1 # -*- coding: utf-8 -*-
3 # Copyright 2018 Whitestack, LLC
4 # Copyright 2018 Telefonica S.A.
6 # Licensed under the Apache License, Version 2.0 (the "License"); you may
7 # not use this file except in compliance with the License. You may obtain
8 # a copy of the License at
10 # http://www.apache.org/licenses/LICENSE-2.0
12 # Unless required by applicable law or agreed to in writing, software
13 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
14 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
15 # License for the specific language governing permissions and limitations
18 # For those usages not covered by the Apache License, Version 2.0 please
19 # contact: esousa@whitestack.com or alfonso.tiernosepulveda@telefonica.com
24 Authenticator is responsible for authenticating the users,
25 create the tokens unscoped and scoped, retrieve the role
26 list inside the projects that they are inserted
29 __author__
= "Eduardo Sousa <esousa@whitestack.com>; Alfonso Tierno <alfonso.tiernosepulveda@telefonica.com>"
30 __date__
= "$27-jul-2018 23:59:59$"
35 from base64
import standard_b64decode
36 from copy
import deepcopy
37 # from functools import reduce
38 from hashlib
import sha256
39 from http
import HTTPStatus
40 from random
import choice
as random_choice
43 from base_topic
import BaseTopic
# To allow project names in project_id
45 from authconn
import AuthException
46 from authconn_keystone
import AuthconnKeystone
47 from osm_common
import dbmongo
48 from osm_common
import dbmemory
49 from osm_common
.dbbase
import DbException
54 This class should hold all the mechanisms for User Authentication and
55 Authorization. Initially it should support Openstack Keystone as a
56 backend through a plugin model where more backends can be added and a
57 RBAC model to manage permissions on operations.
58 This class must be threading safe
61 periodin_db_pruning
= 60 * 30 # for the internal backend only. every 30 minutes expired tokens will be pruned
65 Authenticator initializer. Setup the initial state of the object,
66 while it waits for the config dictionary and database initialization.
71 self
.tokens_cache
= dict()
72 self
.next_db_prune_time
= 0 # time when next cleaning of expired tokens must be done
73 self
.resources_to_operations_file
= None
74 self
.roles_to_operations_file
= None
75 self
.resources_to_operations_mapping
= {}
76 self
.operation_to_allowed_roles
= {}
77 self
.logger
= logging
.getLogger("nbi.authenticator")
80 def start(self
, config
):
82 Method to configure the Authenticator object. This method should be called
83 after object creation. It is responsible by initializing the selected backend,
84 as well as the initialization of the database connection.
86 :param config: dictionary containing the relevant parameters for this object.
92 if config
["database"]["driver"] == "mongo":
93 self
.db
= dbmongo
.DbMongo()
94 self
.db
.db_connect(config
["database"])
95 elif config
["database"]["driver"] == "memory":
96 self
.db
= dbmemory
.DbMemory()
97 self
.db
.db_connect(config
["database"])
99 raise AuthException("Invalid configuration param '{}' at '[database]':'driver'"
100 .format(config
["database"]["driver"]))
102 if config
["authentication"]["backend"] == "keystone":
103 self
.backend
= AuthconnKeystone(self
.config
["authentication"])
104 elif config
["authentication"]["backend"] == "internal":
105 self
._internal
_tokens
_prune
()
107 raise AuthException("Unknown authentication backend: {}"
108 .format(config
["authentication"]["backend"]))
109 if not self
.resources_to_operations_file
:
110 if "resources_to_operations" in config
["rbac"]:
111 self
.resources_to_operations_file
= config
["rbac"]["resources_to_operations"]
114 __file__
[:__file__
.rfind("auth.py")] + "resources_to_operations.yml",
115 "./resources_to_operations.yml"
117 for config_file
in possible_paths
:
118 if path
.isfile(config_file
):
119 self
.resources_to_operations_file
= config_file
121 if not self
.resources_to_operations_file
:
122 raise AuthException("Invalid permission configuration: resources_to_operations file missing")
123 if not self
.roles_to_operations_file
:
124 if "roles_to_operations" in config
["rbac"]:
125 self
.roles_to_operations_file
= config
["rbac"]["roles_to_operations"]
128 __file__
[:__file__
.rfind("auth.py")] + "roles_to_operations.yml",
129 "./roles_to_operations.yml"
131 for config_file
in possible_paths
:
132 if path
.isfile(config_file
):
133 self
.roles_to_operations_file
= config_file
135 if not self
.roles_to_operations_file
:
136 raise AuthException("Invalid permission configuration: roles_to_operations file missing")
137 except Exception as e
:
138 raise AuthException(str(e
))
143 self
.db
.db_disconnect()
144 except DbException
as e
:
145 raise AuthException(str(e
), http_code
=e
.http_code
)
147 def init_db(self
, target_version
='1.0'):
149 Check if the database has been initialized, with at least one user. If not, create the required tables
150 and insert the predefined mappings between roles and permissions.
152 :param target_version: schema version that should be present in the database.
153 :return: None if OK, exception if error or version is different.
155 # Always reads operation to resource mapping from file (this is static, no need to store it in MongoDB)
156 # Operations encoding: "<METHOD> <URL>"
157 # Note: it is faster to rewrite the value than to check if it is already there or not
158 if self
.config
["authentication"]["backend"] == "internal":
161 with
open(self
.resources_to_operations_file
, "r") as stream
:
162 resources_to_operations_yaml
= yaml
.load(stream
)
164 for resource
, operation
in resources_to_operations_yaml
["resources_to_operations"].items():
165 if operation
not in self
.operations
:
166 self
.operations
.append(operation
)
167 self
.resources_to_operations_mapping
[resource
] = operation
169 records
= self
.db
.get_list("roles_operations")
171 # Loading permissions to MongoDB if there is not any permission.
173 with
open(self
.roles_to_operations_file
, "r") as stream
:
174 roles_to_operations_yaml
= yaml
.load(stream
)
177 for role_with_operations
in roles_to_operations_yaml
["roles"]:
178 # Verifying if role already exists. If it does, raise exception
179 if role_with_operations
["name"] not in role_names
:
180 role_names
.append(role_with_operations
["name"])
182 raise AuthException("Duplicated role name '{}' at file '{}''"
183 .format(role_with_operations
["name"], self
.roles_to_operations_file
))
185 if not role_with_operations
["permissions"]:
188 for permission
, is_allowed
in role_with_operations
["permissions"].items():
189 if not isinstance(is_allowed
, bool):
190 raise AuthException("Invalid value for permission '{}' at role '{}'; at file '{}'"
191 .format(permission
, role_with_operations
["name"],
192 self
.roles_to_operations_file
))
194 # TODO chek permission is ok
195 if permission
[-1] == ":":
196 raise AuthException("Invalid permission '{}' terminated in ':' for role '{}'; at file {}"
197 .format(permission
, role_with_operations
["name"],
198 self
.roles_to_operations_file
))
200 if "default" not in role_with_operations
["permissions"]:
201 role_with_operations
["permissions"]["default"] = False
202 if "admin" not in role_with_operations
["permissions"]:
203 role_with_operations
["permissions"]["admin"] = False
206 role_with_operations
["_admin"] = {
211 if self
.config
["authentication"]["backend"] != "internal" and \
212 role_with_operations
["name"] != "anonymous":
214 backend_roles
= self
.backend
.get_role_list(filter_q
={"name": role_with_operations
["name"]})
217 backend_id
= backend_roles
[0]["_id"]
219 backend_id
= self
.backend
.create_role(role_with_operations
["name"])
220 role_with_operations
["_id"] = backend_id
222 self
.db
.create("roles_operations", role_with_operations
)
224 if self
.config
["authentication"]["backend"] != "internal":
225 self
.backend
.assign_role_to_user("admin", "admin", "system_admin")
227 self
.load_operation_to_allowed_roles()
229 def load_operation_to_allowed_roles(self
):
231 Fills the internal self.operation_to_allowed_roles based on database role content and self.operations
235 permissions
= {oper
: [] for oper
in self
.operations
}
236 records
= self
.db
.get_list("roles_operations")
238 ignore_fields
= ["_id", "_admin", "name", "default", "admin"]
239 for record
in records
:
240 record_permissions
= {oper
: record
["permissions"].get("default", False) for oper
in self
.operations
}
241 operations_joined
= [(oper
, value
) for oper
, value
in record
["permissions"].items()
242 if oper
not in ignore_fields
]
243 operations_joined
.sort(key
=lambda x
: x
[0].count(":"))
245 for oper
in operations_joined
:
246 match
= list(filter(lambda x
: x
.find(oper
[0]) == 0, record_permissions
.keys()))
249 record_permissions
[m
] = oper
[1]
251 allowed_operations
= [k
for k
, v
in record_permissions
.items() if v
is True]
253 for allowed_op
in allowed_operations
:
254 permissions
[allowed_op
].append(record
["name"])
256 for oper
, role_list
in permissions
.items():
257 self
.operation_to_allowed_roles
[oper
] = role_list
263 # 1. Get token Authorization bearer
264 auth
= cherrypy
.request
.headers
.get("Authorization")
266 auth_list
= auth
.split(" ")
267 if auth_list
[0].lower() == "bearer":
268 token
= auth_list
[-1]
269 elif auth_list
[0].lower() == "basic":
270 user_passwd64
= auth_list
[-1]
272 if cherrypy
.session
.get("Authorization"):
273 # 2. Try using session before request a new token. If not, basic authentication will generate
274 token
= cherrypy
.session
.get("Authorization")
275 if token
== "logout":
276 token
= None # force Unauthorized response to insert user password again
277 elif user_passwd64
and cherrypy
.request
.config
.get("auth.allow_basic_authentication"):
278 # 3. Get new token from user password
282 user_passwd
= standard_b64decode(user_passwd64
).decode()
283 user
, _
, passwd
= user_passwd
.partition(":")
286 outdata
= self
.new_token(None, {"username": user
, "password": passwd
})
287 token
= outdata
["id"]
288 cherrypy
.session
['Authorization'] = token
289 if self
.config
["authentication"]["backend"] == "internal":
290 return self
._internal
_authorize
(token
)
293 raise AuthException("Needed a token or Authorization http header",
294 http_code
=HTTPStatus
.UNAUTHORIZED
)
296 self
.backend
.validate_token(token
)
297 self
.check_permissions(self
.tokens_cache
[token
], cherrypy
.request
.path_info
,
298 cherrypy
.request
.method
)
299 # TODO: check if this can be avoided. Backend may provide enough information
300 return deepcopy(self
.tokens_cache
[token
])
301 except AuthException
:
302 self
.del_token(token
)
304 except AuthException
as e
:
305 if cherrypy
.session
.get('Authorization'):
306 del cherrypy
.session
['Authorization']
307 cherrypy
.response
.headers
["WWW-Authenticate"] = 'Bearer realm="{}"'.format(e
)
308 raise AuthException(str(e
))
310 def new_token(self
, session
, indata
, remote
):
311 if self
.config
["authentication"]["backend"] == "internal":
312 return self
._internal
_new
_token
(session
, indata
, remote
)
316 current_token
= session
.get("token")
317 token_info
= self
.backend
.authenticate(
318 user
=indata
.get("username"),
319 password
=indata
.get("username"),
321 project
=indata
.get("project_id")
324 # if indata.get("username"):
325 # token, projects = self.backend.authenticate_with_user_password(
326 # indata.get("username"), indata.get("password"))
328 # token, projects = self.backend.authenticate_with_token(
329 # session.get("id"), indata.get("project_id"))
331 # raise AuthException("Provide credentials: username/password or Authorization Bearer token",
332 # http_code=HTTPStatus.UNAUTHORIZED)
334 # if indata.get("project_id"):
335 # project_id = indata.get("project_id")
336 # if project_id not in projects:
337 # raise AuthException("Project {} not allowed for this user".format(project_id),
338 # http_code=HTTPStatus.UNAUTHORIZED)
340 # project_id = projects[0]
343 # token, projects = self.backend.authenticate_with_token(token, project_id)
345 # if project_id == "admin":
346 # session_admin = True
348 # session_admin = reduce(lambda x, y: x or (True if y == "admin" else False),
353 "_id": token_info
["_id"],
354 "id": token_info
["_id"],
356 "expires": token_info
.get("expires", now
+ 3600),
357 "project_id": token_info
["project_id"],
358 "username": token_info
.get("username") or session
.get("username"),
359 "remote_port": remote
.port
,
360 "admin": True if token_info
.get("project_name") == "admin" else False # TODO put admin in RBAC
364 new_session
["remote_host"] = remote
.name
366 new_session
["remote_host"] = remote
.ip
368 # TODO: check if this can be avoided. Backend may provide enough information
369 self
.tokens_cache
[token_info
["_id"]] = new_session
371 return deepcopy(new_session
)
373 def get_token_list(self
, session
):
374 if self
.config
["authentication"]["backend"] == "internal":
375 return self
._internal
_get
_token
_list
(session
)
377 # TODO: check if this can be avoided. Backend may provide enough information
378 return [deepcopy(token
) for token
in self
.tokens_cache
.values()
379 if token
["username"] == session
["username"]]
381 def get_token(self
, session
, token
):
382 if self
.config
["authentication"]["backend"] == "internal":
383 return self
._internal
_get
_token
(session
, token
)
385 # TODO: check if this can be avoided. Backend may provide enough information
386 token_value
= self
.tokens_cache
.get(token
)
388 raise AuthException("token not found", http_code
=HTTPStatus
.NOT_FOUND
)
389 if token_value
["username"] != session
["username"] and not session
["admin"]:
390 raise AuthException("needed admin privileges", http_code
=HTTPStatus
.UNAUTHORIZED
)
393 def del_token(self
, token
):
394 if self
.config
["authentication"]["backend"] == "internal":
395 return self
._internal
_del
_token
(token
)
398 self
.backend
.revoke_token(token
)
399 del self
.tokens_cache
[token
]
400 return "token '{}' deleted".format(token
)
402 raise AuthException("Token '{}' not found".format(token
), http_code
=HTTPStatus
.NOT_FOUND
)
404 def check_permissions(self
, session
, url
, method
):
405 self
.logger
.info("Session: {}".format(session
))
406 self
.logger
.info("URL: {}".format(url
))
407 self
.logger
.info("Method: {}".format(method
))
409 key
, parameters
= self
._normalize
_url
(url
, method
)
411 # TODO: Check if parameters might be useful for the decision
413 operation
= self
.resources_to_operations_mapping
[key
]
414 roles_required
= self
.operation_to_allowed_roles
[operation
]
415 roles_allowed
= self
.backend
.get_user_role_list(session
["_id"])
417 if "anonymous" in roles_required
:
420 for role
in roles_allowed
:
421 if role
in roles_required
:
424 raise AuthException("Access denied: lack of permissions.")
426 def get_user_list(self
):
427 return self
.backend
.get_user_list()
429 def _normalize_url(self
, url
, method
):
430 # Removing query strings
431 normalized_url
= url
if '?' not in url
else url
[:url
.find("?")]
432 normalized_url_splitted
= normalized_url
.split("/")
435 filtered_keys
= [key
for key
in self
.resources_to_operations_mapping
.keys()
436 if method
in key
.split()[0]]
438 for idx
, path_part
in enumerate(normalized_url_splitted
):
440 for tmp_key
in filtered_keys
:
441 splitted
= tmp_key
.split()[1].split("/")
442 if idx
>= len(splitted
):
444 elif "<" in splitted
[idx
] and ">" in splitted
[idx
]:
445 if splitted
[idx
] == "<artifactPath>":
446 tmp_keys
.append(tmp_key
)
448 elif idx
== len(normalized_url_splitted
) - 1 and \
449 len(normalized_url_splitted
) != len(splitted
):
452 tmp_keys
.append(tmp_key
)
453 elif splitted
[idx
] == path_part
:
454 if idx
== len(normalized_url_splitted
) - 1 and \
455 len(normalized_url_splitted
) != len(splitted
):
458 tmp_keys
.append(tmp_key
)
459 filtered_keys
= tmp_keys
460 if len(filtered_keys
) == 1 and \
461 filtered_keys
[0].split("/")[-1] == "<artifactPath>":
464 if len(filtered_keys
) == 0:
465 raise AuthException("Cannot make an authorization decision. URL not found. URL: {0}".format(url
))
466 elif len(filtered_keys
) > 1:
467 raise AuthException("Cannot make an authorization decision. Multiple URLs found. URL: {0}".format(url
))
469 filtered_key
= filtered_keys
[0]
471 for idx
, path_part
in enumerate(filtered_key
.split()[1].split("/")):
472 if "<" in path_part
and ">" in path_part
:
473 if path_part
== "<artifactPath>":
474 parameters
[path_part
[1:-1]] = "/".join(normalized_url_splitted
[idx
:])
476 parameters
[path_part
[1:-1]] = normalized_url_splitted
[idx
]
478 return filtered_key
, parameters
480 def _internal_authorize(self
, token_id
):
483 raise AuthException("Needed a token or Authorization http header", http_code
=HTTPStatus
.UNAUTHORIZED
)
484 # try to get from cache first
486 session
= self
.tokens_cache
.get(token_id
)
487 if session
and session
["expires"] < now
:
488 # delete token. MUST be done with care, as another thread maybe already delete it. Do not use del
489 self
.tokens_cache
.pop(token_id
, None)
494 # get from database if not in cache
495 session
= self
.db
.get_one("tokens", {"_id": token_id
})
496 if session
["expires"] < now
:
497 raise AuthException("Expired Token or Authorization http header", http_code
=HTTPStatus
.UNAUTHORIZED
)
498 self
.tokens_cache
[token_id
] = session
500 except DbException
as e
:
501 if e
.http_code
== HTTPStatus
.NOT_FOUND
:
502 raise AuthException("Invalid Token or Authorization http header", http_code
=HTTPStatus
.UNAUTHORIZED
)
506 except AuthException
:
507 if self
.config
["global"].get("test.user_not_authorized"):
508 return {"id": "fake-token-id-for-test",
509 "project_id": self
.config
["global"].get("test.project_not_authorized", "admin"),
510 "username": self
.config
["global"]["test.user_not_authorized"], "admin": True}
514 def _internal_new_token(self
, session
, indata
, remote
):
518 # Try using username/password
519 if indata
.get("username"):
520 user_rows
= self
.db
.get_list("users", {"username": indata
.get("username")})
522 user_content
= user_rows
[0]
523 salt
= user_content
["_admin"]["salt"]
524 shadow_password
= sha256(indata
.get("password", "").encode('utf-8') + salt
.encode('utf-8')).hexdigest()
525 if shadow_password
!= user_content
["password"]:
528 raise AuthException("Invalid username/password", http_code
=HTTPStatus
.UNAUTHORIZED
)
530 user_rows
= self
.db
.get_list("users", {"username": session
["username"]})
532 user_content
= user_rows
[0]
534 raise AuthException("Invalid token", http_code
=HTTPStatus
.UNAUTHORIZED
)
536 raise AuthException("Provide credentials: username/password or Authorization Bearer token",
537 http_code
=HTTPStatus
.UNAUTHORIZED
)
539 token_id
= ''.join(random_choice('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789')
540 for _
in range(0, 32))
541 project_id
= indata
.get("project_id")
543 if project_id
!= "admin":
544 # To allow project names in project_id
545 proj
= self
.db
.get_one("projects", {BaseTopic
.id_field("projects", project_id
): project_id
})
546 if proj
["_id"] not in user_content
["projects"] and proj
["name"] not in user_content
["projects"]:
547 raise AuthException("project {} not allowed for this user"
548 .format(project_id
), http_code
=HTTPStatus
.UNAUTHORIZED
)
550 project_id
= user_content
["projects"][0]
551 if project_id
== "admin":
554 # To allow project names in project_id
555 project
= self
.db
.get_one("projects", {BaseTopic
.id_field("projects", project_id
): project_id
})
556 session_admin
= project
.get("admin", False)
557 new_session
= {"issued_at": now
, "expires": now
+ 3600,
558 "_id": token_id
, "id": token_id
, "project_id": project_id
, "username": user_content
["username"],
559 "remote_port": remote
.port
, "admin": session_admin
}
561 new_session
["remote_host"] = remote
.name
563 new_session
["remote_host"] = remote
.ip
565 self
.tokens_cache
[token_id
] = new_session
566 self
.db
.create("tokens", new_session
)
567 # check if database must be prune
568 self
._internal
_tokens
_prune
(now
)
569 return deepcopy(new_session
)
571 def _internal_get_token_list(self
, session
):
573 token_list
= self
.db
.get_list("tokens", {"username": session
["username"], "expires.gt": now
})
576 def _internal_get_token(self
, session
, token_id
):
577 token_value
= self
.db
.get_one("tokens", {"_id": token_id
}, fail_on_empty
=False)
579 raise AuthException("token not found", http_code
=HTTPStatus
.NOT_FOUND
)
580 if token_value
["username"] != session
["username"] and not session
["admin"]:
581 raise AuthException("needed admin privileges", http_code
=HTTPStatus
.UNAUTHORIZED
)
584 def _internal_del_token(self
, token_id
):
586 self
.tokens_cache
.pop(token_id
, None)
587 self
.db
.del_one("tokens", {"_id": token_id
})
588 return "token '{}' deleted".format(token_id
)
589 except DbException
as e
:
590 if e
.http_code
== HTTPStatus
.NOT_FOUND
:
591 raise AuthException("Token '{}' not found".format(token_id
), http_code
=HTTPStatus
.NOT_FOUND
)
595 def _internal_tokens_prune(self
, now
=None):
597 if not self
.next_db_prune_time
or self
.next_db_prune_time
>= now
:
598 self
.db
.del_list("tokens", {"expires.lt": now
})
599 self
.next_db_prune_time
= self
.periodin_db_pruning
+ now
600 self
.tokens_cache
.clear() # force to reload tokens from database