osm_nbi/auth.py

   1 # -*- coding: utf-8 -*-
   2
   3 # Copyright 2018 Whitestack, LLC
   4 # Copyright 2018 Telefonica S.A.
   5 #
   6 # Licensed under the Apache License, Version 2.0 (the "License"); you may
   7 # not use this file except in compliance with the License. You may obtain
   8 # a copy of the License at
   9 #
  10 #         http://www.apache.org/licenses/LICENSE-2.0
  11 #
  12 # Unless required by applicable law or agreed to in writing, software
  13 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  14 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  15 # License for the specific language governing permissions and limitations
  16 # under the License.
  17 #
  18 # For those usages not covered by the Apache License, Version 2.0 please
  19 # contact: esousa@whitestack.com or alfonso.tiernosepulveda@telefonica.com
  20 ##
  21
  22
  23 """
  24 Authenticator is responsible for authenticating the users,
  25 create the tokens unscoped and scoped, retrieve the role
  26 list inside the projects that they are inserted
  27 """
  28
  29 __author__ = "Eduardo Sousa <esousa@whitestack.com>; Alfonso Tierno <alfonso.tiernosepulveda@telefonica.com>"
  30 __date__ = "$27-jul-2018 23:59:59$"
  31
  32 import cherrypy
  33 import logging
  34 import yaml
  35 from base64 import standard_b64decode
  36 from copy import deepcopy
  37 # from functools import reduce
  38 from http import HTTPStatus
  39 from time import time
  40 from os import path
  41
  42 from authconn import AuthException, AuthExceptionUnauthorized
  43 from authconn_keystone import AuthconnKeystone
  44 from authconn_internal import AuthconnInternal   # Comment out for testing&debugging, uncomment when ready
  45 from osm_common import dbmongo
  46 from osm_common import dbmemory
  47 from osm_common.dbbase import DbException
  48 from itertools import chain
  49
  50 from uuid import uuid4
  51
  52
  53 class Authenticator:
  54     """
  55     This class should hold all the mechanisms for User Authentication and
  56     Authorization. Initially it should support Openstack Keystone as a
  57     backend through a plugin model where more backends can be added and a
  58     RBAC model to manage permissions on operations.
  59     This class must be threading safe
  60     """
  61
  62     periodin_db_pruning = 60 * 30  # for the internal backend only. every 30 minutes expired tokens will be pruned
  63
  64     def __init__(self, valid_methods, valid_query_string):
  65         """
  66         Authenticator initializer. Setup the initial state of the object,
  67         while it waits for the config dictionary and database initialization.
  68         """
  69         self.backend = None
  70         self.config = None
  71         self.db = None
  72         self.tokens_cache = dict()
  73         self.next_db_prune_time = 0  # time when next cleaning of expired tokens must be done
  74         self.roles_to_operations_file = None
  75         # self.roles_to_operations_table = None
  76         self.resources_to_operations_mapping = {}
  77         self.operation_to_allowed_roles = {}
  78         self.logger = logging.getLogger("nbi.authenticator")
  79         self.role_permissions = []
  80         self.valid_methods = valid_methods
  81         self.valid_query_string = valid_query_string
  82
  83     def start(self, config):
  84         """
  85         Method to configure the Authenticator object. This method should be called
  86         after object creation. It is responsible by initializing the selected backend,
  87         as well as the initialization of the database connection.
  88
  89         :param config: dictionary containing the relevant parameters for this object.
  90         """
  91         self.config = config
  92
  93         try:
  94             if not self.db:
  95                 if config["database"]["driver"] == "mongo":
  96                     self.db = dbmongo.DbMongo()
  97                     self.db.db_connect(config["database"])
  98                 elif config["database"]["driver"] == "memory":
  99                     self.db = dbmemory.DbMemory()
 100                     self.db.db_connect(config["database"])
 101                 else:
 102                     raise AuthException("Invalid configuration param '{}' at '[database]':'driver'"
 103                                         .format(config["database"]["driver"]))
 104             if not self.backend:
 105                 if config["authentication"]["backend"] == "keystone":
 106                     self.backend = AuthconnKeystone(self.config["authentication"], self.db, self.tokens_cache)
 107                 elif config["authentication"]["backend"] == "internal":
 108                     self.backend = AuthconnInternal(self.config["authentication"], self.db, self.tokens_cache)
 109                     self._internal_tokens_prune()
 110                 else:
 111                     raise AuthException("Unknown authentication backend: {}"
 112                                         .format(config["authentication"]["backend"]))
 113
 114             if not self.roles_to_operations_file:
 115                 if "roles_to_operations" in config["rbac"]:
 116                     self.roles_to_operations_file = config["rbac"]["roles_to_operations"]
 117                 else:
 118                     possible_paths = (
 119                         __file__[:__file__.rfind("auth.py")] + "roles_to_operations.yml",
 120                         "./roles_to_operations.yml"
 121                     )
 122                     for config_file in possible_paths:
 123                         if path.isfile(config_file):
 124                             self.roles_to_operations_file = config_file
 125                             break
 126                 if not self.roles_to_operations_file:
 127                     raise AuthException("Invalid permission configuration: roles_to_operations file missing")
 128
 129             # load role_permissions
 130             def load_role_permissions(method_dict):
 131                 for k in method_dict:
 132                     if k == "ROLE_PERMISSION":
 133                         for method in chain(method_dict.get("METHODS", ()), method_dict.get("TODO", ())):
 134                             permission = method_dict["ROLE_PERMISSION"] + method.lower()
 135                             if permission not in self.role_permissions:
 136                                 self.role_permissions.append(permission)
 137                     elif k in ("TODO", "METHODS"):
 138                         continue
 139                     else:
 140                         load_role_permissions(method_dict[k])
 141
 142             load_role_permissions(self.valid_methods)
 143             for query_string in self.valid_query_string:
 144                 for method in ("get", "put", "patch", "post", "delete"):
 145                     permission = query_string.lower() + ":" + method
 146                     if permission not in self.role_permissions:
 147                         self.role_permissions.append(permission)
 148
 149         except Exception as e:
 150             raise AuthException(str(e))
 151
 152     def stop(self):
 153         try:
 154             if self.db:
 155                 self.db.db_disconnect()
 156         except DbException as e:
 157             raise AuthException(str(e), http_code=e.http_code)
 158
 159     def create_admin_project(self):
 160         """
 161         Creates a new project 'admin' into database if it doesn't exist. Useful for initialization.
 162         :return: _id identity of the 'admin' project
 163         """
 164
 165         # projects = self.db.get_one("projects", fail_on_empty=False, fail_on_more=False)
 166         project_desc = {"name": "admin"}
 167         projects = self.backend.get_project_list(project_desc)
 168         if projects:
 169             return projects[0]["_id"]
 170         now = time()
 171         project_desc["_id"] = str(uuid4())
 172         project_desc["_admin"] = {"created": now, "modified": now}
 173         pid = self.backend.create_project(project_desc)
 174         self.logger.info("Project '{}' created at database".format(project_desc["name"]))
 175         return pid
 176
 177     def create_admin_user(self, project_id):
 178         """
 179         Creates a new user admin/admin into database if database is empty. Useful for initialization
 180         :return: _id identity of the inserted data, or None
 181         """
 182         # users = self.db.get_one("users", fail_on_empty=False, fail_on_more=False)
 183         users = self.backend.get_user_list()
 184         if users:
 185             return None
 186         # user_desc = {"username": "admin", "password": "admin", "projects": [project_id]}
 187         now = time()
 188         user_desc = {"username": "admin", "password": "admin", "_admin": {"created": now, "modified": now}}
 189         if project_id:
 190             pid = project_id
 191         else:
 192             # proj = self.db.get_one("projects", {"name": "admin"}, fail_on_empty=False, fail_on_more=False)
 193             proj = self.backend.get_project_list({"name": "admin"})
 194             pid = proj[0]["_id"] if proj else None
 195         # role = self.db.get_one("roles", {"name": "system_admin"}, fail_on_empty=False, fail_on_more=False)
 196         roles = self.backend.get_role_list({"name": "system_admin"})
 197         if pid and roles:
 198             user_desc["project_role_mappings"] = [{"project": pid, "role": roles[0]["_id"]}]
 199         uid = self.backend.create_user(user_desc)
 200         self.logger.info("User '{}' created at database".format(user_desc["username"]))
 201         return uid
 202
 203     def init_db(self, target_version='1.0'):
 204         """
 205         Check if the database has been initialized, with at least one user. If not, create the required tables
 206         and insert the predefined mappings between roles and permissions.
 207
 208         :param target_version: schema version that should be present in the database.
 209         :return: None if OK, exception if error or version is different.
 210         """
 211
 212         records = self.backend.get_role_list()
 213
 214         # Loading permissions to MongoDB if there is not any permission.
 215         if not records or (len(records) == 1 and records[0]["name"] == "admin"):
 216             with open(self.roles_to_operations_file, "r") as stream:
 217                 roles_to_operations_yaml = yaml.load(stream)
 218
 219             role_names = []
 220             for role_with_operations in roles_to_operations_yaml["roles"]:
 221                 # Verifying if role already exists. If it does, raise exception
 222                 if role_with_operations["name"] not in role_names:
 223                     role_names.append(role_with_operations["name"])
 224                 else:
 225                     raise AuthException("Duplicated role name '{}' at file '{}''"
 226                                         .format(role_with_operations["name"], self.roles_to_operations_file))
 227
 228                 if not role_with_operations["permissions"]:
 229                     continue
 230
 231                 for permission, is_allowed in role_with_operations["permissions"].items():
 232                     if not isinstance(is_allowed, bool):
 233                         raise AuthException("Invalid value for permission '{}' at role '{}'; at file '{}'"
 234                                             .format(permission, role_with_operations["name"],
 235                                                     self.roles_to_operations_file))
 236
 237                     # TODO chek permission is ok
 238                     if permission[-1] == ":":
 239                         raise AuthException("Invalid permission '{}' terminated in ':' for role '{}'; at file {}"
 240                                             .format(permission, role_with_operations["name"],
 241                                                     self.roles_to_operations_file))
 242
 243                 if "default" not in role_with_operations["permissions"]:
 244                     role_with_operations["permissions"]["default"] = False
 245                 if "admin" not in role_with_operations["permissions"]:
 246                     role_with_operations["permissions"]["admin"] = False
 247
 248                 now = time()
 249                 role_with_operations["_admin"] = {
 250                     "created": now,
 251                     "modified": now,
 252                 }
 253
 254                 # self.db.create(self.roles_to_operations_table, role_with_operations)
 255                 self.backend.create_role(role_with_operations)
 256                 self.logger.info("Role '{}' created at database".format(role_with_operations["name"]))
 257
 258         # Create admin project&user if required
 259         pid = self.create_admin_project()
 260         self.create_admin_user(pid)
 261
 262         # self.backend.update_user({"_id": "admin",
 263         #                           "add_project_role_mappings": {"project": "admin", "role": "system_admin"}})
 264         if self.config["authentication"]["backend"] == "keystone":
 265             try:
 266                 self.backend.assign_role_to_user("admin", "admin", "system_admin")
 267             except Exception:
 268                 pass
 269
 270         self.load_operation_to_allowed_roles()
 271
 272     def load_operation_to_allowed_roles(self):
 273         """
 274         Fills the internal self.operation_to_allowed_roles based on database role content and self.role_permissions
 275         It works in a shadow copy and replace at the end to allow other threads working with the old copy
 276         :return: None
 277         """
 278
 279         permissions = {oper: [] for oper in self.role_permissions}
 280         # records = self.db.get_list(self.roles_to_operations_table)
 281         records = self.backend.get_role_list()
 282
 283         ignore_fields = ["_id", "_admin", "name", "default"]
 284         for record in records:
 285             if not record.get("permissions"):
 286                 continue
 287             record_permissions = {oper: record["permissions"].get("default", False) for oper in self.role_permissions}
 288             operations_joined = [(oper, value) for oper, value in record["permissions"].items()
 289                                  if oper not in ignore_fields]
 290             operations_joined.sort(key=lambda x: x[0].count(":"))
 291
 292             for oper in operations_joined:
 293                 match = list(filter(lambda x: x.find(oper[0]) == 0, record_permissions.keys()))
 294
 295                 for m in match:
 296                     record_permissions[m] = oper[1]
 297
 298             allowed_operations = [k for k, v in record_permissions.items() if v is True]
 299
 300             for allowed_op in allowed_operations:
 301                 permissions[allowed_op].append(record["name"])
 302
 303         self.operation_to_allowed_roles = permissions
 304
 305     def authorize(self, role_permission=None, query_string_operations=None):
 306         token = None
 307         user_passwd64 = None
 308         try:
 309             # 1. Get token Authorization bearer
 310             auth = cherrypy.request.headers.get("Authorization")
 311             if auth:
 312                 auth_list = auth.split(" ")
 313                 if auth_list[0].lower() == "bearer":
 314                     token = auth_list[-1]
 315                 elif auth_list[0].lower() == "basic":
 316                     user_passwd64 = auth_list[-1]
 317             if not token:
 318                 if cherrypy.session.get("Authorization"):
 319                     # 2. Try using session before request a new token. If not, basic authentication will generate
 320                     token = cherrypy.session.get("Authorization")
 321                     if token == "logout":
 322                         token = None  # force Unauthorized response to insert user password again
 323                 elif user_passwd64 and cherrypy.request.config.get("auth.allow_basic_authentication"):
 324                     # 3. Get new token from user password
 325                     user = None
 326                     passwd = None
 327                     try:
 328                         user_passwd = standard_b64decode(user_passwd64).decode()
 329                         user, _, passwd = user_passwd.partition(":")
 330                     except Exception:
 331                         pass
 332                     outdata = self.new_token(None, {"username": user, "password": passwd})
 333                     token = outdata["_id"]
 334                     cherrypy.session['Authorization'] = token
 335
 336             if not token:
 337                 raise AuthException("Needed a token or Authorization http header",
 338                                     http_code=HTTPStatus.UNAUTHORIZED)
 339             token_info = self.backend.validate_token(token)
 340             # TODO add to token info remote host, port
 341
 342             if role_permission:
 343                 self.check_permissions(token_info, cherrypy.request.method, role_permission,
 344                                        query_string_operations)
 345             return token_info
 346         except AuthException as e:
 347             if not isinstance(e, AuthExceptionUnauthorized):
 348                 if cherrypy.session.get('Authorization'):
 349                     del cherrypy.session['Authorization']
 350                 cherrypy.response.headers["WWW-Authenticate"] = 'Bearer realm="{}"'.format(e)
 351             raise
 352
 353     def new_token(self, token_info, indata, remote):
 354         new_token_info = self.backend.authenticate(
 355             user=indata.get("username"),
 356             password=indata.get("password"),
 357             token_info=token_info,
 358             project=indata.get("project_id")
 359         )
 360
 361         new_token_info["remote_port"] = remote.port
 362         if not new_token_info.get("expires"):
 363             new_token_info["expires"] = time() + 3600
 364         if not new_token_info.get("admin"):
 365             new_token_info["admin"] = True if new_token_info.get("project_name") == "admin" else False
 366             # TODO put admin in RBAC
 367
 368         if remote.name:
 369             new_token_info["remote_host"] = remote.name
 370         elif remote.ip:
 371             new_token_info["remote_host"] = remote.ip
 372
 373         self.tokens_cache[new_token_info["_id"]] = new_token_info
 374
 375         # TODO call self._internal_tokens_prune(now) ?
 376         return deepcopy(new_token_info)
 377
 378     def get_token_list(self, token_info):
 379         if self.config["authentication"]["backend"] == "internal":
 380             return self._internal_get_token_list(token_info)
 381         else:
 382             # TODO: check if this can be avoided. Backend may provide enough information
 383             return [deepcopy(token) for token in self.tokens_cache.values()
 384                     if token["username"] == token_info["username"]]
 385
 386     def get_token(self, token_info, token):
 387         if self.config["authentication"]["backend"] == "internal":
 388             return self._internal_get_token(token_info, token)
 389         else:
 390             # TODO: check if this can be avoided. Backend may provide enough information
 391             token_value = self.tokens_cache.get(token)
 392             if not token_value:
 393                 raise AuthException("token not found", http_code=HTTPStatus.NOT_FOUND)
 394             if token_value["username"] != token_info["username"] and not token_info["admin"]:
 395                 raise AuthException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
 396             return token_value
 397
 398     def del_token(self, token):
 399         try:
 400             self.backend.revoke_token(token)
 401             self.tokens_cache.pop(token, None)
 402             return "token '{}' deleted".format(token)
 403         except KeyError:
 404             raise AuthException("Token '{}' not found".format(token), http_code=HTTPStatus.NOT_FOUND)
 405
 406     def check_permissions(self, token_info, method, role_permission=None, query_string_operations=None):
 407         """
 408         Checks that operation has permissions to be done, base on the assigned roles to this user project
 409         :param token_info: Dictionary that contains "roles" with a list of assigned roles.
 410             This method fills the token_info["admin"] with True or False based on assigned tokens, if any allows admin
 411             This will be used among others to hide or not the _admin content of topics
 412         :param method: GET,PUT, POST, ...
 413         :param role_permission: role permission name of the operation required
 414         :param query_string_operations: list of possible admin query strings provided by user. It is checked that the
 415             assigned role allows this query string for this method
 416         :return: None if granted, exception if not allowed
 417         """
 418
 419         roles_required = self.operation_to_allowed_roles[role_permission]
 420         roles_allowed = [role["name"] for role in token_info["roles"]]
 421
 422         # fills token_info["admin"] if some roles allows it
 423         token_info["admin"] = False
 424         for role in roles_allowed:
 425             if role in self.operation_to_allowed_roles["admin:" + method.lower()]:
 426                 token_info["admin"] = True
 427                 break
 428
 429         if "anonymous" in roles_required:
 430             return
 431         operation_allowed = False
 432         for role in roles_allowed:
 433             if role in roles_required:
 434                 operation_allowed = True
 435                 # if query_string operations, check if this role allows it
 436                 if not query_string_operations:
 437                     return
 438                 for query_string_operation in query_string_operations:
 439                     if role not in self.operation_to_allowed_roles[query_string_operation]:
 440                         break
 441                 else:
 442                     return
 443
 444         if not operation_allowed:
 445             raise AuthExceptionUnauthorized("Access denied: lack of permissions.")
 446         else:
 447             raise AuthExceptionUnauthorized("Access denied: You have not permissions to use these admin query string")
 448
 449     def get_user_list(self):
 450         return self.backend.get_user_list()
 451
 452     def _normalize_url(self, url, method):
 453         # DEPRECATED !!!
 454         # Removing query strings
 455         normalized_url = url if '?' not in url else url[:url.find("?")]
 456         normalized_url_splitted = normalized_url.split("/")
 457         parameters = {}
 458
 459         filtered_keys = [key for key in self.resources_to_operations_mapping.keys()
 460                          if method in key.split()[0]]
 461
 462         for idx, path_part in enumerate(normalized_url_splitted):
 463             tmp_keys = []
 464             for tmp_key in filtered_keys:
 465                 splitted = tmp_key.split()[1].split("/")
 466                 if idx >= len(splitted):
 467                     continue
 468                 elif "<" in splitted[idx] and ">" in splitted[idx]:
 469                     if splitted[idx] == "<artifactPath>":
 470                         tmp_keys.append(tmp_key)
 471                         continue
 472                     elif idx == len(normalized_url_splitted) - 1 and \
 473                             len(normalized_url_splitted) != len(splitted):
 474                         continue
 475                     else:
 476                         tmp_keys.append(tmp_key)
 477                 elif splitted[idx] == path_part:
 478                     if idx == len(normalized_url_splitted) - 1 and \
 479                             len(normalized_url_splitted) != len(splitted):
 480                         continue
 481                     else:
 482                         tmp_keys.append(tmp_key)
 483             filtered_keys = tmp_keys
 484             if len(filtered_keys) == 1 and \
 485                     filtered_keys[0].split("/")[-1] == "<artifactPath>":
 486                 break
 487
 488         if len(filtered_keys) == 0:
 489             raise AuthException("Cannot make an authorization decision. URL not found. URL: {0}".format(url))
 490         elif len(filtered_keys) > 1:
 491             raise AuthException("Cannot make an authorization decision. Multiple URLs found. URL: {0}".format(url))
 492
 493         filtered_key = filtered_keys[0]
 494
 495         for idx, path_part in enumerate(filtered_key.split()[1].split("/")):
 496             if "<" in path_part and ">" in path_part:
 497                 if path_part == "<artifactPath>":
 498                     parameters[path_part[1:-1]] = "/".join(normalized_url_splitted[idx:])
 499                 else:
 500                     parameters[path_part[1:-1]] = normalized_url_splitted[idx]
 501
 502         return filtered_key, parameters
 503
 504     def _internal_get_token_list(self, token_info):
 505         now = time()
 506         token_list = self.db.get_list("tokens", {"username": token_info["username"], "expires.gt": now})
 507         return token_list
 508
 509     def _internal_get_token(self, token_info, token_id):
 510         token_value = self.db.get_one("tokens", {"_id": token_id}, fail_on_empty=False)
 511         if not token_value:
 512             raise AuthException("token not found", http_code=HTTPStatus.NOT_FOUND)
 513         if token_value["username"] != token_info["username"] and not token_info["admin"]:
 514             raise AuthException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
 515         return token_value
 516
 517     def _internal_tokens_prune(self, now=None):
 518         now = now or time()
 519         if not self.next_db_prune_time or self.next_db_prune_time >= now:
 520             self.db.del_list("tokens", {"expires.lt": now})
 521             self.next_db_prune_time = self.periodin_db_pruning + now
 522             self.tokens_cache.clear()  # force to reload tokens from database