90120e6678
- we'll skip any syncing on plugins which simply don't get any group information - we let plugins define if they wish to sync groups - prevent from odd cases in which someone sets user groups as syncing, and using regular plugin. In this case memebership of that group would be wiped, and it's generaly bad behaviour.
147 lines
5.3 KiB
Python
147 lines
5.3 KiB
Python
# -*- coding: utf-8 -*-
|
|
|
|
# Copyright (C) 2016-2018 RhodeCode GmbH
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU Affero General Public License, version 3
|
|
# (only), as published by the Free Software Foundation.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
# This program is dual-licensed. If you wish to learn more about the
|
|
# RhodeCode Enterprise Edition, including its added features, Support services,
|
|
# and proprietary license terms, please see https://rhodecode.com/licenses/
|
|
|
|
"""
|
|
RhodeCode authentication token plugin for built in internal auth
|
|
"""
|
|
|
|
import logging
|
|
|
|
from rhodecode.translation import _
|
|
from rhodecode.authentication.base import (
|
|
RhodeCodeAuthPluginBase, VCS_TYPE, hybrid_property)
|
|
from rhodecode.authentication.routes import AuthnPluginResourceBase
|
|
from rhodecode.model.db import User, UserApiKeys, Repository
|
|
|
|
|
|
log = logging.getLogger(__name__)
|
|
|
|
|
|
def plugin_factory(plugin_id, *args, **kwds):
|
|
plugin = RhodeCodeAuthPlugin(plugin_id)
|
|
return plugin
|
|
|
|
|
|
class RhodecodeAuthnResource(AuthnPluginResourceBase):
|
|
pass
|
|
|
|
|
|
class RhodeCodeAuthPlugin(RhodeCodeAuthPluginBase):
|
|
"""
|
|
Enables usage of authentication tokens for vcs operations.
|
|
"""
|
|
|
|
def includeme(self, config):
|
|
config.add_authn_plugin(self)
|
|
config.add_authn_resource(self.get_id(), RhodecodeAuthnResource(self))
|
|
config.add_view(
|
|
'rhodecode.authentication.views.AuthnPluginViewBase',
|
|
attr='settings_get',
|
|
renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
|
|
request_method='GET',
|
|
route_name='auth_home',
|
|
context=RhodecodeAuthnResource)
|
|
config.add_view(
|
|
'rhodecode.authentication.views.AuthnPluginViewBase',
|
|
attr='settings_post',
|
|
renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
|
|
request_method='POST',
|
|
route_name='auth_home',
|
|
context=RhodecodeAuthnResource)
|
|
|
|
def get_display_name(self):
|
|
return _('Rhodecode Token Auth')
|
|
|
|
@hybrid_property
|
|
def name(self):
|
|
return "authtoken"
|
|
|
|
def user_activation_state(self):
|
|
def_user_perms = User.get_default_user().AuthUser().permissions['global']
|
|
return 'hg.register.auto_activate' in def_user_perms
|
|
|
|
def allows_authentication_from(
|
|
self, user, allows_non_existing_user=True,
|
|
allowed_auth_plugins=None, allowed_auth_sources=None):
|
|
"""
|
|
Custom method for this auth that doesn't accept empty users. And also
|
|
allows users from all other active plugins to use it and also
|
|
authenticate against it. But only via vcs mode
|
|
"""
|
|
from rhodecode.authentication.base import get_authn_registry
|
|
authn_registry = get_authn_registry()
|
|
|
|
active_plugins = set(
|
|
[x.name for x in authn_registry.get_plugins_for_authentication()])
|
|
active_plugins.discard(self.name)
|
|
|
|
allowed_auth_plugins = [self.name] + list(active_plugins)
|
|
# only for vcs operations
|
|
allowed_auth_sources = [VCS_TYPE]
|
|
|
|
return super(RhodeCodeAuthPlugin, self).allows_authentication_from(
|
|
user, allows_non_existing_user=False,
|
|
allowed_auth_plugins=allowed_auth_plugins,
|
|
allowed_auth_sources=allowed_auth_sources)
|
|
|
|
def auth(self, userobj, username, password, settings, **kwargs):
|
|
if not userobj:
|
|
log.debug('userobj was:%s skipping' % (userobj, ))
|
|
return None
|
|
|
|
user_attrs = {
|
|
"username": userobj.username,
|
|
"firstname": userobj.firstname,
|
|
"lastname": userobj.lastname,
|
|
"groups": [],
|
|
'user_group_sync': False,
|
|
"email": userobj.email,
|
|
"admin": userobj.admin,
|
|
"active": userobj.active,
|
|
"active_from_extern": userobj.active,
|
|
"extern_name": userobj.user_id,
|
|
"extern_type": userobj.extern_type,
|
|
}
|
|
|
|
log.debug('Authenticating user with args %s', user_attrs)
|
|
if userobj.active:
|
|
# calling context repo for token scopes
|
|
scope_repo_id = None
|
|
if self.acl_repo_name:
|
|
repo = Repository.get_by_repo_name(self.acl_repo_name)
|
|
scope_repo_id = repo.repo_id if repo else None
|
|
|
|
token_match = userobj.authenticate_by_token(
|
|
password, roles=[UserApiKeys.ROLE_VCS],
|
|
scope_repo_id=scope_repo_id)
|
|
|
|
if userobj.username == username and token_match:
|
|
log.info(
|
|
'user `%s` successfully authenticated via %s',
|
|
user_attrs['username'], self.name)
|
|
return user_attrs
|
|
log.error(
|
|
'user `%s` failed to authenticate via %s, reason: bad or '
|
|
'inactive token.', username, self.name)
|
|
else:
|
|
log.warning(
|
|
'user `%s` failed to authenticate via %s, reason: account not '
|
|
'active.', username, self.name)
|
|
return None
|