+ if self.config["authentication"]["backend"] == "internal":
+ return self.engine.new_token(session, indata, remote)
+ else:
+ if indata.get("username"):
+ token, projects = self.backend.authenticate_with_user_password(
+ indata.get("username"), indata.get("password"))
+ elif session:
+ token, projects = self.backend.authenticate_with_token(
+ session.get("id"), indata.get("project_id"))
+ else:
+ raise AuthException("Provide credentials: username/password or Authorization Bearer token",
+ http_code=HTTPStatus.UNAUTHORIZED)
+
+ if indata.get("project_id"):
+ project_id = indata.get("project_id")
+ if project_id not in projects:
+ raise AuthException("Project {} not allowed for this user".format(project_id),
+ http_code=HTTPStatus.UNAUTHORIZED)
+ else:
+ project_id = projects[0]
+
+ if project_id == "admin":
+ session_admin = True
+ else:
+ session_admin = reduce(lambda x, y: x or (True if y == "admin" else False),
+ projects, False)
+
+ now = time()
+ new_session = {
+ "_id": token,
+ "id": token,
+ "issued_at": now,
+ "expires": now+3600,
+ "project_id": project_id,
+ "username": indata.get("username") if not session else session.get("username"),
+ "remote_port": remote.port,
+ "admin": session_admin
+ }
+
+ if remote.name:
+ new_session["remote_host"] = remote.name
+ elif remote.ip:
+ new_session["remote_host"] = remote.ip
+
+ self.tokens[token] = new_session
+
+ return deepcopy(new_session)