Changeset 6897

Timestamp:

27/05/10 16:36:40 (11 years ago)

Author:

pjkersha

Message:

Fixed setting of authentication realm for HTTP Basic Auth middleware and improved interface to callback function by providing a exception type for the callback function to use to pass back message and HTTP status code.

Location:

TI12-security/trunk/MyProxyServerUtils/myproxy/server

Files:

• test/httpbasicauth.ini (modified) (1 diff)
• test/myproxywsgi.ini (modified) (1 diff)
• test/test_httpbasicauth.py (modified) (2 diffs)
• test/test_myproxywsgi.cfg (modified) (1 diff)
• test/test_myproxywsgi.py (modified) (3 diffs)
• test/test_myproxywsgi_with_paster.py (modified) (2 diffs)
• wsgi/app.py (modified) (3 diffs)
• wsgi/httpbasicauth.py (modified) (7 diffs)
• wsgi/middleware.py (modified) (4 diffs)

TI12-security/trunk/MyProxyServerUtils/myproxy/server/test/httpbasicauth.ini

@@ -23 +23 @@
 httpbasicauth.authnFuncEnvKeyName = HTTPBASICAUTH_FUNC
 httpbasicauth.rePathMatchList = /auth
+httpbasicauth.realm = test-realm

TI12-security/trunk/MyProxyServerUtils/myproxy/server/test/myproxywsgi.ini

@@ -20 +20 @@
 paste.app_factory = myproxy.server.wsgi.app:MyProxyLogonApp.app_factory
 prefix = myproxy.
+myproxy.httpbasicauth.realm = myproxy-realm
 myproxy.logonFuncEnvKeyName = MYPROXY_LOGON_FUNC
 myproxy.rePathMatchList = /logon

TI12-security/trunk/MyProxyServerUtils/myproxy/server/test/test_httpbasicauth.py

@@ -18 +18 @@
 
 from myproxy.server.wsgi.httpbasicauth import (HttpBasicAuthMiddleware,
-                                               HttpBasicAuthUnauthorized)
+                                               HttpBasicAuthResponseException)
 
 
@@ -85 +85 @@
             if (username != self.__class__.USERNAME or
                 password != self.__class__.PASSWORD):
-                raise HttpBasicAuthUnauthorized()
+                raise HttpBasicAuthResponseException("Invalid credentials")
             
         environ['HTTPBASICAUTH_FUNC'] = authenticate

TI12-security/trunk/MyProxyServerUtils/myproxy/server/test/test_myproxywsgi.cfg

@@ -13 +13 @@
 #
 [test01Logon]
-username: pjk
+username = https://ceda.ac.uk/openid/Philip.Kershaw
+#username: pjk
 #password = mypassword
 uri = https://localhost:10443/logon

TI12-security/trunk/MyProxyServerUtils/myproxy/server/test/test_myproxywsgi.py

@@ -1 +1 @@
 #!/usr/bin/env python
-"""Unit tests for MyProxy WSGI Middleware classes and Application
+"""Unit tests for MyProxy WSGI Middleware classes and Application.  These are
+run using paste.fixture i.e. tests stubs to a web application server
 """
 __author__ = "P J Kershaw"
@@ -90 +91 @@
         
     def test01Logon(self):
+        # Test successful logon
         username = self.cfg.get('test01Logon', 'username')
         try: 
@@ -105 +107 @@
         print response 
         self.assert_(response)
-          
+        
+    def test02NoAuthorisationHeaderSet(self):   
+        # Test failure with omission of HTTP Basic Auth header - a 401 result is
+        # expected.
+             
+        # Create key pair and certificate request
+        keyPair, certReq = self._createRequestCreds()
+        response = self.app.post('/logon', certReq, status=401)
+        print response 
+        self.assert_(response)  
+        
+    def test03NoCertificateRequestSent(self):
+        # Test with missing certificate request
+        
+        username = self.cfg.get('test01Logon', 'username')
+        try: 
+            password = self.cfg.get('test01Logon', 'password')
+        except NoOptionError:
+            password = getpass('test01Logon password: ')
+            
+        base64String = base64.encodestring('%s:%s' % (username, password))[:-1]
+        authHeader =  "Basic %s" % base64String
+        headers = {'Authorization': authHeader}
+        
+        # Bad POST'ed content
+        response = self.app.post('/logon', 'x', headers=headers, status=400)
+        print response 
+        self.assert_(response)
+        
+    def test04GET(self):
+        # Test HTTP GET request - should be rejected - POST is expected
+        
+        username = self.cfg.get('test01Logon', 'username')
+        try: 
+            password = self.cfg.get('test01Logon', 'password')
+        except NoOptionError:
+            password = getpass('test01Logon password: ')
+            
+        base64String = base64.encodestring('%s:%s' % (username, password))[:-1]
+        authHeader =  "Basic %s" % base64String
+        headers = {'Authorization': authHeader}
+        
+        response = self.app.get('/logon', headers=headers, status=405)
+        print response 
+        self.assert_(response)               
 
 if __name__ == "__main__":

TI12-security/trunk/MyProxyServerUtils/myproxy/server/test/test_myproxywsgi_with_paster.py

@@ -1 +1 @@
 #!/usr/bin/env python
 """Unit tests for MyProxy WSGI Middleware classes and Application testing them
-with PAster web application server
+with Paster web application server.  The server is started from __init__ method
+of the Test Case class and then called by the unit test methods.  The unit
+test methods themselves using a bash script myproxy-ws-logon.sh to query the 
+MyProxy web application.
 """
 __author__ = "P J Kershaw"
@@ -9 +12 @@
 __contact__ = "Philip.Kershaw@stfc.ac.uk"
 __revision__ = '$Id$'
-from os import path, waitpid
+from os import path
 from getpass import getpass
-from cStringIO import StringIO
 from ConfigParser import SafeConfigParser, NoOptionError
 import subprocess

TI12-security/trunk/MyProxyServerUtils/myproxy/server/wsgi/app.py

@@ -28 +28 @@
     """
     PARAM_PREFIX = 'myproxy.logon.'
+    HTTPBASICAUTH_REALM_OPTNAME = 'httpbasicauth.realm'
     
     @classmethod
@@ -46 +47 @@
         logonFuncEnvironKeyName = app_conf.get(logonFuncEnvKeyNameOptName,
                                 MyProxyClientMiddleware.LOGON_FUNC_ENV_KEYNAME)
-            
-        # Mirror callback function setting in HTTP Basic Auth middleware so
-        # that it correctly picks up the authentication function
-        app_conf[prefix + HttpBasicAuthMiddleware.AUTHN_FUNC_ENV_KEYNAME_OPTNAME
-                 ] = logonFuncEnvironKeyName
-                 
+                       
         app = MyProxyLogonApp()
         httpBasicAuthMWare = HttpBasicAuthMiddleware.filter_app_factory(app, 
@@ -67 +63 @@
         httpBasicAuthMWare.authnFuncEnvironKeyName = app.logonFuncEnvironKeyName
         
+        # Mirror callback function setting in HTTP Basic Auth middleware so
+        # that it correctly picks up the authentication function
+        realmOptName = prefix + cls.HTTPBASICAUTH_REALM_OPTNAME
+        httpBasicAuthMWare.realm = app_conf[realmOptName]
+        
         return app
     

TI12-security/trunk/MyProxyServerUtils/myproxy/server/wsgi/httpbasicauth.py

@@ -23 +23 @@
 
 
-class HttpBasicAuthUnauthorized(HttpBasicAuthMiddlewareError):  
-    """Raise from custom authentication interface in order to set HTTP 
-    401 Unuathorized response"""
+class HttpBasicAuthResponseException(HttpBasicAuthMiddlewareError):
+    """Exception class for use by the authentication function callback to
+    signal HTTP codes and messages back to HttpBasicAuthMiddleware.  The code 
+    can conceivably a non-error HTTP code such as 200
+    """
+    def __init__(self, *arg, **kw):
+        """Extend Exception type to accommodate an extra HTTP response code
+        argument
+        """
+        self.response = arg[0]
+        if len(arg) == 2:
+            argList = list(arg)
+            self.code = argList.pop()
+            arg = tuple(argList)
+        else:
+            self.code = httplib.UNAUTHORIZED
+                
+        HttpBasicAuthMiddlewareError.__init__(self, *arg, **kw)
     
     
@@ -33 +48 @@
     AUTHN_FUNC_ENV_KEYNAME = (
     'myproxy.server.wsgi.httpbasicauth.HttpBasicAuthMiddleware.authenticate')
+    
+    # Config file option names
     AUTHN_FUNC_ENV_KEYNAME_OPTNAME = 'authnFuncEnvKeyName'       
+    RE_PATH_MATCH_LIST_OPTNAME = 'rePathMatchList'
+    REALM_OPTNAME = 'realm'
+    
     PARAM_PREFIX = 'http.auth.basic.'
-    HTTP_HDR_FIELDNAME = 'basic'
+    
+    # HTTP header request and response field parameters
+    AUTHENTICATE_HDR_FIELDNAME = 'WWW-Authenticate'
+    
+    # For testing header content in start_response_wrapper
+    AUTHENTICATE_HDR_FIELDNAME_LOWER = AUTHENTICATE_HDR_FIELDNAME.lower()
+    
+    AUTHN_SCHEME_HDR_FIELDNAME = 'Basic'
+    AUTHN_SCHEME_HDR_FIELDNAME_LOWER = AUTHN_SCHEME_HDR_FIELDNAME.lower()
+    
     FIELD_SEP = ':'
     AUTHZ_ENV_KEYNAME = 'HTTP_AUTHORIZATION'
     
-    RE_PATH_MATCH_LIST_OPTNAME = 'rePathMatchList'
-    
-    __slots__ = ('__rePathMatchList', '__authnFuncEnvironKeyName', '__app')
+    __slots__ = (
+        '__rePathMatchList', 
+        '__authnFuncEnvironKeyName', 
+        '__realm',
+        '__app'
+    )
     
     def __init__(self, app):
         self.__rePathMatchList = None
         self.__authnFuncEnvironKeyName = None
+        self.__realm = None
         self.__app = app
 
@@ -122 +155 @@
                                    "URI paths intercepted by this middleware")
 
+    def _getRealm(self):
+        return self.__realm
+
+    def _setRealm(self, value):
+        if not isinstance(value, basestring):
+            raise TypeError('Expecting string type for '
+                            '"realm"; got %r' % type(value))
+        
+        self.__realm = value
+
+    realm = property(fget=_getRealm, fset=_setRealm, 
+                     doc="HTTP Authentication realm to set in responses")
+
     def _pathMatch(self, environ):
         """Apply a list of regular expression matching patterns to the contents
@@ -155 +201 @@
                        
         method, encodedCreds = basicAuthHdr.split(None, 1)
-        if method.lower() != HttpBasicAuthMiddleware.HTTP_HDR_FIELDNAME:
+        if (method.lower() != 
+            HttpBasicAuthMiddleware.AUTHN_SCHEME_HDR_FIELDNAME_LOWER):
             log.debug("Auth method is %r not %r: skipping request",
-                      method, HttpBasicAuthMiddleware.HTTP_HDR_FIELDNAME)
+                      method, 
+                      HttpBasicAuthMiddleware.AUTHN_SCHEME_HDR_FIELDNAME)
             return None, None
             
@@ -166 +214 @@
     def __call__(self, environ, start_response):
         """Authenticate based HTTP header elements as specified by the HTTP
-        Basic Authentication spec."""
+        Basic Authentication spec.
+        
+        @param environ: WSGI environ 
+        @type environ: dict-like type
+        @param start_response: WSGI start response function
+        @type start_response: function
+        @return: response
+        @rtype: iterable
+        """
         log.debug("HttpBasicAuthNMiddleware.__call__ ...")
         
         if not self._pathMatch(environ):
             return self.__app(environ, start_response)
-            
+        
+        def start_response_wrapper(status, headers): 
+            """Ensure Authentication realm is included with 401 responses"""
+            statusCode = int(status.split()[0])
+            if statusCode == httplib.UNAUTHORIZED:
+                authnRealmHdrFound = False
+                for name, val in headers:
+                    if (name.lower() == 
+                            self.__class__.AUTHENTICATE_HDR_FIELDNAME_LOWER):
+                        authnRealmHdrFound = True
+                        break
+                     
+                if not authnRealmHdrFound:
+                    authnRealmHdr = (self.__class__.AUTHENTICATE_HDR_FIELDNAME,
+                                     "%s %s" % (                                   
+                                     self.__class__.AUTHN_SCHEME_HDR_FIELDNAME,
+                                     self.realm))
+                    headers.append(authnRealmHdr)
+                
+            return start_response(status, headers)
+        
         username, password = self._parseCredentials(environ)
         if username is None:
             log.error('No username set in HTTP Authorization header')
-            return self.setErrorResponse(start_response, 
+            return self.setErrorResponse(start_response_wrapper, 
                                          msg="No username set\n")
         
@@ -187 +263 @@
         # the next middleware is called in the chain
         try:
-            response = authenticateFunc(environ, start_response, username, 
+            response = authenticateFunc(environ, 
+                                        start_response_wrapper, 
+                                        username, 
                                         password)
             if response is None:
-                return self.__app(environ, start_response)
+                return self.__app(environ, start_response_wrapper)
             else:
                 return response
             
-        except HttpBasicAuthUnauthorized:
-            log.error('Client authentication failed: %s', 
+        except HttpBasicAuthResponseException, e:
+            log.error('Client authentication raised an exception: %s', 
                       traceback.format_exc())
-            return self.setErrorResponse(start_response)    
-
-    @staticmethod
-    def setErrorResponse(start_response, msg=None, 
-                         code=httplib.UNAUTHORIZED, contentType=None):
+            return self.setErrorResponse(start_response_wrapper,
+                                         msg=e.response,
+                                         code=e.code)    
+
+    @classmethod
+    def setErrorResponse(cls,
+                         start_response, 
+                         msg=None, 
+                         code=httplib.UNAUTHORIZED,
+                         contentType=None):
         '''Convenience method to set a simple error response
         
@@ -222 +305 @@
         if contentType is None:
             contentType = 'text/plain'
-                
-        start_response(status,
-                       [('Content-type', contentType),
-                        ('Content-Length', str(len(response)))])
+                        
+        headers = [
+            ('Content-type', contentType), 
+            ('Content-length', str(len(msg)))
+        ]
+        start_response(status, headers)
         return [response]

TI12-security/trunk/MyProxyServerUtils/myproxy/server/wsgi/middleware.py

@@ -19 +19 @@
 from OpenSSL import crypto
 from myproxy.client import MyProxyClient, MyProxyClientError
-       
+from myproxy.server.wsgi.httpbasicauth import HttpBasicAuthResponseException
+  
 
 class MyProxyClientMiddlewareError(Exception):
@@ -185 +186 @@
         def _myProxylogon(environ, start_response, username, password):
             """Wrap MyProxy logon method as a WSGI app
-            """               
-            if environ.get('REQUEST_METHOD') == 'POST':
-                wsgiInput = environ[
-                                MyProxyClientMiddleware.WSGI_INPUT_ENV_KEYNAME]
-                
-                contentLength = int(environ.get('CONTENT_LENGTH', -1))
-                if contentLength == -1:
-                    raise MyProxyClientMiddlewareError('No "CONTENT_LENGTH" '
-                                                       'setting found in '
-                                                       'environ')
-                    
-                pemCertReq = wsgiInput.read(contentLength)
-                
-                # Restore WSGI file object with duck typing(!)
-                wsgiInput = StringIO()
-                wsgiInput.write(pemCertReq)
-                wsgiInput.seek(0)
-                
-                # Expecting PEM encoded request
-                certReq = crypto.load_certificate_request(
-                                                        crypto.FILETYPE_PEM,
-                                                        pemCertReq)
-                
-                # Convert to ASN1 format expect by logon client call
-                asn1CertReq = crypto.dump_certificate_request(
-                                                        crypto.FILETYPE_ASN1, 
-                                                        certReq)
-            else:
-                status = self.getStatusMessage(httplib.UNAUTHORIZED)
-                response = ("HTTP request method %r not recognised for this "
-                            "request " % environ.get('REQUEST_METHOD', 
-                                                     '<Not set>'))
-                log.error(response)
-                start_response(status,
-                               [('Content-length', str(len(response))),
-                                ('Content-type', 'text/plain')])
-                return [response]  
-                          
+            """  
+            requestMethod = environ.get('REQUEST_METHOD')             
+            if requestMethod != 'POST':
+                response = "HTTP Request method not recognised"
+                log.error("HTTP Request method %r not recognised", 
+                          requestMethod)
+                raise HttpBasicAuthResponseException(response, 
+                                                     httplib.METHOD_NOT_ALLOWED) 
+            
+            wsgiInput = environ[MyProxyClientMiddleware.WSGI_INPUT_ENV_KEYNAME]
+                
+            contentLength = int(environ.get('CONTENT_LENGTH', -1))
+            if contentLength == -1:
+                raise MyProxyClientMiddlewareError('No "CONTENT_LENGTH" '
+                                                   'setting found in '
+                                                   'environ')
+                
+            pemCertReq = wsgiInput.read(contentLength)
+            
+            # Restore WSGI file object with duck typing(!)
+            wsgiInput = StringIO()
+            wsgiInput.write(pemCertReq)
+            wsgiInput.seek(0)
+            
+            # Expecting PEM encoded request
+            try:
+                certReq = crypto.load_certificate_request(crypto.FILETYPE_PEM,
+                                                          pemCertReq)
+            except crypto.Error, e:
+                log.error("Error loading input certificate request: %r", 
+                          pemCertReq)
+                raise HttpBasicAuthResponseException("Error loading input "
+                                                     "certificate request",
+                                                     httplib.BAD_REQUEST)
+                
+            # Convert to ASN1 format expect by logon client call
+            asn1CertReq = crypto.dump_certificate_request(crypto.FILETYPE_ASN1, 
+                                                          certReq)
+ 
             try:
                 credentials = self.myProxyClient.logon(username, 
@@ -230 +232 @@
                 response = '\n'.join(credentials)
                 
+                start_response(status,
+                               [('Content-length', str(len(response))),
+                                ('Content-type', 'text/plain')])
+                return [response]
+                       
             except MyProxyClientError, e:
-                status = self.getStatusMessage(httplib.UNAUTHORIZED)
-                response = str(e)
-            
+                raise HttpBasicAuthResponseException(str(e),
+                                                     httplib.UNAUTHORIZED)
             except socket.error, e:
                 raise MyProxyClientMiddlewareError("Socket error "
@@ -243 +249 @@
                           self.myProxyClient.hostname,
                           traceback.format_exc())
-                raise
-            
-            start_response(status,
-                           [('Content-length', str(len(response))),
-                            ('Content-type', 'text/plain')])
-            return [response]
+                raise # Trigger 500 Internal Server Error
+            
+
         
         return _myProxylogon