1

# encoding: utf-8

     2

     3

import datetime

     4

import urlparse

     5

import werkzeug

     6

import werkzeug.urls

     7

     8

import pvl.login.auth

     9

import pvl.web

    10

import pvl.web.response

    11

    12

from pvl.login import pubtkt

    13

from pvl.web import urls

    14

from pvl.web import html5 as html

    15

    16

import logging; log = logging.getLogger('pvl.login.server')

    17

    18

class Handler (pvl.web.Handler) :

    19

    # Bootstrap

    20

    DOCTYPE = 'html'

    21

    HTML_XMLNS = None

    22

    HTML_LANG = 'en'

    23

    CSS = (

    24

            '//netdna.bootstrapcdn.com/bootstrap/3.0.3/css/bootstrap.min.css',

    25

    )

    26

    JS = (

    27

            '//code.jquery.com/jquery.js',

    28

            '//netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js',

    29

    )

    30

    31

    STYLE = """

    32

body {

    33

    padding-top: 2em;

    34

    text-align: center;

    35

}

    36

    37

.container {

    38

    padding: 2em 1em;

    39

    text-align: left;

    40

}

    41

    """

    42

    43

    def redirect (self, *url, **params) :

    44

        return pvl.web.response.redirect(self.url(*url, **params))

    45

    46

    pubtkt = None

    47

    invalid_pubtkt = None

    48

    valid_pubtkt = None

    49

    50

    def init (self) :

    51

        self.alerts = []

    52

    53

    def alert (self, type, alert, icon=None) :

    54

        log.info(u"%s: %s", type, alert)

    55

    56

        self.alerts.append((type, icon, unicode(alert)))

    57

    58

    def process_cookie (self) :

    59

        """

    60

            Reverse the urlencoding used for the cookie...

    61

        """

    62

    63

        log.debug("cookies: %s", self.request.cookies)

    64

    65

        cookie = self.request.cookies.get(self.app.cookie_name)

    66

    67

        if not cookie :

    68

            return

    69

    70

        log.debug("cookie %s=%s", self.app.cookie_name, cookie)

    71

    72

        cookie = werkzeug.urls.url_unquote(cookie)

    73

    74

        log.debug("cookie decoded: %s", cookie)

    75

    76

        if not cookie :

    77

            return

    78

    79

        try :

    80

            self.pubtkt = self.app.load(cookie)

    81

    82

        except pubtkt.ParseError as ex :

    83

            self.alert('danger', ex, icon='compare')

    84

    85

        except pubtkt.VerifyError as ex :

    86

            self.alert('danger', ex, icon='warning-sign')

    87

    88

            self.invalid_pubtkt = ex.pubtkt

    89

    90

        except pubtkt.ExpiredError as ex :

    91

            self.alert('warning', ex, icon='clock')

    92

    93

            # store it anyways, but not as valid

    94

            self.pubtkt = ex.pubtkt

    95

    96

        else :

    97

            # it's a parsed, verified and valid pubtkt

    98

            self.valid_pubtkt = self.pubtkt

    99

   100

        return self.pubtkt

   101

   102

    def process_back (self) :

   103

        self.server = None

   104

        self.back = urlparse.urlunparse((self.app.login_scheme, self.app.login_server, '/', '', '', ''))

   105

   106

        back = self.request.args.get('back')

   107

   108

        if back :

   109

            url = urlparse.urlparse(back, self.app.login_scheme)

   110

   111

            if not self.app.login_scheme :

   112

                scheme = url.scheme

   113

   114

            elif url.scheme == self.app.login_scheme :

   115

                scheme = url.scheme

   116

   117

            else :

   118

                self.alert('info', "Using SSL for application URL", icon='lock')

   119

                scheme = self.app.login_scheme

   120

   121

            if url.hostname :

   122

                self.server = self.app.check_server(url.hostname)

   123

            else :

   124

                self.server = self.app.login_server

   125

   126

            self.back = urlparse.urlunparse((scheme, self.server, url.path, url.params, url.query, url.fragment))

   127

   128

    def render_alerts (self) :

   129

        for type, icon, alert in self.alerts :

   130

            yield html.div(class_='alert alert-{type}'.format(type=type))(

   131

                    html.span(class_='glyphicon glyphicon-{glyphicon}'.format(glyphicon=icon)) if icon else None,

   132

                    alert

   133

            )

   134

   135

   136

   137

class Index (Handler) :

   138

    TITLE = u"Päivölä Network Login"

   139

   140

    STYLE = Handler.STYLE + """

   141

.pubtkt {

   142

    width: 30em;

   143

    margin: 1em auto;

   144

}

   145

   146

.pubtkt form {

   147

    display: inline;

   148

}

   149

   150

.pubtkt .panel-heading {

   151

    line-height: 20px;

   152

}

   153

   154

.pubtkt .panel-body .glyphicon {

   155

    width: 1em;

   156

    float: left;

   157

    line-height: 20px;

   158

}

   159

   160

.pubtkt .panel-body .progress {

   161

    margin-bottom: 0;

   162

    margin-left: 2em;

   163

}

   164

    """

   165

   166

    JS = Handler.JS + (

   167

        '/static/pubtkt-expire.js',

   168

    )

   169

   170

    def process (self) :

   171

        self.process_cookie()

   172

   173

        if not self.pubtkt :

   174

            return self.redirect(Login)

   175

   176

    def render_valid (self, valid) :

   177

        seconds = valid.seconds + valid.days * (24 * 60 * 60)

   178

   179

        minutes, seconds = divmod(seconds, 60)

   180

        hours, minutes = divmod(minutes, 60)

   181

   182

        return "%2d:%02d:%02d" % (hours, minutes, seconds)

   183

   184

    def render_status (self, pubtkt) :

   185

        valid = pubtkt.valid()

   186

        grace = pubtkt.grace()

   187

   188

        if grace :

   189

            return 'warning'

   190

        elif valid :

   191

            return 'success'

   192

        else :

   193

            return 'danger'

   194

   195

    def render_pubtkt_valid (self, pubtkt) :

   196

        """

   197

            Yield HTML for ticket validity.

   198

        """

   199

   200

   201

        lifetime = self.app.login_valid

   202

        valid = pubtkt.valid()

   203

        grace = pubtkt.grace()

   204

        grace_period = pubtkt.grace_period()

   205

        remaining = pubtkt.remaining()

   206

   207

        if valid :

   208

            progress = float(valid.seconds) / float(lifetime.seconds)

   209

        else :

   210

            progress = None

   211

   212

        if grace :

   213

            title = "Remaining renewal period"

   214

            label = "{grace} (Renew)".format(grace=self.render_valid(grace))

   215

            status = 'warning'

   216

        elif valid :

   217

            title = "Remaining validity period"

   218

            label = "{valid}".format(valid=self.render_valid(valid))

   219

            status = 'success'

   220

        else :

   221

            title = "Expired"

   222

            label = "Expired"

   223

            status = 'danger'

   224

   225

        if progress :

   226

            return html.div(class_='panel-body', title=title)(

   227

                html.span(class_='glyphicon glyphicon-time'),

   228

                html.div(class_='progress pubtkt-progress',

   229

                    data_start=valid.seconds,

   230

                    data_refresh=grace_period.seconds if remaining else None,

   231

                    data_end=lifetime.seconds,

   232

                )(

   233

                    html.div(class_='progress-bar progress-bar-{status}'.format(status=status),

   234

                        role='progressbar',

   235

                        style='width: {pp:.0f}%'.format(pp=progress*100),

   236

                    )(

   237

                        html.span(class_='pubtkt-progress-label')(label)

   238

                    )

   239

                )

   240

            )

   241

        else :

   242

            return None # html.p(label)

   243

   244

    def render_pubtkt_fields (self, pubtkt) :

   245

        """

   246

            Yield (glyphicon, text) to render as fields for ticket.

   247

        """

   248

   249

        if pubtkt.cip :

   250

            yield 'cloud', None, "Network address", pubtkt.cip

   251

   252

        if pubtkt.udata :

   253

            yield 'comment', None, "User data", pubtkt.udata

   254

   255

        for token in pubtkt.tokens :

   256

            yield 'flag', None, "Access token", token

   257

   258

        if pubtkt.bauth :

   259

            yield 'keys', None, "Authentication token", pubtkt.bauth

   260

   261

    def render_pubtkt (self, pubtkt) :

   262

        status = self.render_status(pubtkt)

   263

        domain = self.app.login_domain

   264

   265

        return html.div(class_='pubtkt panel panel-{status}'.format(status=status))(

   266

            html.div(class_='panel-heading')(

   267

                html.span(class_='glyphicon glyphicon-user'),

   268

                html.strong(pubtkt.uid),

   269

                html.span("@", domain),

   270

            ),

   271

            self.render_pubtkt_valid(pubtkt),

   272

            html.ul(class_='list-group')(

   273

                html.li(class_='list-group-item {status}'.format(status=('alert-'+status if status else '')), title=title)(

   274

                    html.span(class_='glyphicon glyphicon-{glyphicon}'.format(glyphicon=icon)) if icon else None,

   275

                    data,

   276

                ) for icon, status, title, data in self.render_pubtkt_fields(pubtkt)

   277

            ),

   278

            html.div(class_='panel-footer')(

   279

                #html.div(class_='btn-toolbar', role='toolbar')(

   280

                    (

   281

                        html.form(action=self.url(Login), method='post', class_='form-inline')(

   282

                            html.button(type='submit', class_='btn btn-success')(

   283

                                html.span(class_='glyphicon glyphicon-time'), "Renew"

   284

                            )

   285

                        )

   286

                    ) if pubtkt.valid() else (

   287

                        html.form(action=self.url(Login), method='get', class_='form-inline')(

   288

                            html.button(type='submit', class_='btn btn-info')(

   289

                                html.span(class_='glyphicon glyphicon-log-in'), "Login"

   290

                            )

   291

                        ),

   292

                    ),

   293

   294

                    html.form(action=self.url(Logout), method='post', class_='form-inline pull-right')(

   295

                        html.button(type='submit', class_='btn btn-warning')(

   296

                            html.span(class_='glyphicon glyphicon-log-out'), "Logout"

   297

                        )

   298

                    ),

   299

                #),

   300

            ),

   301

        )

   302

   303

    def render (self) :

   304

        return html.div(class_='container')(

   305

                self.render_alerts(),

   306

                self.render_pubtkt(self.pubtkt) if self.pubtkt else None,

   307

        )

   308

   309

class Login (Handler) :

   310

    TITLE = "Login"

   311

   312

    STYLE = Handler.STYLE + """

   313

form#login {

   314

    max-width:  50%;

   315

    padding:    1em;

   316

    margin:     0 auto;

   317

}

   318

   319

    """

   320

   321

    login_failure = None

   322

   323

    def process (self) :

   324

        self.process_cookie()

   325

   326

        try :

   327

            self.process_back()

   328

        except pubtkt.Error as ex :

   329

            self.alert('danger', ex)

   330

   331

        if self.pubtkt :

   332

            self.username = self.pubtkt.uid

   333

        else :

   334

            self.username = None

   335

   336

        # update cookie?

   337

        set_pubtkt = None

   338

   339

        if self.request.method == 'POST' :

   340

            username = self.request.form.get('username')

   341

            password = self.request.form.get('password')

   342

   343

            if username :

   344

                # preprocess

   345

                username = username.strip().lower()

   346

   347

            if username and password :

   348

                self.username = username

   349

   350

                try :

   351

                    set_pubtkt = self.app.auth(username, password)

   352

   353

                except pvl.login.auth.AuthError as ex :

   354

                    self.alert('danger', "Internal authentication error, try again later?")

   355

   356

                else :

   357

                    if not set_pubtkt :

   358

                        self.alert('danger', "Invalid authentication credentials, try again.")

   359

   360

            elif self.pubtkt and self.pubtkt.valid() :

   361

                # renew manually if valid

   362

                set_pubtkt = self.app.renew(self.pubtkt)

   363

   364

            # a POST request that does not modify state is a failure

   365

            if not set_pubtkt :

   366

                self.login_failure = True

   367

   368

        elif 'renew' in self.request.args :

   369

            # renew automatically if in grace period

   370

            if self.pubtkt and self.pubtkt.grace() :

   371

                set_pubtkt = self.app.renew(self.pubtkt)

   372

   373

        if set_pubtkt :

   374

            signed = self.app.sign(set_pubtkt)

   375

   376

            self.pubtkt = set_pubtkt

   377

   378

            # browsers and mod_pubtkt seem to be very particular about quoting ;'s in cookie values...

   379

            # this follows PHP's setcookie() encoding, without any quoting of the value..

   380

            cookie = '{cookie}={value}; Domain={domain}; Secure; HttpOnly'.format(

   381

                    cookie  = self.app.cookie_name,

   382

                    value   = werkzeug.urls.url_quote(signed),

   383

                    domain  = self.app.cookie_domain,

   384

            )

   385

   386

            # redirect with cookie

   387

            response = pvl.web.response.redirect(self.back)

   388

            response.headers.add('Set-Cookie', cookie)

   389

   390

            return response

   391

   392

    def status (self) :

   393

        if self.login_failure :

   394

            return 400

   395

        else :

   396

            return 200

   397

   398

    def render (self) :

   399

        domain = self.app.login_domain

   400

   401

        if 'logout' in self.request.args :

   402

            self.alert('info', "You have been logged out.", icon='log-out')

   403

   404

        if self.pubtkt and self.pubtkt.valid() :

   405

            renew = True

   406

   407

            # within validity period...

   408

            self.alert('info', "Login or renew ticket.", icon='log-in')

   409

   410

        else :

   411

            renew = False

   412

   413

        return html.div(class_='container')(

   414

            html.form(action=self.url(back=self.back), method='POST', id='login')(

   415

                self.render_alerts(),

   416

   417

                html.fieldset(

   418

                    html.legend(

   419

                        (

   420

                            "Login @ ",

   421

                            html.a(href=self.back)(self.server),

   422

                        ) if self.server else (

   423

                            "Login"

   424

                        )

   425

                   ),

   426

   427

                    html.div(class_='form-group')(

   428

                        html.div(class_='input-group')(

   429

                            html.label(for_='username', class_='sr-only')("Username"),

   430

                            html.input(name='username', type='text', class_='form-control', placeholder="username", required=True, autofocus=(not self.username), value=self.username),

   431

                            html.span(class_='input-group-addon')("@{domain}".format(domain=domain)),

   432

                        ),

   433

   434

                        html.label(for_='password', class_='sr-only')("Password"),

   435

                        html.input(name='password', type='password', class_='form-control', placeholder="Password", required=(not renew), autofocus=bool(self.username)),

   436

                    ),

   437

   438

                    html.button(type='submit', class_='btn btn-primary')(

   439

                        html.span(class_='glyphicon glyphicon-log-in'), "Login"

   440

                    ),

   441

   442

                    html.button(type='submit', class_='btn btn-success')(

   443

                        html.span(class_='glyphicon glyphicon-time'), "Renew"

   444

                    ) if renew else None,

   445

                )

   446

            )

   447

        )

   448

   449

class Logout (Handler) :

   450

    TITLE = "Logout"

   451

   452

    def process (self) :

   453

        self.process_cookie()

   454

   455

        if not self.pubtkt :

   456

            return self.redirect(Login)

   457

   458

        if self.request.method == 'POST' :

   459

            response = pvl.web.response.redirect(self.url(Login, logout=1))

   460

   461

            response.set_cookie(self.app.cookie_name, '',

   462

                    expires = 0,

   463

                    domain      = self.app.cookie_domain,

   464

                    secure      = self.app.cookie_secure,

   465

                    httponly    = self.app.cookie_httponly,

   466

            )

   467

   468

            return response

   469

   470

    def render (self) :

   471

        return html.div(class_='container')(

   472

            html.form(action=self.url(), method='post')(

   473

                self.render_alerts(),

   474

   475

                html.fieldset(

   476

                    html.legend("Logout {pubtkt.uid}".format(pubtkt=self.pubtkt)),

   477

   478

                    html.button(type='submit', class_='btn btn-warning')(

   479

                        html.span(class_='glyphicon glyphicon-log-out'), "Logout"

   480

                    ),

   481

                )

   482

            )

   483

        )

   484

   485

class SSL (Handler) :

   486

    TITLE = "SSL"

   487

   488

    OUT = 'tmp/spkac'

   489

   490

    def render_cert (self) :

   491

        return html.div(class_='container')(