1

# encoding: utf-8

     2

     3

import datetime

     4

import urlparse

     5

import werkzeug

     6

import werkzeug.urls

     7

     8

import pvl.web

     9

import pvl.web.response

    10

    11

from pvl.login import pubtkt

    14

    15

import logging; log = logging.getLogger('pvl.login.server')

    16

    17

class Handler (pvl.web.Handler) :

    18

    # Bootstrap

    19

    DOCTYPE = 'html'

    20

    HTML_XMLNS = None

    21

    HTML_LANG = 'en'

    22

    CSS = (

    23

            '//netdna.bootstrapcdn.com/bootstrap/3.0.3/css/bootstrap.min.css',

    24

    )

    25

    JS = (

    26

            '//code.jquery.com/jquery.js',

    27

            '//netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js',

    28

    )

    29

    30

    STYLE = """

    31

body {

    32

    padding-top: 2em;

    33

    text-align: center;

    34

}

    35

    36

.container {

    37

    padding: 2em 1em;

    38

    text-align: left;

    39

}

    40

    """

    41

    42

    def redirect (self, *url, **params) :

    43

        return pvl.web.response.redirect(self.url(*url, **params))

    44

    45

    pubtkt = None

    46

    47

    def init (self) :

    48

        self.alerts = []

    49

    51

        log.info(u"%s: %s", type, alert)

    52

    54

    55

    def process_cookie (self) :

    56

        """

    57

            Reverse the urlencoding used for the cookie...

    58

        """

    59

    60

        log.debug("cookies: %s", self.request.cookies)

    61

    62

        cookie = self.request.cookies.get(self.app.cookie_name)

    63

    64

        if not cookie :

    65

            return

    66

    67

        log.debug("cookie %s=%s", self.app.cookie_name, cookie)

    68

    69

        cookie = werkzeug.urls.url_unquote(cookie)

    70

    71

        log.debug("cookie decoded: %s", cookie)

    72

    73

        if not cookie :

    74

            return

    75

    76

        try :

    77

            self.pubtkt = self.app.load(cookie)

    78

    79

        except pubtkt.ParseError as ex :

    81

    82

        except pubtkt.ExpiredError as ex :

    83

            self.pubtkt = ex.pubtkt

    85

    86

        except pubtkt.VerifyError as ex :

    87

            self.pubtkt = ex.pubtkt

    89

    90

    def process_back (self) :

    91

        self.server = None

    92

        self.back = urlparse.urlunparse((self.app.login_scheme, self.app.login_server, '/', '', '', ''))

    93

    94

        back = self.request.args.get('back')

    95

    96

        if back :

    97

            url = urlparse.urlparse(back, self.app.login_scheme)

    98

    99

            if not self.app.login_scheme :

   100

                scheme = url.scheme

   101

   102

            elif url.scheme == self.app.login_scheme :

   103

                scheme = url.scheme

   104

   105

            else :

   107

                scheme = self.app.login_scheme

   108

   109

            self.server = self.app.check_server(url.hostname)

   110

            self.back = urlparse.urlunparse((scheme, self.server, url.path, url.params, url.query, url.fragment))

   111

   121

class Index (Handler) :

   122

    TITLE = u"Päivölä Network Login"

   123

   124

    STYLE = Handler.STYLE + """

   125

.pubtkt {

   126

    width: 30em;

   127

    margin: 1em auto;

   128

}

   129

   130

.pubtkt form {

   131

    display: inline;

   132

}

   133

    """

   134

   135

    def process (self) :

   136

        self.process_cookie()

   137

   138

        if not self.pubtkt :

   139

            return self.redirect(Login)

   140

   141

    def render_valid (self, valid) :

   142

        seconds = valid.seconds + valid.days * (24 * 60 * 60)

   143

   144

        minutes, seconds = divmod(seconds, 60)

   145

        hours, minutes = divmod(minutes, 60)

   146

   147

        return "%2d:%02d:%02d" % (hours, minutes, seconds)

   148

   149

    def render_status (self, pubtkt) :

   150

        valid = pubtkt.valid()

   151

        grace = pubtkt.grace()

   152

   153

        if grace :

   154

            return 'warning'

   155

        elif valid :

   156

            return 'success'

   157

        else :

   158

            return 'danger'

   159

   160

    def render_pubtkt_fields (self, pubtkt) :

   161

        """

   162

            Yield (glyphicon, text) to render as fields for ticket.

   163

        """

   164

   165

        yield 'user', None, "User account", pubtkt.uid

   166

   167

        valid = pubtkt.valid()

   168

        grace = pubtkt.grace()

   169

   170

        if grace :

   171

            valid = "{grace} (Renew)".format(grace=self.render_valid(grace))

   172

            valid_status = 'warning'

   173

        elif valid :

   174

            valid = "{valid}".format(valid=self.render_valid(valid))

   175

            valid_status = 'success'

   176

        else :

   177

            valid = "Expired"

   178

            valid_status = 'danger'

   179

   180

        yield 'time', valid_status, "Remaining validity", valid

   181

   182

        if pubtkt.cip :

   183

            yield 'cloud', None, "Network address", pubtkt.cip

   184

   185

        if pubtkt.udata :

   186

            yield 'comment', None, "Associated data", pubtkt.udata

   187

   188

        for token in pubtkt.tokens :

   189

            yield 'flag', None, "Access token", token

   190

   191

        if pubtkt.bauth :

   192

            yield 'keys', None, "Authentication token", pubtkt.bauth

   193

   194

    def render_pubtkt (self, pubtkt) :

   195

        status = self.render_status(pubtkt)

   196

   197

        return html.div(class_='pubtkt panel panel-{status}'.format(status=status))(

   198

            html.div(class_='panel-heading')("Login: {pubtkt.uid}".format(pubtkt=self.pubtkt)),

   199

            html.ul(class_='list-group')(

   200

                html.li(class_='list-group-item {status}'.format(status=('alert-'+status if status else '')), title=title)(

   201

                    html.span(class_='glyphicon glyphicon-{glyphicon}'.format(glyphicon=icon)) if icon else None,

   202

                    info,

   203

                ) for icon, status, title, info in self.render_pubtkt_fields(pubtkt)

   204

            ),

   205

            html.div(class_='panel-footer')(

   206

                #html.div(class_='btn-toolbar', role='toolbar')(

   207

                    (

   208

                        html.form(action=self.url(Login), method='post', class_='form-inline')(

   212

                        )

   213

                    ) if pubtkt.valid() else (

   214

                        html.form(action=self.url(Login), method='get', class_='form-inline')(

   218

                        ),

   219

                    ),

   220

   221

                    html.form(action=self.url(Logout), method='post', class_='form-inline pull-right')(

   225

                    ),

   226

                #),

   227

            ),

   228

        )

   229

   230

    def render (self) :

   231

        return html.div(class_='container')(

   234

        )

   235

   236

class Login (Handler) :

   237

    TITLE = "Login"

   238

   239

    STYLE = Handler.STYLE + """

   240

form#login {

   241

    max-width:  50%;

   242

    padding:    1em;

   243

    margin:     0 auto;

   244

}

   245

   246

    """

   247

    def process (self) :

   248

        self.process_cookie()

   249

   250

        try :

   251

            self.process_back()

   252

        except pubtkt.Error as ex :

   253

            self.alert('danger', ex)

   254

   255

        # update cookie?

   256

        set_pubtkt = None

   257

   258

        if self.request.method == 'POST' :

   259

            username = self.request.form.get('username')

   260

            password = self.request.form.get('username')

   261

   262

            if username and password :

   263

                # preprocess

   264

                username = username.strip().lower()

   265

   266

                try :

   267

                    set_pubtkt = self.app.auth(username, password)

   268

   269

                except pubtkt.Error as ex :

   270

                    self.auth_errors = ex

   271

   272

            elif self.pubtkt and self.pubtkt.valid() :

   273

                # renew manually if valid

   274

                set_pubtkt = self.app.renew(self.pubtkt)

   275

   276

        elif 'renew' in self.request.args :

   277

            # renew automatically if in grace period

   278

            if self.pubtkt and self.pubtkt.grace() :

   279

                set_pubtkt = self.app.renew(self.pubtkt)

   280

   281

        if set_pubtkt :

   282

            # browsers seem to be very particular about quoting ;'s in cookie values...

   283

            # this follows PHP's setcookie() encoding...

   284

            cookie = werkzeug.urls.url_quote(self.app.sign(set_pubtkt))

   285

   286

            self.pubtkt = set_pubtkt

   287

   288

            # redirect with cookie

   289

            response = pvl.web.response.redirect(self.back)

   290

   291

            response.set_cookie(self.app.cookie_name, cookie,

   292

                domain      = self.app.cookie_domain,

   293

                secure      = self.app.cookie_secure,

   294

                httponly    = self.app.cookie_httponly,

   295

            )

   296

   297

            return response

   298

   299

   300

    def render (self) :

   301

        if self.pubtkt :

   302

            username = self.pubtkt.uid

   303

        else :

   304

            username = None

   305

   306

        domain = self.app.login_domain

   307

   308

        if 'logout' in self.request.args :

   310

   311

        if self.pubtkt and self.pubtkt.valid() :

   312

            renew = True

   313

   314

            # within validity period...

   316

   317

        else :

   318

            renew = False

   319

   320

        return html.div(class_='container')(

   321

            html.form(action=self.url(back=self.back), method='POST', id='login')(

   323

   324

                html.fieldset(

   325

                    html.legend(

   326

                        (

   327

                            "Login @ ",

   328

                            html.a(href=self.back)(self.server),

   329

                        ) if self.server else (

   330

                            "Login"

   331

                        )

   332

                   ),

   333

   334

                    html.div(class_='form-group')(

   335

                        html.div(class_='input-group')(

   336

                            html.label(for_='username', class_='sr-only')("Username"),

   337

                            html.input(name='username', type='text', class_='form-control', placeholder="username", required=True, autofocus=True, value=username),

   338

                            html.span(class_='input-group-addon')("@{domain}".format(domain=domain)),

   339

                        ),

   340

   341

                        html.label(for_='password', class_='sr-only')("Password"),

   342

                        html.input(name='password', type='password', class_='form-control', placeholder="Password", required=(not renew)),

   343

                    ),

   344

   348

   352

                )

   353

            )

   354

        )

   355

   356

class Logout (Handler) :

   357

    TITLE = "Logout"

   358

   359

    def process (self) :

   360

        self.process_cookie()

   361

   362

        if not self.pubtkt :

   363

            return self.redirect(Login)

   364

   365

        if self.request.method == 'POST' :

   366

            response = pvl.web.response.redirect(self.url(Login, logout=1))

   367

   368

            response.set_cookie(self.app.cookie_name, '',

   369

                    expires = 0,

   370

                    domain      = self.app.cookie_domain,

   371

                    secure      = self.app.cookie_secure,

   372

                    httponly    = self.app.cookie_httponly,

   373

            )

   374

   375

            return response

   376

   377

    def render (self) :

   378

        return html.div(class_='container')(

   379

            html.form(action=self.url(), method='post')(

   380

                html.fieldset(

   381

                    html.legend("Logout {pubtkt.uid}".format(pubtkt=self.pubtkt)),

   382

   386

                )

   387

            )

   388

        )

   389

   390

class LoginApplication (pvl.web.Application) :

   391

    URLS = urls.Map((

   392

        urls.rule('/',              Index),

   393

        urls.rule('/login',         Login),

   394

        urls.rule('/logout',        Logout),

   395

    ))

   396

   397

    PUBLIC_KEY = 'etc/login/public.pem'

   398

    PRIVATE_KEY = 'etc/login/private.pem'

   399

   400

    login_domain = 'test.paivola.fi'

   401

    login_server = 'login.test.paivola.fi'

   402

    login_valid = datetime.timedelta(seconds=60)

   403

    login_grace = datetime.timedelta(seconds=30)

   404

    login_scheme = 'https'

   405

   406

    cookie_name = 'auth_pubtkt'

   407

    cookie_domain = 'test.paivola.fi'

   408

    cookie_secure = True

   409

    cookie_httponly = True

   410

   411

    def __init__ (self, public_key=PUBLIC_KEY, private_key=PRIVATE_KEY, **opts) :

   412

        super(LoginApplication, self).__init__(**opts)

   413

   414

        self.server_keys = pubtkt.ServerKeys.config(

   415

                public_key  = public_key,

   416

                private_key = private_key,

   417

        )

   418

   419

    def check_server (self, server) :

   420

        """

   421

            Check that the given target server is valid.

   422

        """

   423

   424

        server = server.lower()

   425

   426

        if server == self.login_domain or server.endswith('.' + self.login_domain) :

   427

            return server

   428

        else :

   429

            raise pubtkt.ServerError("Target server is not covered by our authentication domain: {domain}".format(domain=self.login_domain))

   430

   431

    def load (self, cookie) :

   432

        """

   433

            Load a pubtkt from a cookie, and verify it.

   434

        """

   435

   436

        return pubtkt.PubTkt.load(cookie, self.server_keys.public)

   437

   438

    def auth (self, username, password) :

   439

        """

   440

            Perform authentication, returning a PubTkt, signed

   441

        """

   442

   443

        return pubtkt.PubTkt.new(username,

   444

                valid   = self.login_valid,

   445

                grace   = self.login_grace,

   446

        )

   447

   448

    def sign (self, pubtkt) :

   449

        """

   450

            Create a cookie by signing the given pubtkt.

   451

        """

   452

   453

        return pubtkt.sign(self.server_keys.private)

   454

   455

    def renew (self, pubtkt) :

   456

        """

   457

            Renew and re-sign the given pubtkt.

   458

        """

   459

   460

        # XXX: inplace

   461

        pubtkt.renew(self.login_valid, self.login_grace)

   462

   463

        return pubtkt