mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-23 23:50:03 -06:00
9753fd4230
* Increase the session ID from 48 random bits to 128. * Implement the sesison_logout RPC command. It permits the UI to send a command that destroys the users credentials in the current session. * Restores the original web URL's and their authentication protections. Adds a new URL for sessions /ipa/session/json. Restores the original Kerberos auth which was for /ipa and everything below. New /ipa/session/json URL is treated as an exception and turns all authenticaion off. Similar to how /ipa/ui is handled. * Refactor the RPC handlers in rpcserver.py such that there is one handler per URL, specifically one handler per RPC and AuthMechanism combination. * Reworked how the URL names are used to map a URL to a handler. Previously it only permitted one level in the URL path hierarchy. We now dispatch on more that one URL path component. * Renames the api.Backend.session object to wsgi_dispatch. The use of the name session was historical and is now confusing since we've implemented sessions in a different location than the api.Backend.session object, which is really a WSGI dispatcher, hence the new name wsgi_dispatch. * Bullet-proof the setting of the KRB5CCNAME environment variable. ldap2.connect already sets it via the create_context() call but just in case that's not called or not called early enough (we now have other things besides ldap which need the ccache) we explicitly set it early as soon as we know it. * Rework how we test for credential validity and expiration. The previous code did not work with s4u2proxy because it assumed the existance of a TGT. Now we first try ldap credentials and if we can't find those fallback to the TGT. This logic was moved to the KRB5_CCache object, it's an imperfect location for it but it's the only location that makes sense at the moment given some of the current code limitations. The new methods are KRB5_CCache.valid() and KRB5_CCache.endtime(). * Add two new classes to session.py AuthManager and SessionAuthManager. Their purpose is to emit authication events to interested listeners. At the moment the logout event is the only event, but the framework should support other events as they arise. * Add BuildRequires python-memcached to freeipa.spec.in * Removed the marshaled_dispatch method, it was cruft, no longer referenced. https://fedorahosted.org/freeipa/ticket/2362
145 lines
4.2 KiB
Python
Executable File
145 lines
4.2 KiB
Python
Executable File
#!/usr/bin/python
|
|
|
|
# Authors:
|
|
# Jason Gerard DeRose <jderose@redhat.com>
|
|
#
|
|
# Copyright (C) 2008 Red Hat
|
|
# see file 'COPYING' for use and warranty information
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
"""
|
|
In-tree paste-based test server.
|
|
|
|
This uses the *Python Paste* WSGI server. For more info, see:
|
|
|
|
http://pythonpaste.org/
|
|
|
|
Unfortunately, SSL support is broken under Python 2.6 with paste 1.7.2, see:
|
|
|
|
http://trac.pythonpaste.org/pythonpaste/ticket/314
|
|
"""
|
|
|
|
from os import path, getcwd
|
|
import optparse
|
|
from paste import httpserver
|
|
import paste.gzipper
|
|
from paste.urlmap import URLMap
|
|
from ipalib import api
|
|
|
|
|
|
class KRBCheater(object):
|
|
def __init__(self, app):
|
|
self.app = app
|
|
self.url = app.url
|
|
self.ccname = api.Backend.krb.default_ccname()
|
|
|
|
def __call__(self, environ, start_response):
|
|
environ['KRB5CCNAME'] = self.ccname
|
|
return self.app(environ, start_response)
|
|
|
|
|
|
class WebUIApp(object):
|
|
INDEX_FILE = 'index.html'
|
|
EXTENSION_TO_MIME_MAP = {
|
|
'xhtml': 'text/html',
|
|
'html': 'text/html',
|
|
'js': 'text/javascript',
|
|
'inc': 'text/html',
|
|
'css': 'text/css',
|
|
'png': 'image/png',
|
|
'json': 'text/javascript',
|
|
}
|
|
|
|
def __init__(self):
|
|
self.url = '/ipa/ui'
|
|
|
|
def __call__(self, environ, start_response):
|
|
path_info = environ['PATH_INFO'].lstrip('/')
|
|
if path_info == '':
|
|
path_info = self.INDEX_FILE
|
|
requested_file = path.join(getcwd(), 'install/ui/', path_info)
|
|
extension = requested_file.rsplit('.', 1)[-1]
|
|
|
|
if extension not in self.EXTENSION_TO_MIME_MAP:
|
|
start_response('404 Not Found', [('Content-Type', 'text/plain')])
|
|
return ['NOT FOUND']
|
|
mime_type = self.EXTENSION_TO_MIME_MAP[extension]
|
|
|
|
f = None
|
|
try:
|
|
f = open(requested_file, 'r')
|
|
api.log.info('Request file %s' % requested_file)
|
|
start_response('200 OK', [('Content-Type', mime_type)])
|
|
return [f.read()]
|
|
except IOError:
|
|
start_response('404 Not Found', [('Content-Type', 'text/plain')])
|
|
return ['NOT FOUND']
|
|
finally:
|
|
if f is not None:
|
|
f.close()
|
|
api.log.info('Request done')
|
|
|
|
|
|
if __name__ == '__main__':
|
|
parser = optparse.OptionParser()
|
|
|
|
parser.add_option('--dev',
|
|
help='Run WebUI in development mode (requires FireBug)',
|
|
default=True,
|
|
action='store_false',
|
|
dest='prod',
|
|
)
|
|
parser.add_option('--host',
|
|
help='Listen on address HOST (default 127.0.0.1)',
|
|
default='127.0.0.1',
|
|
)
|
|
parser.add_option('--port',
|
|
help='Listen on PORT (default 8888)',
|
|
default=8888,
|
|
type='int',
|
|
)
|
|
|
|
api.env.in_server = True
|
|
api.env.startup_traceback = True
|
|
(options, args) = api.bootstrap_with_global_options(parser, context='lite')
|
|
api.env._merge(
|
|
lite_port=options.port,
|
|
lite_host=options.host,
|
|
webui_prod=options.prod,
|
|
lite_pem=api.env._join('dot_ipa', 'lite.pem'),
|
|
)
|
|
api.finalize()
|
|
|
|
urlmap = URLMap()
|
|
apps = [
|
|
('IPA', KRBCheater(api.Backend.wsgi_dispatch)),
|
|
('webUI', KRBCheater(WebUIApp())),
|
|
]
|
|
for (name, app) in apps:
|
|
urlmap[app.url] = app
|
|
api.log.info('Mounting %s at %s', name, app.url)
|
|
|
|
if path.isfile(api.env.lite_pem):
|
|
pem = api.env.lite_pem
|
|
else:
|
|
api.log.info('To enable SSL, place PEM file at %r', api.env.lite_pem)
|
|
pem = None
|
|
|
|
httpserver.serve(paste.gzipper.middleware(urlmap),
|
|
host=api.env.lite_host,
|
|
port=api.env.lite_port,
|
|
ssl_pem=pem,
|
|
)
|