1 # -*- coding: utf-8 -*-
3 # Copyright 2018 Whitestack, LLC
4 # Copyright 2018 Telefonica S.A.
6 # Licensed under the Apache License, Version 2.0 (the "License"); you may
7 # not use this file except in compliance with the License. You may obtain
8 # a copy of the License at
10 # http://www.apache.org/licenses/LICENSE-2.0
12 # Unless required by applicable law or agreed to in writing, software
13 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
14 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
15 # License for the specific language governing permissions and limitations
18 # For those usages not covered by the Apache License, Version 2.0 please
19 # contact: esousa@whitestack.com or alfonso.tiernosepulveda@telefonica.com
24 Authenticator is responsible for authenticating the users,
25 create the tokens unscoped and scoped, retrieve the role
26 list inside the projects that they are inserted
29 __author__
= "Eduardo Sousa <esousa@whitestack.com>; Alfonso Tierno <alfonso.tiernosepulveda@telefonica.com>"
30 __date__
= "$27-jul-2018 23:59:59$"
35 from base64
import standard_b64decode
36 from copy
import deepcopy
37 from functools
import reduce
38 from hashlib
import sha256
39 from http
import HTTPStatus
40 from random
import choice
as random_choice
43 from base_topic
import BaseTopic
# To allow project names in project_id
45 from authconn
import AuthException
46 from authconn_keystone
import AuthconnKeystone
47 from osm_common
import dbmongo
48 from osm_common
import dbmemory
49 from osm_common
.dbbase
import DbException
54 This class should hold all the mechanisms for User Authentication and
55 Authorization. Initially it should support Openstack Keystone as a
56 backend through a plugin model where more backends can be added and a
57 RBAC model to manage permissions on operations.
58 This class must be threading safe
61 periodin_db_pruning
= 60 * 30 # for the internal backend only. every 30 minutes expired tokens will be pruned
65 Authenticator initializer. Setup the initial state of the object,
66 while it waits for the config dictionary and database initialization.
71 self
.tokens_cache
= dict()
72 self
.next_db_prune_time
= 0 # time when next cleaning of expired tokens must be done
73 self
.resources_to_operations_file
= None
74 self
.roles_to_operations_file
= None
75 self
.resources_to_operations_mapping
= {}
76 self
.operation_to_allowed_roles
= {}
77 self
.logger
= logging
.getLogger("nbi.authenticator")
79 def start(self
, config
):
81 Method to configure the Authenticator object. This method should be called
82 after object creation. It is responsible by initializing the selected backend,
83 as well as the initialization of the database connection.
85 :param config: dictionary containing the relevant parameters for this object.
91 if config
["database"]["driver"] == "mongo":
92 self
.db
= dbmongo
.DbMongo()
93 self
.db
.db_connect(config
["database"])
94 elif config
["database"]["driver"] == "memory":
95 self
.db
= dbmemory
.DbMemory()
96 self
.db
.db_connect(config
["database"])
98 raise AuthException("Invalid configuration param '{}' at '[database]':'driver'"
99 .format(config
["database"]["driver"]))
101 if config
["authentication"]["backend"] == "keystone":
102 self
.backend
= AuthconnKeystone(self
.config
["authentication"])
103 elif config
["authentication"]["backend"] == "internal":
104 self
._internal
_tokens
_prune
()
106 raise AuthException("Unknown authentication backend: {}"
107 .format(config
["authentication"]["backend"]))
108 if not self
.resources_to_operations_file
:
109 if "resources_to_operations" in config
["rbac"]:
110 self
.resources_to_operations_file
= config
["rbac"]["resources_to_operations"]
113 __file__
[:__file__
.rfind("auth.py")] + "resources_to_operations.yml",
114 "./resources_to_operations.yml"
116 for config_file
in possible_paths
:
117 if path
.isfile(config_file
):
118 self
.resources_to_operations_file
= config_file
120 if not self
.resources_to_operations_file
:
121 raise AuthException("Invalid permission configuration: resources_to_operations file missing")
122 if not self
.roles_to_operations_file
:
123 if "roles_to_operations" in config
["rbac"]:
124 self
.roles_to_operations_file
= config
["rbac"]["roles_to_operations"]
127 __file__
[:__file__
.rfind("auth.py")] + "roles_to_operations.yml",
128 "./roles_to_operations.yml"
130 for config_file
in possible_paths
:
131 if path
.isfile(config_file
):
132 self
.roles_to_operations_file
= config_file
134 if not self
.roles_to_operations_file
:
135 raise AuthException("Invalid permission configuration: roles_to_operations file missing")
136 except Exception as e
:
137 raise AuthException(str(e
))
142 self
.db
.db_disconnect()
143 except DbException
as e
:
144 raise AuthException(str(e
), http_code
=e
.http_code
)
146 def init_db(self
, target_version
='1.0'):
148 Check if the database has been initialized, with at least one user. If not, create the required tables
149 and insert the predefined mappings between roles and permissions.
151 :param target_version: schema version that should be present in the database.
152 :return: None if OK, exception if error or version is different.
154 # Always reads operation to resource mapping from file (this is static, no need to store it in MongoDB)
155 # Operations encoding: "<METHOD> <URL>"
156 # Note: it is faster to rewrite the value than to check if it is already there or not
157 if self
.config
["authentication"]["backend"] == "internal":
161 with
open(self
.resources_to_operations_file
, "r") as stream
:
162 resources_to_operations_yaml
= yaml
.load(stream
)
164 for resource
, operation
in resources_to_operations_yaml
["resources_to_operations"].items():
165 operation_key
= operation
.replace(".", ":")
166 if operation_key
not in operations
:
167 operations
.append(operation_key
)
168 self
.resources_to_operations_mapping
[resource
] = operation_key
170 records
= self
.db
.get_list("roles_operations")
172 # Loading permissions to MongoDB. If there are permissions already in MongoDB, do nothing.
173 if len(records
) == 0:
174 with
open(self
.roles_to_operations_file
, "r") as stream
:
175 roles_to_operations_yaml
= yaml
.load(stream
)
178 for role_with_operations
in roles_to_operations_yaml
["roles_to_operations"]:
179 # Verifying if role already exists. If it does, send warning to log and ignore it.
180 if role_with_operations
["role"] not in roles
:
181 roles
.append(role_with_operations
["role"])
183 self
.logger
.warning("Duplicated role with name: {0}. Role definition is ignored."
184 .format(role_with_operations
["role"]))
190 if not role_with_operations
["operations"]:
193 for operation
, is_allowed
in role_with_operations
["operations"].items():
194 if not isinstance(is_allowed
, bool):
201 if len(operation
) != 1 and operation
[-1] == ".":
202 self
.logger
.warning("Invalid operation {0} terminated in '.'. "
203 "Operation will be discarded"
207 operation_key
= operation
.replace(".", ":")
208 if operation_key
not in role_ops
.keys():
209 role_ops
[operation_key
] = is_allowed
211 self
.logger
.info("In role {0}, the operation {1} with the value {2} was discarded due to "
212 "repetition.".format(role_with_operations
["role"], operation
, is_allowed
))
216 self
.logger
.info("Root for role {0} not defined. Default value 'False' applied."
217 .format(role_with_operations
["role"]))
220 operation_to_roles_item
= {
225 "name": role_with_operations
["role"],
229 for operation
, value
in role_ops
.items():
230 operation_to_roles_item
[operation
] = value
232 if self
.config
["authentication"]["backend"] != "internal" and \
233 role_with_operations
["role"] != "anonymous":
234 keystone_id
= [role
for role
in self
.backend
.get_role_list()
235 if role
["name"] == role_with_operations
["role"]]
237 keystone_id
= keystone_id
[0]
239 keystone_id
= self
.backend
.create_role(role_with_operations
["role"])
240 operation_to_roles_item
["_id"] = keystone_id
["_id"]
242 self
.db
.create("roles_operations", operation_to_roles_item
)
244 permissions
= {oper
: [] for oper
in operations
}
245 records
= self
.db
.get_list("roles_operations")
247 ignore_fields
= ["_id", "_admin", "name", "root"]
248 for record
in records
:
249 record_permissions
= {oper
: record
["root"] for oper
in operations
}
250 operations_joined
= [(oper
, value
) for oper
, value
in record
.items() if oper
not in ignore_fields
]
251 operations_joined
.sort(key
=lambda x
: x
[0].count(":"))
253 for oper
in operations_joined
:
254 match
= list(filter(lambda x
: x
.find(oper
[0]) == 0, record_permissions
.keys()))
257 record_permissions
[m
] = oper
[1]
259 allowed_operations
= [k
for k
, v
in record_permissions
.items() if v
is True]
261 for allowed_op
in allowed_operations
:
262 permissions
[allowed_op
].append(record
["name"])
264 for oper
, role_list
in permissions
.items():
265 self
.operation_to_allowed_roles
[oper
] = role_list
267 if self
.config
["authentication"]["backend"] != "internal":
268 self
.backend
.assign_role_to_user("admin", "admin", "system_admin")
274 # 1. Get token Authorization bearer
275 auth
= cherrypy
.request
.headers
.get("Authorization")
277 auth_list
= auth
.split(" ")
278 if auth_list
[0].lower() == "bearer":
279 token
= auth_list
[-1]
280 elif auth_list
[0].lower() == "basic":
281 user_passwd64
= auth_list
[-1]
283 if cherrypy
.session
.get("Authorization"):
284 # 2. Try using session before request a new token. If not, basic authentication will generate
285 token
= cherrypy
.session
.get("Authorization")
286 if token
== "logout":
287 token
= None # force Unauthorized response to insert user password again
288 elif user_passwd64
and cherrypy
.request
.config
.get("auth.allow_basic_authentication"):
289 # 3. Get new token from user password
293 user_passwd
= standard_b64decode(user_passwd64
).decode()
294 user
, _
, passwd
= user_passwd
.partition(":")
297 outdata
= self
.new_token(None, {"username": user
, "password": passwd
})
298 token
= outdata
["id"]
299 cherrypy
.session
['Authorization'] = token
300 if self
.config
["authentication"]["backend"] == "internal":
301 return self
._internal
_authorize
(token
)
304 raise AuthException("Needed a token or Authorization http header",
305 http_code
=HTTPStatus
.UNAUTHORIZED
)
307 self
.backend
.validate_token(token
)
308 self
.check_permissions(self
.tokens_cache
[token
], cherrypy
.request
.path_info
,
309 cherrypy
.request
.method
)
310 # TODO: check if this can be avoided. Backend may provide enough information
311 return deepcopy(self
.tokens_cache
[token
])
312 except AuthException
:
313 self
.del_token(token
)
315 except AuthException
as e
:
316 if cherrypy
.session
.get('Authorization'):
317 del cherrypy
.session
['Authorization']
318 cherrypy
.response
.headers
["WWW-Authenticate"] = 'Bearer realm="{}"'.format(e
)
319 raise AuthException(str(e
))
321 def new_token(self
, session
, indata
, remote
):
322 if self
.config
["authentication"]["backend"] == "internal":
323 return self
._internal
_new
_token
(session
, indata
, remote
)
325 if indata
.get("username"):
326 token
, projects
= self
.backend
.authenticate_with_user_password(
327 indata
.get("username"), indata
.get("password"))
329 token
, projects
= self
.backend
.authenticate_with_token(
330 session
.get("id"), indata
.get("project_id"))
332 raise AuthException("Provide credentials: username/password or Authorization Bearer token",
333 http_code
=HTTPStatus
.UNAUTHORIZED
)
335 if indata
.get("project_id"):
336 project_id
= indata
.get("project_id")
337 if project_id
not in projects
:
338 raise AuthException("Project {} not allowed for this user".format(project_id
),
339 http_code
=HTTPStatus
.UNAUTHORIZED
)
341 project_id
= projects
[0]
344 token
, projects
= self
.backend
.authenticate_with_token(token
, project_id
)
346 if project_id
== "admin":
349 session_admin
= reduce(lambda x
, y
: x
or (True if y
== "admin" else False),
357 "expires": now
+ 3600,
358 "project_id": project_id
,
359 "username": indata
.get("username") if not session
else session
.get("username"),
360 "remote_port": remote
.port
,
361 "admin": session_admin
365 new_session
["remote_host"] = remote
.name
367 new_session
["remote_host"] = remote
.ip
369 # TODO: check if this can be avoided. Backend may provide enough information
370 self
.tokens_cache
[token
] = new_session
372 return deepcopy(new_session
)
374 def get_token_list(self
, session
):
375 if self
.config
["authentication"]["backend"] == "internal":
376 return self
._internal
_get
_token
_list
(session
)
378 # TODO: check if this can be avoided. Backend may provide enough information
379 return [deepcopy(token
) for token
in self
.tokens_cache
.values()
380 if token
["username"] == session
["username"]]
382 def get_token(self
, session
, token
):
383 if self
.config
["authentication"]["backend"] == "internal":
384 return self
._internal
_get
_token
(session
, token
)
386 # TODO: check if this can be avoided. Backend may provide enough information
387 token_value
= self
.tokens_cache
.get(token
)
389 raise AuthException("token not found", http_code
=HTTPStatus
.NOT_FOUND
)
390 if token_value
["username"] != session
["username"] and not session
["admin"]:
391 raise AuthException("needed admin privileges", http_code
=HTTPStatus
.UNAUTHORIZED
)
394 def del_token(self
, token
):
395 if self
.config
["authentication"]["backend"] == "internal":
396 return self
._internal
_del
_token
(token
)
399 self
.backend
.revoke_token(token
)
400 del self
.tokens_cache
[token
]
401 return "token '{}' deleted".format(token
)
403 raise AuthException("Token '{}' not found".format(token
), http_code
=HTTPStatus
.NOT_FOUND
)
405 def check_permissions(self
, session
, url
, method
):
406 self
.logger
.info("Session: {}".format(session
))
407 self
.logger
.info("URL: {}".format(url
))
408 self
.logger
.info("Method: {}".format(method
))
410 key
, parameters
= self
._normalize
_url
(url
, method
)
412 # TODO: Check if parameters might be useful for the decision
414 operation
= self
.resources_to_operations_mapping
[key
]
415 roles_required
= self
.operation_to_allowed_roles
[operation
]
416 roles_allowed
= self
.backend
.get_user_role_list(session
["id"])
418 if "anonymous" in roles_required
:
421 for role
in roles_allowed
:
422 if role
in roles_required
:
425 raise AuthException("Access denied: lack of permissions.")
427 def get_user_list(self
):
428 return self
.backend
.get_user_list()
430 def _normalize_url(self
, url
, method
):
431 # Removing query strings
432 normalized_url
= url
if '?' not in url
else url
[:url
.find("?")]
433 normalized_url_splitted
= normalized_url
.split("/")
436 filtered_keys
= [key
for key
in self
.resources_to_operations_mapping
.keys()
437 if method
in key
.split()[0]]
439 for idx
, path_part
in enumerate(normalized_url_splitted
):
441 for tmp_key
in filtered_keys
:
442 splitted
= tmp_key
.split()[1].split("/")
443 if idx
>= len(splitted
):
445 elif "<" in splitted
[idx
] and ">" in splitted
[idx
]:
446 if splitted
[idx
] == "<artifactPath>":
447 tmp_keys
.append(tmp_key
)
449 elif idx
== len(normalized_url_splitted
) - 1 and \
450 len(normalized_url_splitted
) != len(splitted
):
453 tmp_keys
.append(tmp_key
)
454 elif splitted
[idx
] == path_part
:
455 if idx
== len(normalized_url_splitted
) - 1 and \
456 len(normalized_url_splitted
) != len(splitted
):
459 tmp_keys
.append(tmp_key
)
460 filtered_keys
= tmp_keys
461 if len(filtered_keys
) == 1 and \
462 filtered_keys
[0].split("/")[-1] == "<artifactPath>":
465 if len(filtered_keys
) == 0:
466 raise AuthException("Cannot make an authorization decision. URL not found. URL: {0}".format(url
))
467 elif len(filtered_keys
) > 1:
468 raise AuthException("Cannot make an authorization decision. Multiple URLs found. URL: {0}".format(url
))
470 filtered_key
= filtered_keys
[0]
472 for idx
, path_part
in enumerate(filtered_key
.split()[1].split("/")):
473 if "<" in path_part
and ">" in path_part
:
474 if path_part
== "<artifactPath>":
475 parameters
[path_part
[1:-1]] = "/".join(normalized_url_splitted
[idx
:])
477 parameters
[path_part
[1:-1]] = normalized_url_splitted
[idx
]
479 return filtered_key
, parameters
481 def _internal_authorize(self
, token_id
):
484 raise AuthException("Needed a token or Authorization http header", http_code
=HTTPStatus
.UNAUTHORIZED
)
485 # try to get from cache first
487 session
= self
.tokens_cache
.get(token_id
)
488 if session
and session
["expires"] < now
:
489 # delete token. MUST be done with care, as another thread maybe already delete it. Do not use del
490 self
.tokens_cache
.pop(token_id
, None)
495 # get from database if not in cache
496 session
= self
.db
.get_one("tokens", {"_id": token_id
})
497 if session
["expires"] < now
:
498 raise AuthException("Expired Token or Authorization http header", http_code
=HTTPStatus
.UNAUTHORIZED
)
499 self
.tokens_cache
[token_id
] = session
501 except DbException
as e
:
502 if e
.http_code
== HTTPStatus
.NOT_FOUND
:
503 raise AuthException("Invalid Token or Authorization http header", http_code
=HTTPStatus
.UNAUTHORIZED
)
507 except AuthException
:
508 if self
.config
["global"].get("test.user_not_authorized"):
509 return {"id": "fake-token-id-for-test",
510 "project_id": self
.config
["global"].get("test.project_not_authorized", "admin"),
511 "username": self
.config
["global"]["test.user_not_authorized"], "admin": True}
515 def _internal_new_token(self
, session
, indata
, remote
):
519 # Try using username/password
520 if indata
.get("username"):
521 user_rows
= self
.db
.get_list("users", {"username": indata
.get("username")})
523 user_content
= user_rows
[0]
524 salt
= user_content
["_admin"]["salt"]
525 shadow_password
= sha256(indata
.get("password", "").encode('utf-8') + salt
.encode('utf-8')).hexdigest()
526 if shadow_password
!= user_content
["password"]:
529 raise AuthException("Invalid username/password", http_code
=HTTPStatus
.UNAUTHORIZED
)
531 user_rows
= self
.db
.get_list("users", {"username": session
["username"]})
533 user_content
= user_rows
[0]
535 raise AuthException("Invalid token", http_code
=HTTPStatus
.UNAUTHORIZED
)
537 raise AuthException("Provide credentials: username/password or Authorization Bearer token",
538 http_code
=HTTPStatus
.UNAUTHORIZED
)
540 token_id
= ''.join(random_choice('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789')
541 for _
in range(0, 32))
542 project_id
= indata
.get("project_id")
544 if project_id
!= "admin":
545 # To allow project names in project_id
546 proj
= self
.db
.get_one("projects", {BaseTopic
.id_field("projects", project_id
): project_id
})
547 if proj
["_id"] not in user_content
["projects"] and proj
["name"] not in user_content
["projects"]:
548 raise AuthException("project {} not allowed for this user"
549 .format(project_id
), http_code
=HTTPStatus
.UNAUTHORIZED
)
551 project_id
= user_content
["projects"][0]
552 if project_id
== "admin":
555 # To allow project names in project_id
556 project
= self
.db
.get_one("projects", {BaseTopic
.id_field("projects", project_id
): project_id
})
557 session_admin
= project
.get("admin", False)
558 new_session
= {"issued_at": now
, "expires": now
+ 3600,
559 "_id": token_id
, "id": token_id
, "project_id": project_id
, "username": user_content
["username"],
560 "remote_port": remote
.port
, "admin": session_admin
}
562 new_session
["remote_host"] = remote
.name
564 new_session
["remote_host"] = remote
.ip
566 self
.tokens_cache
[token_id
] = new_session
567 self
.db
.create("tokens", new_session
)
568 # check if database must be prune
569 self
._internal
_tokens
_prune
(now
)
570 return deepcopy(new_session
)
572 def _internal_get_token_list(self
, session
):
574 token_list
= self
.db
.get_list("tokens", {"username": session
["username"], "expires.gt": now
})
577 def _internal_get_token(self
, session
, token_id
):
578 token_value
= self
.db
.get_one("tokens", {"_id": token_id
}, fail_on_empty
=False)
580 raise AuthException("token not found", http_code
=HTTPStatus
.NOT_FOUND
)
581 if token_value
["username"] != session
["username"] and not session
["admin"]:
582 raise AuthException("needed admin privileges", http_code
=HTTPStatus
.UNAUTHORIZED
)
585 def _internal_del_token(self
, token_id
):
587 self
.tokens_cache
.pop(token_id
, None)
588 self
.db
.del_one("tokens", {"_id": token_id
})
589 return "token '{}' deleted".format(token_id
)
590 except DbException
as e
:
591 if e
.http_code
== HTTPStatus
.NOT_FOUND
:
592 raise AuthException("Token '{}' not found".format(token_id
), http_code
=HTTPStatus
.NOT_FOUND
)
596 def _internal_tokens_prune(self
, now
=None):
598 if not self
.next_db_prune_time
or self
.next_db_prune_time
>= now
:
599 self
.db
.del_list("tokens", {"expires.lt": now
})
600 self
.next_db_prune_time
= self
.periodin_db_pruning
+ now
601 self
.tokens_cache
.clear() # force to reload tokens from database