Authenticate Via External Cookie

   1 # +++++++++++++++ beginning of external_cookie  example
   2 
   3 # This is some sample code you might find useful when you want to use some
   4 # external cookie (made by some other program, not moin) with moin.
   5 # See the +++ places for customizing it to your needs.  Copy this
   6 # code into your farmconfig.py or wikiconfig.py by pasting it over the current:
   7 #
   8 #    class Config(DefaultConfig):
   9 # OR
  10 #    class FarmConfig(DefaultConfig):
  11 
  12 
  13 from MoinMoin.config.multiconfig import DefaultConfig
  14 from MoinMoin.auth import BaseAuth
  15     
  16 # This is included in case you want to create a log file during testing 
  17 import time
  18 def writeLog(*args): 
  19     '''Write an entry in a log file with a timestamp and all of the args.'''
  20     s = time.strftime('%Y-%m-%d %H:%M:%S ',time.localtime())
  21     for a in args:
  22         s = '%s %s;' % (s,a)
  23     log = open('/somelogfile', 'a') # +++ location for log file
  24     log.write('\n' + s + '\n')
  25     log.close()
  26     return
  27     
  28 # these 2 methods are examples of how to "authenticate" the other application cookie
  29 import MySQLdb
  30 def verifySession(sidHash): # +++ to use this, uncomment a procedure call below in ExternalCookie
  31     """Return True if sidHash value exists (meaning user is currently logged on), false otherwise.  
  32     
  33     If you are not a MySQL user, find another way to store this information.  ActiveSession is a two-column table
  34     containing a hashed cookie value (sidHash) plus a date-time stamp (tStamp).
  35     Your other application must add an entry to this table each time a user logs on and delete the entry when the user logs off.
  36     """
  37     db = MySQLdb.connect(db='mydb',user='myid',passwd='mypw') #+++ user ID needs read access
  38     c = db.cursor()
  39     q = 'select sidHash from ActiveSession where sidHash="%s"' % sidHash
  40     result = c.execute(q)
  41     c.close()
  42     if result == 1:
  43         return True
  44     return False
  45     
  46 def verifySessionPlus(sidHash,timeout=3600*4): # +++ to use this, uncomment a procedure call below in ExternalCookie
  47     """Return True if sidHash value exists (meaning user is currently logged on), false otherwise.  
  48     
  49     This version of verifySession deletes entries inactive for more than 4 hours and
  50     updates the tStamp field with each moin transaction.  If performance is 
  51     important, find another way to delete inactive sessions.
  52     """
  53     db = MySQLdb.connect(db='mydb',user='myid',passwd='mypw') # +++ user ID needs write access
  54     c = db.cursor()
  55     q = 'delete from ActiveSession where tStamp<"%s"' % int(time.time() - timeout) # delete inactive entries
  56     result = c.execute(q)
  57     q = 'update ActiveSession set tStamp=%s where sidHash="%s"' % (int(time.time()),sidHash)
  58     result = c.execute(q)
  59     c.close()
  60     if result == 1:
  61         return True
  62     return False
  63     
  64 
  65 class ExternalCookie(BaseAuth):
  66     name = 'external_cookie'
  67     # +++ The next 2 lines may be useful if you are overriding the username method in your themes.
  68     # +++  If commented out, wiki pages will not have login or logout hyperlinks
  69     login_inputs = ['username', 'password'] # +++ required to get a login hyperlink in wiki navigation area
  70     # logout_possible = True # +++ required to get a logout hyperlink in wiki navigation area
  71     
  72     def __init__(self, autocreate=False):
  73         self.autocreate = autocreate
  74         BaseAuth.__init__(self)
  75 
  76     def request(self, request, user_obj, **kw):
  77         """Return (user-obj,False) if user is authenticated, else return (None,True). """
  78         # login = kw.get('login') # +++ example does not use this; login is expected in other application
  79         # user_obj = kw.get('user_obj')  # +++ example does not use this
  80         # username = kw.get('name') # +++ example does not use this
  81         # logout = kw.get('logout') # +++ example does not use this; logout is expected in other application
  82         import Cookie
  83         user = None  # user is not authenticated
  84         try_next = True  # if True, moin tries the next auth method in auth list
  85         
  86         otherAppCookie = "MoinAuth" # +++ username, email,useralias, session ID separated by #
  87         try:
  88             cookie = Cookie.SimpleCookie(request.cookies) #moin 1.9
  89         except Cookie.CookieError:
  90             cookie = None # ignore invalid cookies
  91 
  92         if cookie and otherAppCookie in cookie: # having this cookie means user auth has already been done in other application
  93             import urllib
  94             if sys.version_info[:2] > (2, 5):
  95                 cookievalue = cookie[otherAppCookie].value # moin 1.9 & python 2.6
  96             else:
  97                 cookievalue = cookie[otherAppCookie] # moin 1.9 & python 2.5
  98             # writeLog('cookievalue',cookievalue)
  99             # +++ decode and parse the cookie value - edit this to fit your needs.
 100             #~ cookievalue = urllib.unquote(cookievalue) # cookie value is urlencoded, decode it moin 1.9
 101             #~ cookievalue = cookievalue.decode('iso-8859-1') # decode cookie charset to unicode moin 1.9
 102             cookievalue = cookievalue[1: -1] # strip leading and ending quotes moin 1.9
 103             # writeLog('cookievalue',cookievalue)
 104             cookievalues = cookievalue.split('#') # cookie has format loginname#email#aliasname#sessionid
 105 
 106             email = aliasname = sessionid = ''
 107             try:  # extract fields from other app cookie
 108                 auth_username = cookievalues[0] # the wiki username
 109                 email = cookievalues[1] # email is required for user to change and save userpreferences
 110                 aliasname = cookievalues[2] # aliasname is useful only if auth_username is not wiki-like
 111                 sessionid = cookievalues[3] # optional other app session ID  -- a unique timestamp or random number 
 112             except IndexError: 
 113                 pass  # do not need aliasname or sessionid unless you uncomment lines below
 114             # writeLog('auth_username',auth_username)
 115             # writeLog('email',email)
 116             # writeLog('aliasname',aliasname)
 117             # writeLog('sessionid',sessionid)
 118 
 119             # +++ any hacker can create a cookie, uncomment these lines to verify the cookie was created by the other application
 120             if auth_username:
 121                 import hashlib  # +++ python 2.5; see http://code.krypto.org/python/hashlib for 2.3, 2.4 download
 122                 sidHash = hashlib.md5(cookievalue).hexdigest() # moin 1.9
 123                 # writeLog('sidHash',sidHash)
 124                 sidOK = verifySession(sidHash) # verify user is currently logged on to the other application +++ or use verifySessionPlus
 125                 if not sidOK:
 126                     auth_username = None
 127             # writeLog('auth_username after verifySession',auth_username)
 128             
 129             if auth_username:
 130                 # we have an authorized user, create the moin user object
 131                 from MoinMoin.user import User
 132                 # giving auth_username to User constructor means that authentication has already been done.
 133                 user = User(request, name=auth_username, auth_username=auth_username, auth_method=self.name)
 134                 changed = False
 135                 if email != user.email: # was the email addr externally updated?
 136                     user.email = email ; 
 137                     changed = True # yes -> update user profile
 138                 # if aliasname != user.aliasname: # +++ was the aliasname externally updated?
 139                     # user.aliasname = aliasname ; 
 140                     # changed = True # yes -> update user profile
 141 
 142                 if user:
 143                     user.create_or_update(changed)
 144                 if user and user.valid: 
 145                     try_next = False # have valid user; stop processing auth method list
 146         # writeLog(str(user), try_next)
 147         return user, try_next 
 148 
 149 from MoinMoin.config import multiconfig, url_prefix_static
 150 
 151 class Config(multiconfig.DefaultConfig):
 152 # class FarmConfig(multiconfig.DefaultConfig):
 153 
 154     auth = [ExternalCookie(autocreate=True)] # only way to login is external application # autocreate parameter new in 1.8.0
 155     
 156     # +++ these are suggested changes to the user preferences form if the  external_cookie  is the only auth method
 157     user_form_disable = ['name', 'aliasname', 'email',] # don't let the user change these, but show them:
 158     user_form_remove = ['password', 'password2', 'css_url', 'logout', 'create', 'account_sendmail','jid'] # remove completely:
 159     #~ user_autocreate = True # +++ Moin will autocreate new user ID if none exists
 160     cookie_lifetime = (12, 12)   # (anonymous,logged-in) default (0,12)  page trails for anonymous users moin 1.9
 161 
 162 # +++++++++++++++ end of external_cookie  example,  your custom configurations continue below 

   1     def username(self, d):
   2         """ Assemble the username / userprefs link
   3         
   4         @param d: parameter dictionary
   5         @rtype: unicode
   6         @return: username html
   7         """
   8         request = self.request
   9         _ = request.getText
  10 
  11         userlinks = []
  12         # Add username/homepage link for registered users. We don't care
  13         # if it exists, the user can create it.
  14         if request.user.valid and request.user.name:
  15             interwiki = wikiutil.getInterwikiHomePage(request)
  16             name = request.user.name
  17             aliasname = request.user.aliasname
  18             if not aliasname:
  19                 aliasname = name
  20             title = "%s @ %s" % (aliasname, interwiki[0])
  21             # link to (interwiki) user homepage
  22             homelink = (request.formatter.interwikilink(1, title=title, id="userhome", generated=True, *interwiki) +
  23                         request.formatter.text(name) +
  24                         request.formatter.interwikilink(0, title=title, id="userhome", *interwiki))
  25             userlinks.append(homelink)
  26             # link to userprefs action
  27             if 'userprefs' not in self.request.cfg.actions_excluded:
  28                 userlinks.append(d['page'].link_to(request, text=_('Settings'),
  29                                                querystr={'action': 'userprefs'}, id='userprefs', rel='nofollow'))
  30 
  31         if request.user.valid:  
  32             if request.user.auth_method in request.cfg.auth_can_logout:
  33                 userlinks.append('<a href="/myapp/Logout">%s</a>' % _('Logout', formatted=False)) # +++ other app logout page
  34         else:
  35             query = {'action': 'login'}
  36             # special direct-login link if the auth methods want no input
  37             if request.cfg.auth_login_inputs == ['special_no_input']:
  38                 query['login'] = '1'
  39             if request.cfg.auth_have_login:
  40                 userlinks.append('<a  href="/myapp/Login">%s</a>' % _("Login", formatted=False)) # +++ other app login page
  41 
  42         userlinks = [u'<li>%s</li>' % link for link in userlinks]
  43         html = u'<ul id="username">%s</ul>' % ''.join(userlinks)
  44         return html