_name = "get_permissions"
+                full_module_name = controllers_module_name + '.' + module_name
+                try:
+                    __import__(full_module_name)
+                except Exception, e:
+                    log.warn("Failure while fetching controller in module %s (%s: %s)",
+                             full_module_name, e.__class__, e)
+                    continue
+                mod = sys.modules[full_module_name]
+                if not hasattr(mod, method_name):
+                    continue
+                get_permissions_method = getattr(mod, method_name)
+
+                perms = get_permissions_method()
+                if not isinstance(perms, dict):
+                    raise Exception("Invalid permission type, should be dict, was %s" % type(perms))
+
+                # TODO: should use a recursive udpate
+                permissions.update(perms)
+
+        return {"permissions": permissions}
+
+    # XXX for debug
+    @authorize(ValidAuthKitUser())
+    def log_me_in(self):
+        return "This page requires login <br/><a href='/logout'>logout</a>"
+
+    # XXX for debug
+    # XXX could be used by client to retrieve user/roles.
+    @jsonify
+    def user_roles(self):
+        user = request.environ.get("REMOTE_USER", "anonymous")
+        users = request.environ['authkit.users']
+        roles = []
+        for role in users.list_roles():
+            if users.user_has_role(user, role):
+                roles.append(role)
+        return {"user": user, "roles": roles}
+
+class Deny:
+    """A special AuthKit permission that always deny access
+    """
+    def check(self, app, environ, start_response):
+        raise NotAuthorizedError("Not authorized at all")

server/python/mapfish/lib/user_auth.py

@@ +1 @@
+from authkit.users.sqlalchemy_driver import UsersFromDatabase
+from time import time
+
+class CachedUsersFromDatabase(UsersFromDatabase):
+    """
+    Caching proxy for AuthKit's class.
+
+    It's not 100% thread safe, but who cares if the request is done twice for
+    nothing?
+    """
+
+    #number of seconds between two purge of the caches
+    REFRESH_PERIOD = 60
+
+    def __init__(self, model, encrypt=None):
+        UsersFromDatabase.__init__(self, model, encrypt)
+        self.nextRefresh = 0
+        self.checkCache()
+        
+    def user_delete(self, username):
+        self.users.pop(username)
+        self.fullUsers.pop(username)
+        return UsersFromDatabase.user_delete(self, username)
+
+    def user_exists(self, username):
+        self.checkCache()
+        if self.users.has_key(username):
+            return self.users.get(username)
+        else:
+            result = UsersFromDatabase.user_exists(self, username)
+            self.users[username] = result
+            return result
+
+    def role_delete(self, rolename):
+        self.roles.pop(rolename)
+        return UsersFromDatabase.role_delete(self, rolename)
+
+    def role_exists(self, rolename):
+        self.checkCache()
+        if self.roles.has_key(rolename):
+            return self.roles.get(rolename)
+        else:
+            result = UsersFromDatabase.role_exists(self, rolename)
+            self.roles[rolename] = result
+            return result
+
+    def group_delete(self, groupname):
+        self.groups.pop(groupname)
+        return UsersFromDatabase.group_delete(self, groupname)
+
+    def group_exists(self, groupname):
+        self.checkCache()
+        if self.groups.has_key(groupname):
+            return self.groups.get(groupname)
+        else:
+            result = UsersFromDatabase.group_exists(self, groupname)
+            self.groups[groupname] = result
+            return result
+
+    def user(self, username):
+        self.checkCache()
+        if self.fullUsers.has_key(username):
+            return self.fullUsers.get(username)
+        else:
+            result = UsersFromDatabase.user(self, username)
+            self.fullUsers[username] = result
+            return result
+
+    def user_roles(self, username):
+        return self.user(username)['roles']
+
+    def user_group(self, username):
+        return self.user(username)['group']
+
+    def user_password(self, username):
+        return self.user(username)['password']
+
+    def user_has_role(self, username, role):
+        return self.user_roles(username).count(role)>0
+
+    def user_has_group(self, username, group):
+        return self.user_group(username)==group
+
+    def user_has_password(self, username, password):
+        return self.user(username)['password']==self.encrypt(password)
+
+    def user_set_username(self, username, new_username):
+        self.fullUsers.pop(username)
+        UsersFromDatabase.user_set_username(self, username, new_username)
+
+    def user_set_group(self, username, group, auto_add_group=False):
+        self.fullUsers.pop(username)
+        self.groups.pop(group)
+        UsersFromDatabase.user_set_group(self, username, group, auto_add_group)
+
+    def user_add_role(self, username, role, auto_add_role=False):
+        self.fullUsers.pop(username)
+        self.roles.pop(role)
+        UsersFromDatabase.user_add_role(self, username, role, auto_add_role)
+
+    def user_remove_group(self, username):
+        self.fullUsers.pop(username)
+        UsersFromDatabase.user_remove_group(self, username, group)
+
+    def user_remove_role(self, username, role):
+        self.fullUsers.pop(username)
+        UsersFromDatabase.user_remove_role(self, username, role)
+
+    def checkCache(self):
+        if self.nextRefresh <= time():
+            self.nextRefresh = time() + self.REFRESH_PERIOD
+            self.users = {}
+            self.roles = {}
+            self.groups = {}
+            self.fullUsers = {}