remove internal content at ns.nsd
[osm/NBI.git] / osm_nbi / auth.py
1 # -*- coding: utf-8 -*-
2
3 # Copyright 2018 Whitestack, LLC
4 # Copyright 2018 Telefonica S.A.
5 #
6 # Licensed under the Apache License, Version 2.0 (the "License"); you may
7 # not use this file except in compliance with the License. You may obtain
8 # a copy of the License at
9 #
10 # http://www.apache.org/licenses/LICENSE-2.0
11 #
12 # Unless required by applicable law or agreed to in writing, software
13 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
14 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
15 # License for the specific language governing permissions and limitations
16 # under the License.
17 #
18 # For those usages not covered by the Apache License, Version 2.0 please
19 # contact: esousa@whitestack.com or alfonso.tiernosepulveda@telefonica.com
20 ##
21
22
23 """
24 Authenticator is responsible for authenticating the users,
25 create the tokens unscoped and scoped, retrieve the role
26 list inside the projects that they are inserted
27 """
28
29 __author__ = "Eduardo Sousa <esousa@whitestack.com>; Alfonso Tierno <alfonso.tiernosepulveda@telefonica.com>"
30 __date__ = "$27-jul-2018 23:59:59$"
31
32 import cherrypy
33 import logging
34 import yaml
35 from base64 import standard_b64decode
36 from copy import deepcopy
37 # from functools import reduce
38 from http import HTTPStatus
39 from time import time
40 from os import path
41
42 from osm_nbi.authconn import AuthException, AuthExceptionUnauthorized
43 from osm_nbi.authconn_keystone import AuthconnKeystone
44 from osm_nbi.authconn_internal import AuthconnInternal
45 from osm_common import dbmemory, dbmongo, msglocal, msgkafka
46 from osm_common.dbbase import DbException
47 from osm_nbi.validation import is_valid_uuid
48 from itertools import chain
49 from uuid import uuid4
50
51
52 class Authenticator:
53 """
54 This class should hold all the mechanisms for User Authentication and
55 Authorization. Initially it should support Openstack Keystone as a
56 backend through a plugin model where more backends can be added and a
57 RBAC model to manage permissions on operations.
58 This class must be threading safe
59 """
60
61 periodin_db_pruning = 60 * 30 # for the internal backend only. every 30 minutes expired tokens will be pruned
62 token_limit = 500 # when reached, the token cache will be cleared
63
64 def __init__(self, valid_methods, valid_query_string):
65 """
66 Authenticator initializer. Setup the initial state of the object,
67 while it waits for the config dictionary and database initialization.
68 """
69 self.backend = None
70 self.config = None
71 self.db = None
72 self.msg = None
73 self.tokens_cache = dict()
74 self.next_db_prune_time = 0 # time when next cleaning of expired tokens must be done
75 self.roles_to_operations_file = None
76 # self.roles_to_operations_table = None
77 self.resources_to_operations_mapping = {}
78 self.operation_to_allowed_roles = {}
79 self.logger = logging.getLogger("nbi.authenticator")
80 self.role_permissions = []
81 self.valid_methods = valid_methods
82 self.valid_query_string = valid_query_string
83
84 def start(self, config):
85 """
86 Method to configure the Authenticator object. This method should be called
87 after object creation. It is responsible by initializing the selected backend,
88 as well as the initialization of the database connection.
89
90 :param config: dictionary containing the relevant parameters for this object.
91 """
92 self.config = config
93
94 try:
95 if not self.db:
96 if config["database"]["driver"] == "mongo":
97 self.db = dbmongo.DbMongo()
98 self.db.db_connect(config["database"])
99 elif config["database"]["driver"] == "memory":
100 self.db = dbmemory.DbMemory()
101 self.db.db_connect(config["database"])
102 else:
103 raise AuthException("Invalid configuration param '{}' at '[database]':'driver'"
104 .format(config["database"]["driver"]))
105 if not self.msg:
106 if config["message"]["driver"] == "local":
107 self.msg = msglocal.MsgLocal()
108 self.msg.connect(config["message"])
109 elif config["message"]["driver"] == "kafka":
110 self.msg = msgkafka.MsgKafka()
111 self.msg.connect(config["message"])
112 else:
113 raise AuthException("Invalid configuration param '{}' at '[message]':'driver'"
114 .format(config["message"]["driver"]))
115 if not self.backend:
116 if config["authentication"]["backend"] == "keystone":
117 self.backend = AuthconnKeystone(self.config["authentication"], self.db, self.role_permissions)
118 elif config["authentication"]["backend"] == "internal":
119 self.backend = AuthconnInternal(self.config["authentication"], self.db, self.role_permissions)
120 self._internal_tokens_prune()
121 else:
122 raise AuthException("Unknown authentication backend: {}"
123 .format(config["authentication"]["backend"]))
124
125 if not self.roles_to_operations_file:
126 if "roles_to_operations" in config["rbac"]:
127 self.roles_to_operations_file = config["rbac"]["roles_to_operations"]
128 else:
129 possible_paths = (
130 __file__[:__file__.rfind("auth.py")] + "roles_to_operations.yml",
131 "./roles_to_operations.yml"
132 )
133 for config_file in possible_paths:
134 if path.isfile(config_file):
135 self.roles_to_operations_file = config_file
136 break
137 if not self.roles_to_operations_file:
138 raise AuthException("Invalid permission configuration: roles_to_operations file missing")
139
140 # load role_permissions
141 def load_role_permissions(method_dict):
142 for k in method_dict:
143 if k == "ROLE_PERMISSION":
144 for method in chain(method_dict.get("METHODS", ()), method_dict.get("TODO", ())):
145 permission = method_dict["ROLE_PERMISSION"] + method.lower()
146 if permission not in self.role_permissions:
147 self.role_permissions.append(permission)
148 elif k in ("TODO", "METHODS"):
149 continue
150 else:
151 load_role_permissions(method_dict[k])
152
153 load_role_permissions(self.valid_methods)
154 for query_string in self.valid_query_string:
155 for method in ("get", "put", "patch", "post", "delete"):
156 permission = query_string.lower() + ":" + method
157 if permission not in self.role_permissions:
158 self.role_permissions.append(permission)
159
160 except Exception as e:
161 raise AuthException(str(e))
162
163 def stop(self):
164 try:
165 if self.db:
166 self.db.db_disconnect()
167 except DbException as e:
168 raise AuthException(str(e), http_code=e.http_code)
169
170 def create_admin_project(self):
171 """
172 Creates a new project 'admin' into database if it doesn't exist. Useful for initialization.
173 :return: _id identity of the 'admin' project
174 """
175
176 # projects = self.db.get_one("projects", fail_on_empty=False, fail_on_more=False)
177 project_desc = {"name": "admin"}
178 projects = self.backend.get_project_list(project_desc)
179 if projects:
180 return projects[0]["_id"]
181 now = time()
182 project_desc["_id"] = str(uuid4())
183 project_desc["_admin"] = {"created": now, "modified": now}
184 pid = self.backend.create_project(project_desc)
185 self.logger.info("Project '{}' created at database".format(project_desc["name"]))
186 return pid
187
188 def create_admin_user(self, project_id):
189 """
190 Creates a new user admin/admin into database if database is empty. Useful for initialization
191 :return: _id identity of the inserted data, or None
192 """
193 # users = self.db.get_one("users", fail_on_empty=False, fail_on_more=False)
194 users = self.backend.get_user_list()
195 if users:
196 return None
197 # user_desc = {"username": "admin", "password": "admin", "projects": [project_id]}
198 now = time()
199 user_desc = {"username": "admin", "password": "admin", "_admin": {"created": now, "modified": now}}
200 if project_id:
201 pid = project_id
202 else:
203 # proj = self.db.get_one("projects", {"name": "admin"}, fail_on_empty=False, fail_on_more=False)
204 proj = self.backend.get_project_list({"name": "admin"})
205 pid = proj[0]["_id"] if proj else None
206 # role = self.db.get_one("roles", {"name": "system_admin"}, fail_on_empty=False, fail_on_more=False)
207 roles = self.backend.get_role_list({"name": "system_admin"})
208 if pid and roles:
209 user_desc["project_role_mappings"] = [{"project": pid, "role": roles[0]["_id"]}]
210 uid = self.backend.create_user(user_desc)
211 self.logger.info("User '{}' created at database".format(user_desc["username"]))
212 return uid
213
214 def init_db(self, target_version='1.0'):
215 """
216 Check if the database has been initialized, with at least one user. If not, create the required tables
217 and insert the predefined mappings between roles and permissions.
218
219 :param target_version: schema version that should be present in the database.
220 :return: None if OK, exception if error or version is different.
221 """
222
223 records = self.backend.get_role_list()
224
225 # Loading permissions to MongoDB if there is not any permission.
226 if not records or (len(records) == 1 and records[0]["name"] == "admin"):
227 with open(self.roles_to_operations_file, "r") as stream:
228 roles_to_operations_yaml = yaml.load(stream, Loader=yaml.Loader)
229
230 role_names = []
231 for role_with_operations in roles_to_operations_yaml["roles"]:
232 # Verifying if role already exists. If it does, raise exception
233 if role_with_operations["name"] not in role_names:
234 role_names.append(role_with_operations["name"])
235 else:
236 raise AuthException("Duplicated role name '{}' at file '{}''"
237 .format(role_with_operations["name"], self.roles_to_operations_file))
238
239 if not role_with_operations["permissions"]:
240 continue
241
242 for permission, is_allowed in role_with_operations["permissions"].items():
243 if not isinstance(is_allowed, bool):
244 raise AuthException("Invalid value for permission '{}' at role '{}'; at file '{}'"
245 .format(permission, role_with_operations["name"],
246 self.roles_to_operations_file))
247
248 # TODO chek permission is ok
249 if permission[-1] == ":":
250 raise AuthException("Invalid permission '{}' terminated in ':' for role '{}'; at file {}"
251 .format(permission, role_with_operations["name"],
252 self.roles_to_operations_file))
253
254 if "default" not in role_with_operations["permissions"]:
255 role_with_operations["permissions"]["default"] = False
256 if "admin" not in role_with_operations["permissions"]:
257 role_with_operations["permissions"]["admin"] = False
258
259 now = time()
260 role_with_operations["_admin"] = {
261 "created": now,
262 "modified": now,
263 }
264
265 # self.db.create(self.roles_to_operations_table, role_with_operations)
266 self.backend.create_role(role_with_operations)
267 self.logger.info("Role '{}' created at database".format(role_with_operations["name"]))
268
269 # Create admin project&user if required
270 pid = self.create_admin_project()
271 user_id = self.create_admin_user(pid)
272
273 # try to assign system_admin role to user admin if not any user has this role
274 if not user_id:
275 try:
276 users = self.backend.get_user_list()
277 roles = self.backend.get_role_list({"name": "system_admin"})
278 role_id = roles[0]["_id"]
279 user_with_system_admin = False
280 user_admin_id = None
281 for user in users:
282 if not user_admin_id:
283 user_admin_id = user["_id"]
284 if user["username"] == "admin":
285 user_admin_id = user["_id"]
286 for prm in user.get("project_role_mappings", ()):
287 if prm["role"] == role_id:
288 user_with_system_admin = True
289 break
290 if user_with_system_admin:
291 break
292 if not user_with_system_admin:
293 self.backend.update_user({"_id": user_admin_id,
294 "add_project_role_mappings": [{"project": pid, "role": role_id}]})
295 self.logger.info("Added role system admin to user='{}' project=admin".format(user_admin_id))
296 except Exception as e:
297 self.logger.error("Error in Authorization DataBase initialization: {}: {}".format(type(e).__name__, e))
298
299 self.load_operation_to_allowed_roles()
300
301 def load_operation_to_allowed_roles(self):
302 """
303 Fills the internal self.operation_to_allowed_roles based on database role content and self.role_permissions
304 It works in a shadow copy and replace at the end to allow other threads working with the old copy
305 :return: None
306 """
307
308 permissions = {oper: [] for oper in self.role_permissions}
309 # records = self.db.get_list(self.roles_to_operations_table)
310 records = self.backend.get_role_list()
311
312 ignore_fields = ["_id", "_admin", "name", "default"]
313 for record in records:
314 if not record.get("permissions"):
315 continue
316 record_permissions = {oper: record["permissions"].get("default", False) for oper in self.role_permissions}
317 operations_joined = [(oper, value) for oper, value in record["permissions"].items()
318 if oper not in ignore_fields]
319 operations_joined.sort(key=lambda x: x[0].count(":"))
320
321 for oper in operations_joined:
322 match = list(filter(lambda x: x.find(oper[0]) == 0, record_permissions.keys()))
323
324 for m in match:
325 record_permissions[m] = oper[1]
326
327 allowed_operations = [k for k, v in record_permissions.items() if v is True]
328
329 for allowed_op in allowed_operations:
330 permissions[allowed_op].append(record["name"])
331
332 self.operation_to_allowed_roles = permissions
333
334 def authorize(self, role_permission=None, query_string_operations=None, item_id=None):
335 token = None
336 user_passwd64 = None
337 try:
338 # 1. Get token Authorization bearer
339 auth = cherrypy.request.headers.get("Authorization")
340 if auth:
341 auth_list = auth.split(" ")
342 if auth_list[0].lower() == "bearer":
343 token = auth_list[-1]
344 elif auth_list[0].lower() == "basic":
345 user_passwd64 = auth_list[-1]
346 if not token:
347 if cherrypy.session.get("Authorization"):
348 # 2. Try using session before request a new token. If not, basic authentication will generate
349 token = cherrypy.session.get("Authorization")
350 if token == "logout":
351 token = None # force Unauthorized response to insert user password again
352 elif user_passwd64 and cherrypy.request.config.get("auth.allow_basic_authentication"):
353 # 3. Get new token from user password
354 user = None
355 passwd = None
356 try:
357 user_passwd = standard_b64decode(user_passwd64).decode()
358 user, _, passwd = user_passwd.partition(":")
359 except Exception:
360 pass
361 outdata = self.new_token(None, {"username": user, "password": passwd})
362 token = outdata["_id"]
363 cherrypy.session['Authorization'] = token
364
365 if not token:
366 raise AuthException("Needed a token or Authorization http header",
367 http_code=HTTPStatus.UNAUTHORIZED)
368
369 # try to get from cache first
370 now = time()
371 token_info = self.tokens_cache.get(token)
372 if token_info and token_info["expires"] < now:
373 # delete token. MUST be done with care, as another thread maybe already delete it. Do not use del
374 self.tokens_cache.pop(token, None)
375 token_info = None
376
377 # get from database if not in cache
378 if not token_info:
379 token_info = self.backend.validate_token(token)
380 # Clear cache if token limit reached
381 if len(self.tokens_cache) > self.token_limit:
382 self.tokens_cache.clear()
383 self.tokens_cache[token] = token_info
384 # TODO add to token info remote host, port
385
386 if role_permission:
387 RBAC_auth = self.check_permissions(token_info, cherrypy.request.method, role_permission,
388 query_string_operations, item_id)
389 token_info["allow_show_user_project_role"] = RBAC_auth
390
391 return token_info
392 except AuthException as e:
393 if not isinstance(e, AuthExceptionUnauthorized):
394 if cherrypy.session.get('Authorization'):
395 del cherrypy.session['Authorization']
396 cherrypy.response.headers["WWW-Authenticate"] = 'Bearer realm="{}"'.format(e)
397 elif self.config.get("user_not_authorized"):
398 # TODO provide user_id, roles id (not name), project_id
399 return {"id": "fake-token-id-for-test",
400 "project_id": self.config.get("project_not_authorized", "admin"),
401 "username": self.config["user_not_authorized"],
402 "roles": ["system_admin"]}
403 raise
404
405 def new_token(self, token_info, indata, remote):
406 new_token_info = self.backend.authenticate(
407 credentials=indata,
408 token_info=token_info,
409 )
410
411 new_token_info["remote_port"] = remote.port
412 if not new_token_info.get("expires"):
413 new_token_info["expires"] = time() + 3600
414 if not new_token_info.get("admin"):
415 new_token_info["admin"] = True if new_token_info.get("project_name") == "admin" else False
416 # TODO put admin in RBAC
417
418 if remote.name:
419 new_token_info["remote_host"] = remote.name
420 elif remote.ip:
421 new_token_info["remote_host"] = remote.ip
422
423 # TODO call self._internal_tokens_prune(now) ?
424 return deepcopy(new_token_info)
425
426 def get_token_list(self, token_info):
427 if self.config["authentication"]["backend"] == "internal":
428 return self._internal_get_token_list(token_info)
429 else:
430 # TODO: check if this can be avoided. Backend may provide enough information
431 return [deepcopy(token) for token in self.tokens_cache.values()
432 if token["username"] == token_info["username"]]
433
434 def get_token(self, token_info, token):
435 if self.config["authentication"]["backend"] == "internal":
436 return self._internal_get_token(token_info, token)
437 else:
438 # TODO: check if this can be avoided. Backend may provide enough information
439 token_value = self.tokens_cache.get(token)
440 if not token_value:
441 raise AuthException("token not found", http_code=HTTPStatus.NOT_FOUND)
442 if token_value["username"] != token_info["username"] and not token_info["admin"]:
443 raise AuthException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
444 return token_value
445
446 def del_token(self, token):
447 try:
448 self.backend.revoke_token(token)
449 # self.tokens_cache.pop(token, None)
450 self.remove_token_from_cache(token)
451 return "token '{}' deleted".format(token)
452 except KeyError:
453 raise AuthException("Token '{}' not found".format(token), http_code=HTTPStatus.NOT_FOUND)
454
455 def check_permissions(self, token_info, method, role_permission=None, query_string_operations=None, item_id=None):
456 """
457 Checks that operation has permissions to be done, base on the assigned roles to this user project
458 :param token_info: Dictionary that contains "roles" with a list of assigned roles.
459 This method fills the token_info["admin"] with True or False based on assigned tokens, if any allows admin
460 This will be used among others to hide or not the _admin content of topics
461 :param method: GET,PUT, POST, ...
462 :param role_permission: role permission name of the operation required
463 :param query_string_operations: list of possible admin query strings provided by user. It is checked that the
464 assigned role allows this query string for this method
465 :param item_id: item identifier if included in the URL, None otherwise
466 :return: True if access granted by permission rules, False if access granted by default rules (Bug 853)
467 :raises: AuthExceptionUnauthorized if access denied
468 """
469
470 roles_required = self.operation_to_allowed_roles[role_permission]
471 roles_allowed = [role["name"] for role in token_info["roles"]]
472
473 # fills token_info["admin"] if some roles allows it
474 token_info["admin"] = False
475 for role in roles_allowed:
476 if role in self.operation_to_allowed_roles["admin:" + method.lower()]:
477 token_info["admin"] = True
478 break
479
480 if "anonymous" in roles_required:
481 return True
482 operation_allowed = False
483 for role in roles_allowed:
484 if role in roles_required:
485 operation_allowed = True
486 # if query_string operations, check if this role allows it
487 if not query_string_operations:
488 return True
489 for query_string_operation in query_string_operations:
490 if role not in self.operation_to_allowed_roles[query_string_operation]:
491 break
492 else:
493 return True
494
495 # Bug 853 - Final Solution
496 # User/Project/Role whole listings are filtered elsewhere
497 # uid, pid, rid = ("user_id", "project_id", "id") if is_valid_uuid(id) else ("username", "project_name", "name")
498 uid = "user_id" if is_valid_uuid(item_id) else "username"
499 if (role_permission in ["projects:get", "projects:id:get", "roles:get", "roles:id:get", "users:get"]) \
500 or (role_permission == "users:id:get" and item_id == token_info[uid]):
501 # or (role_permission == "projects:id:get" and item_id == token_info[pid]) \
502 # or (role_permission == "roles:id:get" and item_id in [role[rid] for role in token_info["roles"]]):
503 return False
504
505 if not operation_allowed:
506 raise AuthExceptionUnauthorized("Access denied: lack of permissions.")
507 else:
508 raise AuthExceptionUnauthorized("Access denied: You have not permissions to use these admin query string")
509
510 def get_user_list(self):
511 return self.backend.get_user_list()
512
513 def _normalize_url(self, url, method):
514 # DEPRECATED !!!
515 # Removing query strings
516 normalized_url = url if '?' not in url else url[:url.find("?")]
517 normalized_url_splitted = normalized_url.split("/")
518 parameters = {}
519
520 filtered_keys = [key for key in self.resources_to_operations_mapping.keys()
521 if method in key.split()[0]]
522
523 for idx, path_part in enumerate(normalized_url_splitted):
524 tmp_keys = []
525 for tmp_key in filtered_keys:
526 splitted = tmp_key.split()[1].split("/")
527 if idx >= len(splitted):
528 continue
529 elif "<" in splitted[idx] and ">" in splitted[idx]:
530 if splitted[idx] == "<artifactPath>":
531 tmp_keys.append(tmp_key)
532 continue
533 elif idx == len(normalized_url_splitted) - 1 and \
534 len(normalized_url_splitted) != len(splitted):
535 continue
536 else:
537 tmp_keys.append(tmp_key)
538 elif splitted[idx] == path_part:
539 if idx == len(normalized_url_splitted) - 1 and \
540 len(normalized_url_splitted) != len(splitted):
541 continue
542 else:
543 tmp_keys.append(tmp_key)
544 filtered_keys = tmp_keys
545 if len(filtered_keys) == 1 and \
546 filtered_keys[0].split("/")[-1] == "<artifactPath>":
547 break
548
549 if len(filtered_keys) == 0:
550 raise AuthException("Cannot make an authorization decision. URL not found. URL: {0}".format(url))
551 elif len(filtered_keys) > 1:
552 raise AuthException("Cannot make an authorization decision. Multiple URLs found. URL: {0}".format(url))
553
554 filtered_key = filtered_keys[0]
555
556 for idx, path_part in enumerate(filtered_key.split()[1].split("/")):
557 if "<" in path_part and ">" in path_part:
558 if path_part == "<artifactPath>":
559 parameters[path_part[1:-1]] = "/".join(normalized_url_splitted[idx:])
560 else:
561 parameters[path_part[1:-1]] = normalized_url_splitted[idx]
562
563 return filtered_key, parameters
564
565 def _internal_get_token_list(self, token_info):
566 now = time()
567 token_list = self.db.get_list("tokens", {"username": token_info["username"], "expires.gt": now})
568 return token_list
569
570 def _internal_get_token(self, token_info, token_id):
571 token_value = self.db.get_one("tokens", {"_id": token_id}, fail_on_empty=False)
572 if not token_value:
573 raise AuthException("token not found", http_code=HTTPStatus.NOT_FOUND)
574 if token_value["username"] != token_info["username"] and not token_info["admin"]:
575 raise AuthException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
576 return token_value
577
578 def _internal_tokens_prune(self, now=None):
579 now = now or time()
580 if not self.next_db_prune_time or self.next_db_prune_time >= now:
581 self.db.del_list("tokens", {"expires.lt": now})
582 self.next_db_prune_time = self.periodin_db_pruning + now
583 # self.tokens_cache.clear() # not required any more
584
585 def remove_token_from_cache(self, token=None):
586 if token:
587 self.tokens_cache.pop(token, None)
588 else:
589 self.tokens_cache.clear()
590 self.msg.write("admin", "revoke_token", {"_id": token} if token else None)