[6669] | 1 | ## $Id: authentication.py 13394 2015-11-06 05:43:37Z henrik $ |
---|
| 2 | ## |
---|
[7190] | 3 | ## Copyright (C) 2011 Uli Fouquet & Henrik Bettermann |
---|
[6669] | 4 | ## This program is free software; you can redistribute it and/or modify |
---|
| 5 | ## it under the terms of the GNU General Public License as published by |
---|
| 6 | ## the Free Software Foundation; either version 2 of the License, or |
---|
| 7 | ## (at your option) any later version. |
---|
| 8 | ## |
---|
| 9 | ## This program is distributed in the hope that it will be useful, |
---|
| 10 | ## but WITHOUT ANY WARRANTY; without even the implied warranty of |
---|
| 11 | ## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
---|
| 12 | ## GNU General Public License for more details. |
---|
| 13 | ## |
---|
| 14 | ## You should have received a copy of the GNU General Public License |
---|
| 15 | ## along with this program; if not, write to the Free Software |
---|
| 16 | ## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
---|
| 17 | ## |
---|
| 18 | """ |
---|
| 19 | Authenticate students. |
---|
| 20 | """ |
---|
| 21 | import grok |
---|
[10055] | 22 | import time |
---|
[6669] | 23 | from zope.component import getUtility |
---|
| 24 | from zope.password.interfaces import IPasswordManager |
---|
[6756] | 25 | from zope.pluggableauth.interfaces import ( |
---|
| 26 | IAuthenticatorPlugin, ICredentialsPlugin) |
---|
| 27 | from zope.pluggableauth.plugins.session import ( |
---|
| 28 | SessionCredentialsPlugin, SessionCredentials) |
---|
| 29 | from zope.publisher.interfaces.http import IHTTPRequest |
---|
| 30 | from zope.session.interfaces import ISession |
---|
[7811] | 31 | from waeup.kofa.authentication import ( |
---|
[10055] | 32 | KofaPrincipalInfo, get_principal_role_manager, FailedLoginInfo) |
---|
[7811] | 33 | from waeup.kofa.interfaces import ( |
---|
[7147] | 34 | IAuthPluginUtility, IUserAccount, IPasswordValidator) |
---|
[7811] | 35 | from waeup.kofa.students.interfaces import IStudent |
---|
[6669] | 36 | |
---|
| 37 | class StudentAccount(grok.Adapter): |
---|
| 38 | """An adapter to turn student objects into accounts on-the-fly. |
---|
| 39 | """ |
---|
| 40 | grok.context(IStudent) |
---|
| 41 | grok.implements(IUserAccount) |
---|
| 42 | |
---|
[8756] | 43 | public_name = None |
---|
| 44 | |
---|
[6669] | 45 | @property |
---|
| 46 | def name(self): |
---|
| 47 | return self.context.student_id |
---|
| 48 | |
---|
| 49 | @property |
---|
| 50 | def password(self): |
---|
| 51 | return getattr(self.context, 'password', None) |
---|
| 52 | |
---|
| 53 | @property |
---|
| 54 | def title(self): |
---|
[7364] | 55 | return self.context.display_fullname |
---|
[6669] | 56 | |
---|
| 57 | @property |
---|
[7221] | 58 | def email(self): |
---|
| 59 | return self.context.email |
---|
| 60 | |
---|
| 61 | @property |
---|
[7233] | 62 | def phone(self): |
---|
| 63 | return self.context.phone |
---|
| 64 | |
---|
| 65 | @property |
---|
[7240] | 66 | def user_type(self): |
---|
| 67 | return u'student' |
---|
| 68 | |
---|
| 69 | @property |
---|
[6669] | 70 | def description(self): |
---|
| 71 | return self.title |
---|
| 72 | |
---|
[12926] | 73 | def suspended(self): |
---|
| 74 | return self.context.suspended |
---|
| 75 | |
---|
[10055] | 76 | @property |
---|
| 77 | def failed_logins(self): |
---|
| 78 | if not hasattr(self.context, 'failed_logins'): |
---|
| 79 | self.context.failed_logins = FailedLoginInfo() |
---|
| 80 | return self.context.failed_logins |
---|
| 81 | |
---|
[6680] | 82 | def _get_roles(self): |
---|
| 83 | prm = get_principal_role_manager() |
---|
| 84 | roles = [x[0] for x in prm.getRolesForPrincipal(self.name) |
---|
| 85 | if x[0].startswith('waeup.')] |
---|
| 86 | return roles |
---|
[6669] | 87 | |
---|
[6680] | 88 | def _set_roles(self, roles): |
---|
| 89 | """Set roles for principal denoted by this account. |
---|
| 90 | """ |
---|
| 91 | prm = get_principal_role_manager() |
---|
| 92 | old_roles = self.roles |
---|
| 93 | for role in old_roles: |
---|
| 94 | # Remove old roles, not to be set now... |
---|
| 95 | if role.startswith('waeup.') and role not in roles: |
---|
| 96 | prm.unsetRoleForPrincipal(role, self.name) |
---|
| 97 | for role in roles: |
---|
| 98 | prm.assignRoleToPrincipal(role, self.name) |
---|
| 99 | return |
---|
| 100 | |
---|
| 101 | roles = property(_get_roles, _set_roles) |
---|
| 102 | |
---|
[6669] | 103 | def setPassword(self, password): |
---|
| 104 | """Set a password (LDAP-compatible) SSHA encoded. |
---|
| 105 | |
---|
[6680] | 106 | We do not store passwords in plaintext. Encrypted password is |
---|
| 107 | stored as unicode string. |
---|
[6669] | 108 | """ |
---|
| 109 | passwordmanager = getUtility(IPasswordManager, 'SSHA') |
---|
[8350] | 110 | self.context.password = passwordmanager.encodePassword(password) |
---|
[6669] | 111 | |
---|
| 112 | def checkPassword(self, password): |
---|
[9334] | 113 | """Check whether the given `password` matches the one stored by |
---|
| 114 | students or the temporary password set by officers. |
---|
[13394] | 115 | We additionally check if student account has been suspended |
---|
| 116 | or if the portal is blocked. |
---|
[6669] | 117 | """ |
---|
[13394] | 118 | try: |
---|
| 119 | blocker = grok.getSite()['configuration'].maintmode_enabled_by |
---|
| 120 | if blocker: |
---|
| 121 | return False |
---|
| 122 | except TypeError: # in unit tests |
---|
| 123 | pass |
---|
[6669] | 124 | if not isinstance(password, basestring): |
---|
| 125 | return False |
---|
[9334] | 126 | passwordmanager = getUtility(IPasswordManager, 'SSHA') |
---|
| 127 | temp_password = self.context.getTempPassword() |
---|
| 128 | if temp_password: |
---|
| 129 | return passwordmanager.checkPassword(temp_password, password) |
---|
[7139] | 130 | if not getattr(self.context, 'password', None): |
---|
| 131 | # unset/empty passwords do never match |
---|
| 132 | return False |
---|
[8983] | 133 | if self.context.suspended == True: |
---|
| 134 | return False |
---|
[9334] | 135 | return passwordmanager.checkPassword(self.context.password, password) |
---|
[6669] | 136 | |
---|
| 137 | class StudentsAuthenticatorPlugin(grok.GlobalUtility): |
---|
| 138 | grok.implements(IAuthenticatorPlugin) |
---|
| 139 | grok.provides(IAuthenticatorPlugin) |
---|
| 140 | grok.name('students') |
---|
| 141 | |
---|
| 142 | def authenticateCredentials(self, credentials): |
---|
| 143 | """Authenticate `credentials`. |
---|
| 144 | |
---|
| 145 | `credentials` is a tuple (login, password). |
---|
| 146 | |
---|
| 147 | We look up students to find out whether a respective student |
---|
| 148 | exists, then check the password and return the resulting |
---|
| 149 | `PrincipalInfo` or ``None`` if no such student can be found. |
---|
| 150 | """ |
---|
| 151 | if not isinstance(credentials, dict): |
---|
| 152 | return None |
---|
| 153 | if not ('login' in credentials and 'password' in credentials): |
---|
| 154 | return None |
---|
| 155 | account = self.getAccount(credentials['login']) |
---|
| 156 | if account is None: |
---|
| 157 | return None |
---|
| 158 | if not account.checkPassword(credentials['password']): |
---|
| 159 | return None |
---|
[7819] | 160 | return KofaPrincipalInfo(id=account.name, |
---|
[6669] | 161 | title=account.title, |
---|
[7233] | 162 | description=account.description, |
---|
| 163 | email=account.email, |
---|
[7240] | 164 | phone=account.phone, |
---|
[8757] | 165 | public_name=account.public_name, |
---|
[7240] | 166 | user_type=account.user_type) |
---|
[6669] | 167 | |
---|
| 168 | def principalInfo(self, id): |
---|
| 169 | """Get a principal identified by `id`. |
---|
| 170 | |
---|
[7233] | 171 | This one is required by IAuthenticatorPlugin but not needed here |
---|
| 172 | (see respective docstring in applicants package). |
---|
[6669] | 173 | """ |
---|
[7233] | 174 | return None |
---|
[6669] | 175 | |
---|
| 176 | def getAccount(self, login): |
---|
| 177 | """Look up a student identified by `login`. Returns an account. |
---|
| 178 | |
---|
| 179 | Currently, we simply look up the key under which the student |
---|
| 180 | is stored in the portal. That means we hit if login name and |
---|
| 181 | name under which the student is stored match. |
---|
| 182 | |
---|
| 183 | Returns not a student but an account object adapted from any |
---|
| 184 | student found. |
---|
| 185 | |
---|
| 186 | If no such student exists, ``None`` is returned. |
---|
| 187 | """ |
---|
| 188 | site = grok.getSite() |
---|
| 189 | if site is None: |
---|
| 190 | return None |
---|
| 191 | studentscontainer = site.get('students', None) |
---|
| 192 | if studentscontainer is None: |
---|
| 193 | return None |
---|
| 194 | student = studentscontainer.get(login, None) |
---|
| 195 | if student is None: |
---|
| 196 | return None |
---|
| 197 | return IUserAccount(student) |
---|
| 198 | |
---|
[6756] | 199 | class PasswordChangeCredentialsPlugin(grok.GlobalUtility, |
---|
| 200 | SessionCredentialsPlugin): |
---|
| 201 | """A session credentials plugin that handles the case of a user |
---|
[7592] | 202 | changing his/her own password. |
---|
[6756] | 203 | |
---|
| 204 | When users change their own password they might find themselves |
---|
| 205 | logged out on next request. |
---|
| 206 | |
---|
| 207 | To avoid this, we support to use a 'change password' page a bit |
---|
| 208 | like a regular login page. That means, on each request we lookup |
---|
| 209 | the sent data for a login field called 'student_id' and a |
---|
| 210 | password. |
---|
| 211 | |
---|
| 212 | If both exist, this means someone sent new credentials. |
---|
| 213 | |
---|
| 214 | We then look for the old credentials stored in the user session. |
---|
| 215 | If the new credentials' login (the student_id) matches the old |
---|
| 216 | one's, we set the new credentials in session _but_ we return the |
---|
| 217 | old credentials for the authentication plugins to check as for the |
---|
| 218 | current request (and for the last time) the old credentials apply. |
---|
| 219 | |
---|
| 220 | No valid credentials are returned by this plugin if one of the |
---|
| 221 | follwing circumstances is true |
---|
| 222 | |
---|
| 223 | - the sent request is not a regular IHTTPRequest |
---|
| 224 | |
---|
| 225 | - the credentials to set do not match the old ones |
---|
| 226 | |
---|
| 227 | - no credentials are sent with the request |
---|
| 228 | |
---|
| 229 | - no credentials were set before (i.e. the user has no session |
---|
| 230 | with credentials set before) |
---|
| 231 | |
---|
[6768] | 232 | - no session exists already |
---|
| 233 | |
---|
| 234 | - password and repeated password do not match |
---|
| 235 | |
---|
[6756] | 236 | Therefore it is mandatory to put this plugin in the line of all |
---|
| 237 | credentials plugins _before_ other plugins, so that the regular |
---|
| 238 | credentials plugins can drop in as a 'fallback'. |
---|
| 239 | |
---|
| 240 | This plugin was designed for students to change their passwords, |
---|
| 241 | but might be used to allow password resets for other types of |
---|
| 242 | accounts as well. |
---|
| 243 | """ |
---|
| 244 | grok.provides(ICredentialsPlugin) |
---|
| 245 | grok.name('student_pw_change') |
---|
| 246 | |
---|
| 247 | loginpagename = 'login' |
---|
| 248 | loginfield = 'student_id' |
---|
[7144] | 249 | passwordfield = 'change_password' |
---|
| 250 | repeatfield = 'change_password_repeat' |
---|
[6756] | 251 | |
---|
| 252 | def extractCredentials(self, request): |
---|
| 253 | if not IHTTPRequest.providedBy(request): |
---|
| 254 | return None |
---|
| 255 | login = request.get(self.loginfield, None) |
---|
| 256 | password = request.get(self.passwordfield, None) |
---|
[6768] | 257 | password_repeat = request.get(self.repeatfield, None) |
---|
| 258 | |
---|
[6756] | 259 | if not login or not password: |
---|
| 260 | return None |
---|
[6768] | 261 | |
---|
[7147] | 262 | validator = getUtility(IPasswordValidator) |
---|
| 263 | errors = validator.validate_password(password, password_repeat) |
---|
| 264 | if errors: |
---|
[6768] | 265 | return None |
---|
| 266 | |
---|
[6756] | 267 | session = ISession(request) |
---|
| 268 | sessionData = session.get( |
---|
| 269 | 'zope.pluggableauth.browserplugins') |
---|
[6768] | 270 | if not sessionData: |
---|
| 271 | return None |
---|
| 272 | |
---|
[6756] | 273 | old_credentials = sessionData.get('credentials', None) |
---|
| 274 | if old_credentials is None: |
---|
| 275 | # Password changes for already authenticated users only! |
---|
| 276 | return None |
---|
| 277 | if old_credentials.getLogin() != login: |
---|
| 278 | # Special treatment only for users that change their own pw. |
---|
| 279 | return None |
---|
| 280 | old_credentials = { |
---|
| 281 | 'login': old_credentials.getLogin(), |
---|
| 282 | 'password': old_credentials.getPassword()} |
---|
| 283 | |
---|
| 284 | # Set new credentials in session. These will be active on next request |
---|
| 285 | new_credentials = SessionCredentials(login, password) |
---|
| 286 | sessionData['credentials'] = new_credentials |
---|
| 287 | |
---|
| 288 | # Return old credentials for this one request only |
---|
| 289 | return old_credentials |
---|
| 290 | |
---|
[6669] | 291 | class StudentsAuthenticatorSetup(grok.GlobalUtility): |
---|
| 292 | """Register or unregister student authentication for a PAU. |
---|
| 293 | |
---|
| 294 | This piece is called when a new site is created. |
---|
| 295 | """ |
---|
| 296 | grok.implements(IAuthPluginUtility) |
---|
[7240] | 297 | grok.name('students_auth_setup') |
---|
[6669] | 298 | |
---|
| 299 | def register(self, pau): |
---|
[6756] | 300 | plugins = list(pau.credentialsPlugins) |
---|
| 301 | # this plugin must come before the regular credentials plugins |
---|
| 302 | plugins.insert(0, 'student_pw_change') |
---|
| 303 | pau.credentialsPlugins = tuple(plugins) |
---|
[6669] | 304 | plugins = list(pau.authenticatorPlugins) |
---|
| 305 | plugins.append('students') |
---|
| 306 | pau.authenticatorPlugins = tuple(plugins) |
---|
| 307 | return pau |
---|
| 308 | |
---|
| 309 | def unregister(self, pau): |
---|
| 310 | plugins = [x for x in pau.authenticatorPlugins |
---|
| 311 | if x != 'students'] |
---|
| 312 | pau.authenticatorPlugins = tuple(plugins) |
---|
| 313 | return pau |
---|