1

# encoding: utf-8

     2

     3

import datetime

     4

import urlparse

     5

import werkzeug

     6

import werkzeug.urls

     7

     8

import pvl.web

     9

import pvl.web.response

    10

    11

from pvl.login import pubtkt

    12

from pvl.web import urls, html

    13

    14

import logging; log = logging.getLogger('pvl.login.server')

    15

    16

class Handler (pvl.web.Handler) :

    17

    # Bootstrap

    18

    DOCTYPE = 'html'

    19

    HTML_XMLNS = None

    20

    HTML_LANG = 'en'

    21

    CSS = (

    22

            '//netdna.bootstrapcdn.com/bootstrap/3.0.3/css/bootstrap.min.css',

    23

    )

    24

    JS = (

    25

            '//code.jquery.com/jquery.js',

    26

            '//netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js',

    27

    )

    28

    29

    STYLE = """

    30

body {

    31

    padding-top: 2em;

    32

    text-align: center;

    33

}

    34

    35

.container {

    36

    padding: 2em 1em;

    37

    text-align: left;

    38

}

    39

    """

    40

    41

    def redirect (self, *url, **params) :

    42

        return pvl.web.response.redirect(self.url(*url, **params))

    43

    44

    pubtkt = None

    45

    46

    def init (self) :

    47

        self.alerts = []

    48

    49

    def alert (self, type, alert) :

    50

        log.info(u"%s: %s", type, alert)

    51

    52

        self.alerts.append((type, unicode(alert)))

    53

    54

    def process_cookie (self) :

    55

        """

    56

            Reverse the urlencoding used for the cookie...

    57

        """

    58

    59

        log.debug("cookies: %s", self.request.cookies)

    60

    61

        cookie = self.request.cookies.get(self.app.cookie_name)

    62

    63

        if not cookie :

    64

            return

    65

    66

        log.debug("cookie %s=%s", self.app.cookie_name, cookie)

    67

    68

        cookie = werkzeug.urls.url_unquote(cookie)

    69

    70

        log.debug("cookie decoded: %s", cookie)

    71

    72

        if not cookie :

    73

            return

    74

    75

        try :

    76

            self.pubtkt = self.app.load(cookie)

    77

    78

        except pubtkt.ParseError as ex :

    79

            self.alert('danger', ex)

    80

    81

        except pubtkt.ExpiredError as ex :

    82

            self.pubtkt = ex.pubtkt

    83

            self.alert('warning', ex)

    84

    85

        except pubtkt.VerifyError as ex :

    86

            self.pubtkt = ex.pubtkt

    87

            self.alert('danger', ex)

    88

    89

    def process_back (self) :

    90

        self.server = None

    91

        self.back = urlparse.urlunparse((self.app.login_scheme, self.app.login_server, '/', '', '', ''))

    92

    93

        back = self.request.args.get('back')

    94

    95

        if back :

    96

            url = urlparse.urlparse(back, self.app.login_scheme)

    97

    98

            if not self.app.login_scheme :

    99

                scheme = url.scheme

   100

   101

            elif url.scheme == self.app.login_scheme :

   102

                scheme = url.scheme

   103

   104

            else :

   105

                self.alert('info', "Using SSL for application URL")

   106

                scheme = self.app.login_scheme

   107

   108

            self.server = self.app.check_server(url.hostname)

   109

            self.back = urlparse.urlunparse((scheme, self.server, url.path, url.params, url.query, url.fragment))

   110

   111

class Index (Handler) :

   112

    TITLE = u"Päivölä Network Login"

   113

   114

    STYLE = Handler.STYLE + """

   115

.pubtkt {

   116

    width: 30em;

   117

    margin: 1em auto;

   118

}

   119

   120

.pubtkt form {

   121

    display: inline;

   122

}

   123

    """

   124

   125

    def process (self) :

   126

        self.process_cookie()

   127

   128

        if not self.pubtkt :

   129

            return self.redirect(Login)

   130

   131

    def render_valid (self, valid) :

   132

        seconds = valid.seconds + valid.days * (24 * 60 * 60)

   133

   134

        minutes, seconds = divmod(seconds, 60)

   135

        hours, minutes = divmod(minutes, 60)

   136

   137

        return "%2d:%02d:%02d" % (hours, minutes, seconds)

   138

   139

    def render_status (self, pubtkt) :

   140

        valid = pubtkt.valid()

   141

        grace = pubtkt.grace()

   142

   144

            return 'warning'

   145

        elif valid :

   146

            return 'success'

   147

        else :

   148

            return 'danger'

   149

   150

    def render_pubtkt_fields (self, pubtkt) :

   151

        """

   152

            Yield (glyphicon, text) to render as fields for ticket.

   153

        """

   154

   155

        yield 'user', None, "User account", pubtkt.uid

   156

   157

        valid = pubtkt.valid()

   158

        grace = pubtkt.grace()

   159

   162

            valid_status = 'warning'

   163

        elif valid :

   164

            valid = "{valid}".format(valid=self.render_valid(valid))

   165

            valid_status = 'success'

   166

        else :

   167

            valid = "Expired"

   168

            valid_status = 'danger'

   169

   170

        yield 'time', valid_status, "Remaining validity", valid

   171

   172

        if pubtkt.cip :

   173

            yield 'cloud', None, "Network address", pubtkt.cip

   174

   175

        if pubtkt.udata :

   176

            yield 'comment', None, "Associated data", pubtkt.udata

   177

   178

        for token in pubtkt.tokens :

   179

            yield 'flag', None, "Access token", token

   180

   181

        if pubtkt.bauth :

   182

            yield 'keys', None, "Authentication token", pubtkt.bauth

   183

   184

    def render_pubtkt (self, pubtkt) :

   185

        status = self.render_status(pubtkt)

   186

   187

        return html.div(class_='pubtkt panel panel-{status}'.format(status=status))(

   188

            html.div(class_='panel-heading')("Login: {pubtkt.uid}".format(pubtkt=self.pubtkt)),

   189

            html.ul(class_='list-group')(

   190

                html.li(class_='list-group-item {status}'.format(status=('alert-'+status if status else '')), title=title)(

   191

                    html.span(class_='glyphicon glyphicon-{glyphicon}'.format(glyphicon=icon)) if icon else None,

   192

                    info,

   193

                ) for icon, status, title, info in self.render_pubtkt_fields(pubtkt)

   194

            ),

   195

            html.div(class_='panel-footer')(

   196

                #html.div(class_='btn-toolbar', role='toolbar')(

   197

                    (

   198

                        html.form(action=self.url(Login), method='post', class_='form-inline')(

   199

                            html.button(type='submit', class_='btn btn-success')("Renew"),

   200

                        )

   201

                    ) if pubtkt.valid() else (

   202

                        html.form(action=self.url(Login), method='get', class_='form-inline')(

   203

                            html.button(type='submit', class_='btn btn-info')("Login"),

   204

                        ),

   205

                    ),

   206

   207

                    html.form(action=self.url(Logout), method='post', class_='form-inline pull-right')(

   208

                        html.button(type='submit', class_='btn btn-warning')("Logout"),

   209

                    ),

   210

                #),

   211

            ),

   212

        )

   213

   214

    def render_info (self) :

   215

        for type, alert in self.alerts :

   216

            yield html.div(class_='alert alert-{type}'.format(type=type))(alert)

   217

   218

        if self.pubtkt :

   219

            yield self.render_pubtkt(self.pubtkt)

   220

   221

    def render (self) :

   222

   223

        return html.div(class_='container')(

   224

                self.render_info(),

   225

        )

   226

   227

class Login (Handler) :

   228

    TITLE = "Login"

   229

   230

    STYLE = Handler.STYLE + """

   231

form#login {

   232

    max-width:  50%;

   233

    padding:    1em;

   234

    margin:     0 auto;

   235

}

   236

   237

    """

   238

    def process (self) :

   239

        self.process_cookie()

   240

   241

        try :

   242

            self.process_back()

   243

        except pubtkt.Error as ex :

   244

            self.alert('danger', ex)

   248

   249

        if self.request.method == 'POST' :

   250

            username = self.request.form.get('username')

   251

            password = self.request.form.get('username')

   252

   253

            if username and password :

   254

                # preprocess

   255

                username = username.strip().lower()

   256

   257

                try :

   259

   260

                except pubtkt.Error as ex :

   261

                    self.auth_errors = ex

   262

   263

            elif self.pubtkt and self.pubtkt.valid() :

   266

   273

            # browsers seem to be very particular about quoting ;'s in cookie values...

   274

            # this follows PHP's setcookie() encoding...

   278

   279

            # redirect with cookie

   280

            response = pvl.web.response.redirect(self.back)

   281

   282

            response.set_cookie(self.app.cookie_name, cookie,

   283

                domain      = self.app.cookie_domain,

   284

                secure      = self.app.cookie_secure,

   285

                httponly    = self.app.cookie_httponly,

   286

            )

   287

   288

            return response

   289

   291

    def render (self) :

   292

        if self.pubtkt :

   293

            username = self.pubtkt.uid

   294

        else :

   295

            username = None

   296

   297

        domain = self.app.login_domain

   298

   299

        if 'logout' in self.request.args :

   300

            self.alert('info', "You have been logged out.")

   301

   311

        return html.div(class_='container')(

   312

            html.form(action=self.url(back=self.back), method='POST', id='login')(

   313

                (

   314

                    html.div(class_='alert alert-{alert}'.format(alert=type))(alert)

   315

                        for type, alert in self.alerts

   316

                ),

   317

   318

                html.fieldset(

   319

                    html.legend(

   320

                        (

   321

                            "Login @ ",

   322

                            html.a(href=self.back)(self.server),

   323

                        ) if self.server else (

   324

                            "Login"

   325

                        )

   326

                   ),

   327

   328

                    html.div(class_='form-group')(

   329

                        html.div(class_='input-group')(

   330

                            html.label(for_='username', class_='sr-only')("Username"),

   331

                            html.input(name='username', type='text', class_='form-control', placeholder="username", required=True, autofocus=True, value=username),

   332

                            html.span(class_='input-group-addon')("@{domain}".format(domain=domain)),

   333

                        ),

   334

   335

                        html.label(for_='password', class_='sr-only')("Password"),

   337

                    ),

   338

   339

                    html.button(type='submit', class_='btn btn-primary')("Login"),

   342

                )

   343

            )

   344

        )

   345

   346

class Logout (Handler) :

   347

    TITLE = "Logout"

   348

   349

    def process (self) :

   350

        self.process_cookie()

   351

   352

        if not self.pubtkt :

   353

            return self.redirect(Login)

   354

   355

        if self.request.method == 'POST' :

   356

            response = pvl.web.response.redirect(self.url(Login, logout=1))

   357

   358

            response.set_cookie(self.app.cookie_name, '',

   359

                    expires = 0,

   360

                    domain      = self.app.cookie_domain,

   361

                    secure      = self.app.cookie_secure,

   362

                    httponly    = self.app.cookie_httponly,

   363

            )

   364

   365

            return response

   366

   367

    def render (self) :

   368

        return html.div(class_='container')(

   369

            html.form(action=self.url(), method='post')(

   370

                html.fieldset(

   371

                    html.legend("Logout {pubtkt.uid}".format(pubtkt=self.pubtkt)),

   372

   373

                    html.button(type='submit', class_='btn btn-warning')("Logout"),

   374

                )

   375

            )

   376

        )

   377

   378

class LoginApplication (pvl.web.Application) :

   379

    URLS = urls.Map((

   380

        urls.rule('/',              Index),

   381

        urls.rule('/login',         Login),

   382

        urls.rule('/logout',        Logout),

   383

    ))

   384

   385

    PUBLIC_KEY = 'etc/login/public.pem'

   386

    PRIVATE_KEY = 'etc/login/private.pem'

   387

   388

    login_domain = 'test.paivola.fi'

   389

    login_server = 'login.test.paivola.fi'

   390

    login_valid = datetime.timedelta(seconds=60)

   391

    login_grace = datetime.timedelta(seconds=30)

   392

    login_scheme = 'https'

   393

   394

    cookie_name = 'auth_pubtkt'

   395

    cookie_domain = 'test.paivola.fi'

   396

    cookie_secure = True

   397

    cookie_httponly = True

   398

   399

    def __init__ (self, public_key=PUBLIC_KEY, private_key=PRIVATE_KEY, **opts) :

   400

        super(LoginApplication, self).__init__(**opts)

   401

   402

        self.server_keys = pubtkt.ServerKeys.config(

   403

                public_key  = public_key,

   404

                private_key = private_key,

   405

        )

   406

   407

    def check_server (self, server) :

   408

        """

   409

            Check that the given target server is valid.

   410

        """

   411

   412

        server = server.lower()

   413

   414

        if server == self.login_domain or server.endswith('.' + self.login_domain) :

   415

            return server

   416

        else :

   417

            raise pubtkt.ServerError("Target server is not covered by our authentication domain: {domain}".format(domain=self.login_domain))

   418

   419

    def load (self, cookie) :

   420

        """

   421

            Load a pubtkt from a cookie, and verify it.

   422

        """

   423

   424

        return pubtkt.PubTkt.load(cookie, self.server_keys.public)

   425

   426

    def auth (self, username, password) :

   427

        """

   428

            Perform authentication, returning a PubTkt, signed

   429

        """

   430

   431

        return pubtkt.PubTkt.new(username,

   432

                valid   = self.login_valid,

   433

                grace   = self.login_grace,

   434

        )

   435

   436

    def sign (self, pubtkt) :

   437

        """

   438

            Create a cookie by signing the given pubtkt.

   439

        """

   440

   441

        return pubtkt.sign(self.server_keys.private)

   442

   443

    def renew (self, pubtkt) :

   444

        """

   445

            Renew and re-sign the given pubtkt.

   446

        """

   450