291 lines
8.3 KiB
Python
Executable File
291 lines
8.3 KiB
Python
Executable File
# -*-python-*-
|
|
# PythonHeaderParserHandler receiving Simple Global Authentication
|
|
# -----------------------------------------------------------------------
|
|
|
|
from mod_python import apache, Cookie, util
|
|
|
|
import os
|
|
import re
|
|
import sys
|
|
import struct
|
|
import cgi
|
|
import binascii
|
|
import time
|
|
import datetime
|
|
import urllib2
|
|
import anyjson
|
|
import random
|
|
|
|
import ga_config
|
|
|
|
if not ga_config.gac.get('globalauth_server','') and not ga_config.gac.get('fof_sudo_server',''):
|
|
raise Exception('ga_config.gac must contain at least globalauth_server="URL" or fof_sudo_server="URL"')
|
|
|
|
gac = {
|
|
'cookie_name' : 'simple_global_auth',
|
|
'cookie_expire' : 86400*7,
|
|
'cookie_path' : '/',
|
|
'cookie_domain' : '',
|
|
'globalauth_server' : '',
|
|
'cache_dir' : os.path.abspath(os.path.dirname(__file__))+'/cache',
|
|
'cut_email_at' : 0,
|
|
'ga_always_require' : 0,
|
|
'fof_sudo_server' : '',
|
|
'fof_sudo_cookie' : 'fof_sudo_id',
|
|
'gc_probability' : 20,
|
|
}
|
|
|
|
for i in gac:
|
|
if ga_config.gac.get(i, None) is not None:
|
|
gac[i] = ga_config.gac[i]
|
|
|
|
def cachefn(key):
|
|
global gac
|
|
key = re.sub('([^a-zA-Z0-9_\-]+)', lambda x: binascii.hexlify(x.group(1)), key)
|
|
return gac['cache_dir']+'/'+key
|
|
|
|
def cacheclean():
|
|
global gac
|
|
t = time.time()
|
|
for fn in os.listdir(gac['cache_dir']):
|
|
if t > os.stat(gac['cache_dir']+'/'+fn).st_mtime:
|
|
os.unlink(gac['cache_dir']+'/'+fn)
|
|
|
|
def cacheset(key, value, expire = 86400):
|
|
fn = cachefn(key)
|
|
try:
|
|
f = open(fn,'w')
|
|
if not expire:
|
|
expire = 86400
|
|
expire = time.time()+expire
|
|
f.write(value)
|
|
f.close()
|
|
os.chmod(fn, 0600)
|
|
os.utime(fn, (expire, expire))
|
|
except:
|
|
raise
|
|
return 1
|
|
|
|
def cacheget(key):
|
|
fn = cachefn(key)
|
|
try:
|
|
f = open(fn,'r')
|
|
value = f.read()
|
|
f.close()
|
|
if time.time() > os.stat(fn).st_mtime:
|
|
os.unlink(fn)
|
|
return ''
|
|
return value
|
|
except:
|
|
pass
|
|
return ''
|
|
|
|
def cachedel(key):
|
|
fn = cachefn(key)
|
|
try:
|
|
os.unlink(fn)
|
|
except:
|
|
pass
|
|
|
|
wd = { 0 : 'Mon', 1 : 'Tue', 2 : 'Wed', 3 : 'Thu', 4 : 'Fri', 5 : 'Sat', 6 : 'Sun' }
|
|
ms = { 1 : 'Jan', 2 : 'Feb', 3 : 'Mar', 4 : 'Apr', 5 : 'May', 6 : 'Jun', 7 : 'Jul', 8 : 'Aug', 9 : 'Sep', 10 : 'Oct', 11 : 'Nov', 12 : 'Dec' }
|
|
|
|
def setcookie(req, value):
|
|
global gac, wd, ms
|
|
exp = ''
|
|
dom = gac['cookie_domain']
|
|
if not dom:
|
|
dom = req.hostname
|
|
if gac['cookie_expire'] > 0:
|
|
tm = int(time.time()+gac['cookie_expire'])
|
|
tm = datetime.datetime.utcfromtimestamp(tm)
|
|
tm = "%s, %02d-%s-%04d %02d:%02d:%02d GMT" % (wd[tm.weekday()], tm.day, ms[tm.month], tm.year, tm.hour, tm.minute, tm.second);
|
|
exp = '; expires='+tm
|
|
req.headers_out.add('Set-Cookie', "%s=%s; path=%s; domain=%s%s" % (gac['cookie_name'], value, gac['cookie_path'], dom, exp))
|
|
|
|
def http_build_query(params, topkey = ''):
|
|
from urllib import quote
|
|
if len(params) == 0:
|
|
return ""
|
|
result = ""
|
|
if type (params) is dict:
|
|
for key in params.keys():
|
|
newkey = quote (key)
|
|
if topkey != '':
|
|
newkey = topkey + quote('[' + key + ']')
|
|
if type(params[key]) is dict:
|
|
result += http_build_query (params[key], newkey)
|
|
elif type(params[key]) is list:
|
|
i = 0
|
|
for val in params[key]:
|
|
result += newkey + quote('[' + str(i) + ']') + "=" + quote(str(val)) + "&"
|
|
i = i + 1
|
|
elif type(params[key]) is bool:
|
|
result += newkey + "=" + quote (str(int(params[key]))) + "&"
|
|
else:
|
|
result += newkey + "=" + quote (str(params[key])) + "&"
|
|
if (result) and (topkey == '') and (result[-1] == '&'):
|
|
result = result[:-1]
|
|
return result
|
|
|
|
def request_vars(req):
|
|
v = {}
|
|
if req.args:
|
|
v.update(util.parse_qs(req.args))
|
|
l = req.headers_in.get('Content-Length')
|
|
if l:
|
|
l = int(l)
|
|
if l and l > 0:
|
|
if req.headers_in.get('Content-Type').lower().find('multipart') >= 0:
|
|
v.update(cgi.parse_multipart(req, req.headers_in))
|
|
else:
|
|
c = ''
|
|
while len(c) < l:
|
|
c = c + req.read(l-len(c))
|
|
v.update(util.parse_qs(c))
|
|
#log("--REQUEST--")
|
|
for i in v:
|
|
if v[i].__class__.__name__ == 'list':
|
|
v[i] = v[i][0]
|
|
#log("REQUEST: "+i+"="+v[i])
|
|
return v
|
|
|
|
def log(s):
|
|
sys.stderr.write(s+"\n")
|
|
sys.stderr.flush()
|
|
|
|
def keydel(d, key):
|
|
try: del d[key]
|
|
except: pass
|
|
|
|
def clean_uri(v, req):
|
|
uriargs = v.copy()
|
|
keydel(uriargs, 'ga_id')
|
|
keydel(uriargs, 'ga_res')
|
|
keydel(uriargs, 'ga_key')
|
|
keydel(uriargs, 'ga_client')
|
|
keydel(uriargs, 'ga_nologin')
|
|
keydel(uriargs, 'ga_require')
|
|
uri = 'http://'+req.hostname+req.uri+'?'+http_build_query(uriargs)
|
|
return uri
|
|
|
|
def set_env_user(req, r_data):
|
|
r_email = r_data.get('user_email', '').encode('utf-8')
|
|
r_url = r_data.get('user_url', '').encode('utf-8')
|
|
if gac['cut_email_at']:
|
|
p = r_email.find('@')
|
|
if p != -1:
|
|
r_email = r_email[0:p]
|
|
os.environ['REMOTE_USER'] = r_email
|
|
req.subprocess_env['REMOTE_USER'] = r_email
|
|
os.environ['user_url'] = r_url
|
|
req.subprocess_env['user_url'] = r_url
|
|
|
|
def globalauth_handler(req, jar, v):
|
|
global gac
|
|
i = random.randint(1, gac['gc_probability'])
|
|
if i == 1:
|
|
cacheclean()
|
|
r_id = jar.get(gac['cookie_name'], '')
|
|
if r_id:
|
|
r_id = r_id.value
|
|
ga_id = v.get('ga_id', '')
|
|
if ga_id!='' and v.get('ga_client','')!='':
|
|
ga_key = v.get('ga_key','')
|
|
if ga_key != '' and ga_key == cacheget('K'+ga_id):
|
|
cachedel('K'+ga_id)
|
|
data = ''
|
|
if v.get('ga_nologin','') != '':
|
|
data = 'nologin'
|
|
else:
|
|
try: data = anyjson.deserialize(v.get('ga_data',''))
|
|
except: raise
|
|
if data != '':
|
|
if data != 'nologin':
|
|
data = anyjson.serialize(data)
|
|
cacheset('D'+ga_id, data)
|
|
raise apache.SERVER_RETURN, apache.HTTP_OK
|
|
raise apache.SERVER_RETURN, apache.HTTP_NOT_FOUND
|
|
elif ga_key == '' and r_id != ga_id:
|
|
d = cacheget('D'+ga_id)
|
|
if d != 'nologin' and d != '':
|
|
try: d = anyjson.deserialize(d)
|
|
except: d = ''
|
|
if d != '':
|
|
setcookie(req, ga_id)
|
|
util.redirect(req, clean_uri(v, req))
|
|
raise apache.SERVER_RETURN, apache.HTTP_OK
|
|
raise apache.SERVER_RETURN, apache.HTTP_NOT_FOUND
|
|
r_data = ''
|
|
if r_id == 'nologin':
|
|
r_data = 'nologin'
|
|
elif r_id != '':
|
|
r_data = cacheget('D'+r_id)
|
|
if r_data != 'nologin':
|
|
try: r_data = anyjson.deserialize(r_data)
|
|
except: r_data = ''
|
|
if v.get('ga_client', '') == '' and (not r_data and (re.match('opera|firefox|chrome|safari', req.headers_in.get('User-Agent', ''), re.I) or gac['ga_always_require'])
|
|
or v.get('ga_require', '') != ''):
|
|
ga_id = binascii.hexlify(os.urandom(16))
|
|
ga_key = binascii.hexlify(os.urandom(16))
|
|
url = gac['globalauth_server']
|
|
if url.find('?') != -1:
|
|
url = url+'&'
|
|
else:
|
|
url = url+'?'
|
|
try:
|
|
resp = urllib2.urlopen(url+'ga_id='+urllib2.quote(ga_id)+'&ga_key='+urllib2.quote(ga_key))
|
|
resp.read()
|
|
if resp.code != 200:
|
|
raise Exception(resp)
|
|
except:
|
|
setcookie(req, 'nologin')
|
|
util.redirect(req, clean_uri(v, req))
|
|
raise apache.SERVER_RETURN, apache.HTTP_OK
|
|
return_uri = 'http://'+req.hostname+req.uri+'?ga_client=1';
|
|
if req.args:
|
|
return_uri = return_uri+'&'+req.args
|
|
cacheset('K'+ga_id, ga_key)
|
|
url = url+'ga_id='+urllib2.quote(ga_id)+'&ga_url='+urllib2.quote(return_uri)
|
|
if v.get('ga_require', '') == '' and not gac['ga_always_require']:
|
|
url = url+'&ga_check=1'
|
|
util.redirect(req, url)
|
|
raise apache.SERVER_RETURN, apache.HTTP_OK
|
|
elif r_data and r_data != 'nologin':
|
|
set_env_user(req, r_data)
|
|
|
|
def fof_sudo_handler(req, jar, v):
|
|
global gac
|
|
sudo_id = jar.get(gac['fof_sudo_cookie'], '')
|
|
if sudo_id:
|
|
sudo_id = sudo_id.value
|
|
if sudo_id != '':
|
|
url = gac['fof_sudo_server']
|
|
if url.find('?') != -1:
|
|
url = url+'&'
|
|
else:
|
|
url = url+'?'
|
|
try:
|
|
resp = urllib2.urlopen(url+'id='+urllib2.quote(sudo_id))
|
|
d = resp.read()
|
|
if resp.code != 200:
|
|
raise Exception(resp)
|
|
d = anyjson.deserialize(d)
|
|
set_env_user(req, d)
|
|
except:
|
|
pass
|
|
|
|
def handler(req):
|
|
global gac
|
|
os.environ['REMOTE_USER'] = ''
|
|
req.subprocess_env['REMOTE_USER'] = ''
|
|
os.environ['user_url'] = ''
|
|
req.subprocess_env['user_url'] = ''
|
|
jar = Cookie.get_cookies(req)
|
|
v = request_vars(req)
|
|
if gac['fof_sudo_server'] != '':
|
|
fof_sudo_handler(req, jar, v)
|
|
if os.environ['REMOTE_USER'] == '' and gac['globalauth_server'] != '':
|
|
globalauth_handler(req, jar, v)
|
|
return apache.OK
|