osm_nbi/auth.py

   1 # -*- coding: utf-8 -*-
   2
   3 # Copyright 2018 Whitestack, LLC
   4 # Copyright 2018 Telefonica S.A.
   5 #
   6 # Licensed under the Apache License, Version 2.0 (the "License"); you may
   7 # not use this file except in compliance with the License. You may obtain
   8 # a copy of the License at
   9 #
  10 #         http://www.apache.org/licenses/LICENSE-2.0
  11 #
  12 # Unless required by applicable law or agreed to in writing, software
  13 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  14 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  15 # License for the specific language governing permissions and limitations
  16 # under the License.
  17 #
  18 # For those usages not covered by the Apache License, Version 2.0 please
  19 # contact: esousa@whitestack.com or alfonso.tiernosepulveda@telefonica.com
  20 ##
  21
  22
  23 """
  24 Authenticator is responsible for authenticating the users,
  25 create the tokens unscoped and scoped, retrieve the role
  26 list inside the projects that they are inserted
  27 """
  28
  29 __author__ = "Eduardo Sousa <esousa@whitestack.com>; Alfonso Tierno <alfonso.tiernosepulveda@telefonica.com>"
  30 __date__ = "$27-jul-2018 23:59:59$"
  31
  32 import cherrypy
  33 import logging
  34 import yaml
  35 from base64 import standard_b64decode
  36 from copy import deepcopy
  37 # from functools import reduce
  38 from http import HTTPStatus
  39 from time import time
  40 from os import path
  41
  42 from authconn import AuthException, AuthExceptionUnauthorized
  43 from authconn_keystone import AuthconnKeystone
  44 from authconn_internal import AuthconnInternal   # Comment out for testing&debugging, uncomment when ready
  45 from osm_common import dbmongo
  46 from osm_common import dbmemory
  47 from osm_common.dbbase import DbException
  48 from itertools import chain
  49
  50 from uuid import uuid4
  51
  52
  53 class Authenticator:
  54     """
  55     This class should hold all the mechanisms for User Authentication and
  56     Authorization. Initially it should support Openstack Keystone as a
  57     backend through a plugin model where more backends can be added and a
  58     RBAC model to manage permissions on operations.
  59     This class must be threading safe
  60     """
  61
  62     periodin_db_pruning = 60 * 30  # for the internal backend only. every 30 minutes expired tokens will be pruned
  63
  64     def __init__(self, valid_methods, valid_query_string):
  65         """
  66         Authenticator initializer. Setup the initial state of the object,
  67         while it waits for the config dictionary and database initialization.
  68         """
  69         self.backend = None
  70         self.config = None
  71         self.db = None
  72         self.tokens_cache = dict()
  73         self.next_db_prune_time = 0  # time when next cleaning of expired tokens must be done
  74         self.roles_to_operations_file = None
  75         # self.roles_to_operations_table = None
  76         self.resources_to_operations_mapping = {}
  77         self.operation_to_allowed_roles = {}
  78         self.logger = logging.getLogger("nbi.authenticator")
  79         self.role_permissions = []
  80         self.valid_methods = valid_methods
  81         self.valid_query_string = valid_query_string
  82
  83     def start(self, config):
  84         """
  85         Method to configure the Authenticator object. This method should be called
  86         after object creation. It is responsible by initializing the selected backend,
  87         as well as the initialization of the database connection.
  88
  89         :param config: dictionary containing the relevant parameters for this object.
  90         """
  91         self.config = config
  92
  93         try:
  94             if not self.db:
  95                 if config["database"]["driver"] == "mongo":
  96                     self.db = dbmongo.DbMongo()
  97                     self.db.db_connect(config["database"])
  98                 elif config["database"]["driver"] == "memory":
  99                     self.db = dbmemory.DbMemory()
 100                     self.db.db_connect(config["database"])
 101                 else:
 102                     raise AuthException("Invalid configuration param '{}' at '[database]':'driver'"
 103                                         .format(config["database"]["driver"]))
 104             if not self.backend:
 105                 if config["authentication"]["backend"] == "keystone":
 106                     self.backend = AuthconnKeystone(self.config["authentication"], self.db, self.tokens_cache)
 107                 elif config["authentication"]["backend"] == "internal":
 108                     self.backend = AuthconnInternal(self.config["authentication"], self.db, self.tokens_cache)
 109                     self._internal_tokens_prune()
 110                 else:
 111                     raise AuthException("Unknown authentication backend: {}"
 112                                         .format(config["authentication"]["backend"]))
 113
 114             if not self.roles_to_operations_file:
 115                 if "roles_to_operations" in config["rbac"]:
 116                     self.roles_to_operations_file = config["rbac"]["roles_to_operations"]
 117                 else:
 118                     possible_paths = (
 119                         __file__[:__file__.rfind("auth.py")] + "roles_to_operations.yml",
 120                         "./roles_to_operations.yml"
 121                     )
 122                     for config_file in possible_paths:
 123                         if path.isfile(config_file):
 124                             self.roles_to_operations_file = config_file
 125                             break
 126                 if not self.roles_to_operations_file:
 127                     raise AuthException("Invalid permission configuration: roles_to_operations file missing")
 128
 129             # load role_permissions
 130             def load_role_permissions(method_dict):
 131                 for k in method_dict:
 132                     if k == "ROLE_PERMISSION":
 133                         for method in chain(method_dict.get("METHODS", ()), method_dict.get("TODO", ())):
 134                             permission = method_dict["ROLE_PERMISSION"] + method.lower()
 135                             if permission not in self.role_permissions:
 136                                 self.role_permissions.append(permission)
 137                     elif k in ("TODO", "METHODS"):
 138                         continue
 139                     else:
 140                         load_role_permissions(method_dict[k])
 141
 142             load_role_permissions(self.valid_methods)
 143             for query_string in self.valid_query_string:
 144                 for method in ("get", "put", "patch", "post", "delete"):
 145                     permission = query_string.lower() + ":" + method
 146                     if permission not in self.role_permissions:
 147                         self.role_permissions.append(permission)
 148
 149         except Exception as e:
 150             raise AuthException(str(e))
 151
 152     def stop(self):
 153         try:
 154             if self.db:
 155                 self.db.db_disconnect()
 156         except DbException as e:
 157             raise AuthException(str(e), http_code=e.http_code)
 158
 159     def create_admin_project(self):
 160         """
 161         Creates a new project 'admin' into database if it doesn't exist. Useful for initialization.
 162         :return: _id identity of the 'admin' project
 163         """
 164
 165         # projects = self.db.get_one("projects", fail_on_empty=False, fail_on_more=False)
 166         project_desc = {"name": "admin"}
 167         projects = self.backend.get_project_list(project_desc)
 168         if projects:
 169             return projects[0]["_id"]
 170         now = time()
 171         project_desc["_id"] = str(uuid4())
 172         project_desc["_admin"] = {"created": now, "modified": now}
 173         pid = self.backend.create_project(project_desc)
 174         self.logger.info("Project '{}' created at database".format(project_desc["name"]))
 175         return pid
 176
 177     def create_admin_user(self, project_id):
 178         """
 179         Creates a new user admin/admin into database if database is empty. Useful for initialization
 180         :return: _id identity of the inserted data, or None
 181         """
 182         # users = self.db.get_one("users", fail_on_empty=False, fail_on_more=False)
 183         users = self.backend.get_user_list()
 184         if users:
 185             return None
 186         # user_desc = {"username": "admin", "password": "admin", "projects": [project_id]}
 187         now = time()
 188         user_desc = {"username": "admin", "password": "admin", "_admin": {"created": now, "modified": now}}
 189         if project_id:
 190             pid = project_id
 191         else:
 192             # proj = self.db.get_one("projects", {"name": "admin"}, fail_on_empty=False, fail_on_more=False)
 193             proj = self.backend.get_project_list({"name": "admin"})
 194             pid = proj[0]["_id"] if proj else None
 195         # role = self.db.get_one("roles", {"name": "system_admin"}, fail_on_empty=False, fail_on_more=False)
 196         roles = self.backend.get_role_list({"name": "system_admin"})
 197         if pid and roles:
 198             user_desc["project_role_mappings"] = [{"project": pid, "role": roles[0]["_id"]}]
 199         uid = self.backend.create_user(user_desc)
 200         self.logger.info("User '{}' created at database".format(user_desc["username"]))
 201         return uid
 202
 203     def init_db(self, target_version='1.0'):
 204         """
 205         Check if the database has been initialized, with at least one user. If not, create the required tables
 206         and insert the predefined mappings between roles and permissions.
 207
 208         :param target_version: schema version that should be present in the database.
 209         :return: None if OK, exception if error or version is different.
 210         """
 211
 212         records = self.backend.get_role_list()
 213
 214         # Loading permissions to MongoDB if there is not any permission.
 215         if not records or (len(records) == 1 and records[0]["name"] == "admin"):
 216             with open(self.roles_to_operations_file, "r") as stream:
 217                 roles_to_operations_yaml = yaml.load(stream)
 218
 219             role_names = []
 220             for role_with_operations in roles_to_operations_yaml["roles"]:
 221                 # Verifying if role already exists. If it does, raise exception
 222                 if role_with_operations["name"] not in role_names:
 223                     role_names.append(role_with_operations["name"])
 224                 else:
 225                     raise AuthException("Duplicated role name '{}' at file '{}''"
 226                                         .format(role_with_operations["name"], self.roles_to_operations_file))
 227
 228                 if not role_with_operations["permissions"]:
 229                     continue
 230
 231                 for permission, is_allowed in role_with_operations["permissions"].items():
 232                     if not isinstance(is_allowed, bool):
 233                         raise AuthException("Invalid value for permission '{}' at role '{}'; at file '{}'"
 234                                             .format(permission, role_with_operations["name"],
 235                                                     self.roles_to_operations_file))
 236
 237                     # TODO chek permission is ok
 238                     if permission[-1] == ":":
 239                         raise AuthException("Invalid permission '{}' terminated in ':' for role '{}'; at file {}"
 240                                             .format(permission, role_with_operations["name"],
 241                                                     self.roles_to_operations_file))
 242
 243                 if "default" not in role_with_operations["permissions"]:
 244                     role_with_operations["permissions"]["default"] = False
 245                 if "admin" not in role_with_operations["permissions"]:
 246                     role_with_operations["permissions"]["admin"] = False
 247
 248                 now = time()
 249                 role_with_operations["_admin"] = {
 250                     "created": now,
 251                     "modified": now,
 252                 }
 253
 254                 # self.db.create(self.roles_to_operations_table, role_with_operations)
 255                 self.backend.create_role(role_with_operations)
 256                 self.logger.info("Role '{}' created at database".format(role_with_operations["name"]))
 257
 258         # Create admin project&user if required
 259         pid = self.create_admin_project()
 260         self.create_admin_user(pid)
 261
 262         if self.config["authentication"]["backend"] == "keystone":
 263             try:
 264                 self.backend.assign_role_to_user("admin", "admin", "system_admin")
 265             except Exception:
 266                 pass
 267
 268         self.load_operation_to_allowed_roles()
 269
 270     def load_operation_to_allowed_roles(self):
 271         """
 272         Fills the internal self.operation_to_allowed_roles based on database role content and self.role_permissions
 273         It works in a shadow copy and replace at the end to allow other threads working with the old copy
 274         :return: None
 275         """
 276
 277         permissions = {oper: [] for oper in self.role_permissions}
 278         # records = self.db.get_list(self.roles_to_operations_table)
 279         records = self.backend.get_role_list()
 280
 281         ignore_fields = ["_id", "_admin", "name", "default"]
 282         for record in records:
 283             if not record.get("permissions"):
 284                 continue
 285             record_permissions = {oper: record["permissions"].get("default", False) for oper in self.role_permissions}
 286             operations_joined = [(oper, value) for oper, value in record["permissions"].items()
 287                                  if oper not in ignore_fields]
 288             operations_joined.sort(key=lambda x: x[0].count(":"))
 289
 290             for oper in operations_joined:
 291                 match = list(filter(lambda x: x.find(oper[0]) == 0, record_permissions.keys()))
 292
 293                 for m in match:
 294                     record_permissions[m] = oper[1]
 295
 296             allowed_operations = [k for k, v in record_permissions.items() if v is True]
 297
 298             for allowed_op in allowed_operations:
 299                 permissions[allowed_op].append(record["name"])
 300
 301         self.operation_to_allowed_roles = permissions
 302
 303     def authorize(self, role_permission=None, query_string_operations=None):
 304         token = None
 305         user_passwd64 = None
 306         try:
 307             # 1. Get token Authorization bearer
 308             auth = cherrypy.request.headers.get("Authorization")
 309             if auth:
 310                 auth_list = auth.split(" ")
 311                 if auth_list[0].lower() == "bearer":
 312                     token = auth_list[-1]
 313                 elif auth_list[0].lower() == "basic":
 314                     user_passwd64 = auth_list[-1]
 315             if not token:
 316                 if cherrypy.session.get("Authorization"):
 317                     # 2. Try using session before request a new token. If not, basic authentication will generate
 318                     token = cherrypy.session.get("Authorization")
 319                     if token == "logout":
 320                         token = None  # force Unauthorized response to insert user password again
 321                 elif user_passwd64 and cherrypy.request.config.get("auth.allow_basic_authentication"):
 322                     # 3. Get new token from user password
 323                     user = None
 324                     passwd = None
 325                     try:
 326                         user_passwd = standard_b64decode(user_passwd64).decode()
 327                         user, _, passwd = user_passwd.partition(":")
 328                     except Exception:
 329                         pass
 330                     outdata = self.new_token(None, {"username": user, "password": passwd})
 331                     token = outdata["_id"]
 332                     cherrypy.session['Authorization'] = token
 333
 334             if not token:
 335                 raise AuthException("Needed a token or Authorization http header",
 336                                     http_code=HTTPStatus.UNAUTHORIZED)
 337             token_info = self.backend.validate_token(token)
 338             # TODO add to token info remote host, port
 339
 340             if role_permission:
 341                 self.check_permissions(token_info, cherrypy.request.method, role_permission,
 342                                        query_string_operations)
 343             return token_info
 344         except AuthException as e:
 345             if not isinstance(e, AuthExceptionUnauthorized):
 346                 if cherrypy.session.get('Authorization'):
 347                     del cherrypy.session['Authorization']
 348                 cherrypy.response.headers["WWW-Authenticate"] = 'Bearer realm="{}"'.format(e)
 349             raise
 350
 351     def new_token(self, token_info, indata, remote):
 352         new_token_info = self.backend.authenticate(
 353             user=indata.get("username"),
 354             password=indata.get("password"),
 355             token_info=token_info,
 356             project=indata.get("project_id")
 357         )
 358
 359         new_token_info["remote_port"] = remote.port
 360         if not new_token_info.get("expires"):
 361             new_token_info["expires"] = time() + 3600
 362         if not new_token_info.get("admin"):
 363             new_token_info["admin"] = True if new_token_info.get("project_name") == "admin" else False
 364             # TODO put admin in RBAC
 365
 366         if remote.name:
 367             new_token_info["remote_host"] = remote.name
 368         elif remote.ip:
 369             new_token_info["remote_host"] = remote.ip
 370
 371         self.tokens_cache[new_token_info["_id"]] = new_token_info
 372
 373         # TODO call self._internal_tokens_prune(now) ?
 374         return deepcopy(new_token_info)
 375
 376     def get_token_list(self, token_info):
 377         if self.config["authentication"]["backend"] == "internal":
 378             return self._internal_get_token_list(token_info)
 379         else:
 380             # TODO: check if this can be avoided. Backend may provide enough information
 381             return [deepcopy(token) for token in self.tokens_cache.values()
 382                     if token["username"] == token_info["username"]]
 383
 384     def get_token(self, token_info, token):
 385         if self.config["authentication"]["backend"] == "internal":
 386             return self._internal_get_token(token_info, token)
 387         else:
 388             # TODO: check if this can be avoided. Backend may provide enough information
 389             token_value = self.tokens_cache.get(token)
 390             if not token_value:
 391                 raise AuthException("token not found", http_code=HTTPStatus.NOT_FOUND)
 392             if token_value["username"] != token_info["username"] and not token_info["admin"]:
 393                 raise AuthException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
 394             return token_value
 395
 396     def del_token(self, token):
 397         try:
 398             self.backend.revoke_token(token)
 399             self.tokens_cache.pop(token, None)
 400             return "token '{}' deleted".format(token)
 401         except KeyError:
 402             raise AuthException("Token '{}' not found".format(token), http_code=HTTPStatus.NOT_FOUND)
 403
 404     def check_permissions(self, token_info, method, role_permission=None, query_string_operations=None):
 405         """
 406         Checks that operation has permissions to be done, base on the assigned roles to this user project
 407         :param token_info: Dictionary that contains "roles" with a list of assigned roles.
 408             This method fills the token_info["admin"] with True or False based on assigned tokens, if any allows admin
 409             This will be used among others to hide or not the _admin content of topics
 410         :param method: GET,PUT, POST, ...
 411         :param role_permission: role permission name of the operation required
 412         :param query_string_operations: list of possible admin query strings provided by user. It is checked that the
 413             assigned role allows this query string for this method
 414         :return: None if granted, exception if not allowed
 415         """
 416
 417         roles_required = self.operation_to_allowed_roles[role_permission]
 418         roles_allowed = [role["name"] for role in token_info["roles"]]
 419
 420         # fills token_info["admin"] if some roles allows it
 421         token_info["admin"] = False
 422         for role in roles_allowed:
 423             if role in self.operation_to_allowed_roles["admin:" + method.lower()]:
 424                 token_info["admin"] = True
 425                 break
 426
 427         if "anonymous" in roles_required:
 428             return
 429         operation_allowed = False
 430         for role in roles_allowed:
 431             if role in roles_required:
 432                 operation_allowed = True
 433                 # if query_string operations, check if this role allows it
 434                 if not query_string_operations:
 435                     return
 436                 for query_string_operation in query_string_operations:
 437                     if role not in self.operation_to_allowed_roles[query_string_operation]:
 438                         break
 439                 else:
 440                     return
 441
 442         if not operation_allowed:
 443             raise AuthExceptionUnauthorized("Access denied: lack of permissions.")
 444         else:
 445             raise AuthExceptionUnauthorized("Access denied: You have not permissions to use these admin query string")
 446
 447     def get_user_list(self):
 448         return self.backend.get_user_list()
 449
 450     def _normalize_url(self, url, method):
 451         # DEPRECATED !!!
 452         # Removing query strings
 453         normalized_url = url if '?' not in url else url[:url.find("?")]
 454         normalized_url_splitted = normalized_url.split("/")
 455         parameters = {}
 456
 457         filtered_keys = [key for key in self.resources_to_operations_mapping.keys()
 458                          if method in key.split()[0]]
 459
 460         for idx, path_part in enumerate(normalized_url_splitted):
 461             tmp_keys = []
 462             for tmp_key in filtered_keys:
 463                 splitted = tmp_key.split()[1].split("/")
 464                 if idx >= len(splitted):
 465                     continue
 466                 elif "<" in splitted[idx] and ">" in splitted[idx]:
 467                     if splitted[idx] == "<artifactPath>":
 468                         tmp_keys.append(tmp_key)
 469                         continue
 470                     elif idx == len(normalized_url_splitted) - 1 and \
 471                             len(normalized_url_splitted) != len(splitted):
 472                         continue
 473                     else:
 474                         tmp_keys.append(tmp_key)
 475                 elif splitted[idx] == path_part:
 476                     if idx == len(normalized_url_splitted) - 1 and \
 477                             len(normalized_url_splitted) != len(splitted):
 478                         continue
 479                     else:
 480                         tmp_keys.append(tmp_key)
 481             filtered_keys = tmp_keys
 482             if len(filtered_keys) == 1 and \
 483                     filtered_keys[0].split("/")[-1] == "<artifactPath>":
 484                 break
 485
 486         if len(filtered_keys) == 0:
 487             raise AuthException("Cannot make an authorization decision. URL not found. URL: {0}".format(url))
 488         elif len(filtered_keys) > 1:
 489             raise AuthException("Cannot make an authorization decision. Multiple URLs found. URL: {0}".format(url))
 490
 491         filtered_key = filtered_keys[0]
 492
 493         for idx, path_part in enumerate(filtered_key.split()[1].split("/")):
 494             if "<" in path_part and ">" in path_part:
 495                 if path_part == "<artifactPath>":
 496                     parameters[path_part[1:-1]] = "/".join(normalized_url_splitted[idx:])
 497                 else:
 498                     parameters[path_part[1:-1]] = normalized_url_splitted[idx]
 499
 500         return filtered_key, parameters
 501
 502     def _internal_get_token_list(self, token_info):
 503         now = time()
 504         token_list = self.db.get_list("tokens", {"username": token_info["username"], "expires.gt": now})
 505         return token_list
 506
 507     def _internal_get_token(self, token_info, token_id):
 508         token_value = self.db.get_one("tokens", {"_id": token_id}, fail_on_empty=False)
 509         if not token_value:
 510             raise AuthException("token not found", http_code=HTTPStatus.NOT_FOUND)
 511         if token_value["username"] != token_info["username"] and not token_info["admin"]:
 512             raise AuthException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
 513         return token_value
 514
 515     def _internal_tokens_prune(self, now=None):
 516         now = now or time()
 517         if not self.next_db_prune_time or self.next_db_prune_time >= now:
 518             self.db.del_list("tokens", {"expires.lt": now})
 519             self.next_db_prune_time = self.periodin_db_pruning + now
 520             self.tokens_cache.clear()  # force to reload tokens from database