+ outdata = self.new_token(
+ None, {"username": user, "password": passwd}
+ )
+ token = outdata["_id"]
+ cherrypy.session["Authorization"] = token
+
+ if not token:
+ raise AuthException(
+ "Needed a token or Authorization http header",
+ http_code=HTTPStatus.UNAUTHORIZED,
+ )
+
+ # try to get from cache first
+ now = time()
+ token_info = self.tokens_cache.get(token)
+ if token_info and token_info["expires"] < now:
+ # delete token. MUST be done with care, as another thread maybe already delete it. Do not use del
+ self.tokens_cache.pop(token, None)
+ token_info = None
+
+ # get from database if not in cache
+ if not token_info:
+ token_info = self.backend.validate_token(token)
+ # Clear cache if token limit reached
+ if len(self.tokens_cache) > self.token_limit:
+ self.tokens_cache.clear()
+ self.tokens_cache[token] = token_info
+ # TODO add to token info remote host, port
+
+ if role_permission:
+ RBAC_auth = self.check_permissions(
+ token_info,
+ cherrypy.request.method,
+ role_permission,
+ query_string_operations,
+ item_id,
+ )
+ self.logger.info("RBAC_auth: {}".format(RBAC_auth))
+ token_info["allow_show_user_project_role"] = RBAC_auth
+
+ return token_info
+ except AuthException as e:
+ if not isinstance(e, AuthExceptionUnauthorized):
+ if cherrypy.session.get("Authorization"):
+ del cherrypy.session["Authorization"]
+ cherrypy.response.headers[
+ "WWW-Authenticate"
+ ] = 'Bearer realm="{}"'.format(e)
+ if self.config["authentication"].get("user_not_authorized"):
+ return {
+ "id": "testing-token",
+ "_id": "testing-token",
+ "project_id": self.test_project_id,
+ "username": self.config["authentication"]["user_not_authorized"],
+ "roles": [self.system_admin_role_id],
+ "admin": True,
+ "allow_show_user_project_role": True,
+ }
+ raise
+
+ def new_token(self, token_info, indata, remote):
+ new_token_info = self.backend.authenticate(
+ credentials=indata,
+ token_info=token_info,
+ )
+
+ new_token_info["remote_port"] = remote.port
+ if not new_token_info.get("expires"):
+ new_token_info["expires"] = time() + 3600
+ if not new_token_info.get("admin"):
+ new_token_info["admin"] = (
+ True if new_token_info.get("project_name") == "admin" else False
+ )
+ # TODO put admin in RBAC
+
+ if remote.name:
+ new_token_info["remote_host"] = remote.name
+ elif remote.ip:
+ new_token_info["remote_host"] = remote.ip
+
+ # TODO call self._internal_tokens_prune(now) ?
+ return deepcopy(new_token_info)
+
+ def get_token_list(self, token_info):
+ if self.config["authentication"]["backend"] == "internal":
+ return self._internal_get_token_list(token_info)
+ else:
+ # TODO: check if this can be avoided. Backend may provide enough information
+ return [
+ deepcopy(token)
+ for token in self.tokens_cache.values()
+ if token["username"] == token_info["username"]
+ ]
+
+ def get_token(self, token_info, token):
+ if self.config["authentication"]["backend"] == "internal":
+ return self._internal_get_token(token_info, token)
+ else:
+ # TODO: check if this can be avoided. Backend may provide enough information
+ token_value = self.tokens_cache.get(token)
+ if not token_value:
+ raise AuthException("token not found", http_code=HTTPStatus.NOT_FOUND)
+ if (
+ token_value["username"] != token_info["username"]
+ and not token_info["admin"]
+ ):
+ raise AuthException(
+ "needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED
+ )
+ return token_value
+
+ def del_token(self, token):
+ try:
+ self.backend.revoke_token(token)
+ # self.tokens_cache.pop(token, None)
+ self.remove_token_from_cache(token)
+ return "token '{}' deleted".format(token)
+ except KeyError:
+ raise AuthException(
+ "Token '{}' not found".format(token), http_code=HTTPStatus.NOT_FOUND
+ )
+
+ def check_permissions(
+ self,
+ token_info,
+ method,
+ role_permission=None,
+ query_string_operations=None,
+ item_id=None,
+ ):
+ """
+ Checks that operation has permissions to be done, base on the assigned roles to this user project
+ :param token_info: Dictionary that contains "roles" with a list of assigned roles.
+ This method fills the token_info["admin"] with True or False based on assigned tokens, if any allows admin
+ This will be used among others to hide or not the _admin content of topics
+ :param method: GET,PUT, POST, ...
+ :param role_permission: role permission name of the operation required
+ :param query_string_operations: list of possible admin query strings provided by user. It is checked that the
+ assigned role allows this query string for this method
+ :param item_id: item identifier if included in the URL, None otherwise
+ :return: True if access granted by permission rules, False if access granted by default rules (Bug 853)
+ :raises: AuthExceptionUnauthorized if access denied
+ """
+ self.load_operation_to_allowed_roles()
+
+ roles_required = self.operation_to_allowed_roles[role_permission]
+ roles_allowed = [role["name"] for role in token_info["roles"]]
+
+ # fills token_info["admin"] if some roles allows it
+ token_info["admin"] = False
+ for role in roles_allowed:
+ if role in self.operation_to_allowed_roles["admin:" + method.lower()]:
+ token_info["admin"] = True
+ break
+
+ if "anonymous" in roles_required:
+ return True
+ operation_allowed = False
+ for role in roles_allowed:
+ if role in roles_required:
+ operation_allowed = True
+ # if query_string operations, check if this role allows it
+ if not query_string_operations:
+ return True
+ for query_string_operation in query_string_operations:
+ if (
+ role
+ not in self.operation_to_allowed_roles[query_string_operation]
+ ):
+ break
+ else:
+ return True
+
+ # Bug 853 - Final Solution
+ # User/Project/Role whole listings are filtered elsewhere
+ # uid, pid, rid = ("user_id", "project_id", "id") if is_valid_uuid(id) else ("username", "project_name", "name")
+ uid = "user_id" if is_valid_uuid(item_id) else "username"
+ if (
+ role_permission
+ in [
+ "projects:get",
+ "projects:id:get",
+ "roles:get",
+ "roles:id:get",
+ "users:get",
+ ]
+ ) or (role_permission == "users:id:get" and item_id == token_info[uid]):
+ # or (role_permission == "projects:id:get" and item_id == token_info[pid]) \
+ # or (role_permission == "roles:id:get" and item_id in [role[rid] for role in token_info["roles"]]):
+ return False
+
+ if not operation_allowed:
+ raise AuthExceptionUnauthorized("Access denied: lack of permissions.")
+ else:
+ raise AuthExceptionUnauthorized(
+ "Access denied: You have not permissions to use these admin query string"
+ )
+
+ def get_user_list(self):
+ return self.backend.get_user_list()
+
+ def _normalize_url(self, url, method):
+ # DEPRECATED !!!
+ # Removing query strings
+ normalized_url = url if "?" not in url else url[: url.find("?")]
+ normalized_url_splitted = normalized_url.split("/")
+ parameters = {}
+
+ filtered_keys = [
+ key
+ for key in self.resources_to_operations_mapping.keys()
+ if method in key.split()[0]
+ ]
+
+ for idx, path_part in enumerate(normalized_url_splitted):
+ tmp_keys = []
+ for tmp_key in filtered_keys:
+ splitted = tmp_key.split()[1].split("/")
+ if idx >= len(splitted):
+ continue
+ elif "<" in splitted[idx] and ">" in splitted[idx]:
+ if splitted[idx] == "<artifactPath>":
+ tmp_keys.append(tmp_key)
+ continue
+ elif idx == len(normalized_url_splitted) - 1 and len(
+ normalized_url_splitted
+ ) != len(splitted):
+ continue
+ else:
+ tmp_keys.append(tmp_key)
+ elif splitted[idx] == path_part:
+ if idx == len(normalized_url_splitted) - 1 and len(
+ normalized_url_splitted
+ ) != len(splitted):
+ continue
+ else:
+ tmp_keys.append(tmp_key)
+ filtered_keys = tmp_keys
+ if (
+ len(filtered_keys) == 1
+ and filtered_keys[0].split("/")[-1] == "<artifactPath>"
+ ):
+ break
+
+ if len(filtered_keys) == 0:
+ raise AuthException(
+ "Cannot make an authorization decision. URL not found. URL: {0}".format(
+ url
+ )
+ )
+ elif len(filtered_keys) > 1:
+ raise AuthException(
+ "Cannot make an authorization decision. Multiple URLs found. URL: {0}".format(
+ url
+ )
+ )
+
+ filtered_key = filtered_keys[0]
+
+ for idx, path_part in enumerate(filtered_key.split()[1].split("/")):
+ if "<" in path_part and ">" in path_part:
+ if path_part == "<artifactPath>":
+ parameters[path_part[1:-1]] = "/".join(
+ normalized_url_splitted[idx:]
+ )
+ else:
+ parameters[path_part[1:-1]] = normalized_url_splitted[idx]
+
+ return filtered_key, parameters
+
+ def _internal_get_token_list(self, token_info):
+ now = time()
+ token_list = self.db.get_list(
+ "tokens", {"username": token_info["username"], "expires.gt": now}
+ )
+ return token_list
+
+ def _internal_get_token(self, token_info, token_id):
+ token_value = self.db.get_one("tokens", {"_id": token_id}, fail_on_empty=False)
+ if not token_value:
+ raise AuthException("token not found", http_code=HTTPStatus.NOT_FOUND)
+ if (
+ token_value["username"] != token_info["username"]
+ and not token_info["admin"]
+ ):
+ raise AuthException(
+ "needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED
+ )
+ return token_value
+
+ def _internal_tokens_prune(self, token_collection, now=None):
+ now = now or time()
+ if not self.next_db_prune_time or self.next_db_prune_time >= now:
+ self.db.del_list(token_collection, {"expires.lt": now})
+ self.next_db_prune_time = self.periodin_db_pruning + now
+ # self.tokens_cache.clear() # not required any more
+
+ def remove_token_from_cache(self, token=None):
+ if token:
+ self.tokens_cache.pop(token, None)
+ else:
+ self.tokens_cache.clear()
+ self.msg.write("admin", "revoke_token", {"_id": token} if token else None)
+
+ def check_password_expiry(self, outdata):
+ """
+ This method will check for password expiry of the user
+ :param outdata: user token information
+ """
+ user_content = None
+ detail = {}
+ present_time = time()
+ user = outdata["username"]
+ if self.config["authentication"].get("pwd_expiry_check"):
+ user_content = self.db.get_list("users", {"username": user})[0]
+ if not user_content.get("username") == "admin":
+ user_content["_admin"]["modified_time"] = present_time
+ if user_content.get("_admin").get("expire_time"):
+ expire_time = user_content["_admin"]["expire_time"]
+ else:
+ expire_time = present_time
+ uid = user_content["_id"]
+ self.db.set_one("users", {"_id": uid}, user_content)
+ if not present_time < expire_time:
+ return True
+ else:
+ pass