Changeset 6937

Timestamp:

04/06/10 16:40:43 (11 years ago)

Author:

pjkersha

Message:

Incomplete - task 5: MyProxy? Logon HTTPS Interface

Location:

TI12-security/trunk/MyProxyLogonWebService

Files:

• .project (added)
• .pydevproject (added)
• myproxy/server/test/ca/bcaeadc0.0 (moved) (moved from TI12-security/trunk/MyProxyLogonWebService/myproxy/server/test/bcaeadc0.0)
• myproxy/server/test/myproxy-ws-logon.sh (modified) (1 diff)
• myproxy/server/test/myproxywsgi.ini (modified) (1 diff)
• myproxy/server/wsgi/middleware.py (modified) (5 diffs)

TI12-security/trunk/MyProxyLogonWebService/myproxy/server/test/myproxy-ws-logon.sh

@@ -95 +95 @@
 #wget $uri --http-user=$username --http-password=$password --post-file=$certreqfilepath --ca-directory=$cadir -O $outfilepath -t 1 --auth-no-challenge
 #response=$(curl $uri -u $username:$password -d "$(cat $certreqfilepath)" --capath $cadir -w " %{http_code}" -s -S)
-response=$(curl $uri -u $username:$password -F "certificate_request=@${certreqfilepath};type=text/plain" --capath $cadir -w " %{http_code}" -s -S)
+#response=$(curl $uri -u $username:$password -F "certificate_request=@${certreqfilepath};get_trustroots=1" --capath $cadir -w " %{http_code}" -s -S)
+response=$(curl $uri -u $username:$password --data-urlencode "certificate_request=$(cat $certreqfilepath)" --capath $cadir -w " %{http_code}" -s -S)
 responsemsg=$(echo "$response"|sed '$s/ *\([^ ]* *\)$//')
 responsecode=$(echo $response|awk '{print $NF}')

TI12-security/trunk/MyProxyLogonWebService/myproxy/server/test/myproxywsgi.ini

@@ -24 +24 @@
 myproxy.rePathMatchList = /logon
 #myproxy.client.hostname = localhost
-myproxy.client.hostname = myproxy.ceda.ac.uk
+myproxy.client.hostname = gabriel.badc.rl.ac.uk
 myproxy.client.caCertDir = /etc/grid-security/certificates

TI12-security/trunk/MyProxyLogonWebService/myproxy/server/wsgi/middleware.py

@@ -17 +17 @@
 from cStringIO import StringIO
 
+from webob import Request
 from OpenSSL import crypto
+
 from myproxy.client import MyProxyClient, MyProxyClientError
 from myproxy.server.wsgi.httpbasicauth import HttpBasicAuthResponseException
@@ -45 +47 @@
                               'MyProxyClientMiddleware.logon')
     
-    WSGI_INPUT_ENV_KEYNAME = 'wsgi.input'
+    CERTIFICATE_REQUST_POST_PARAM_KEYNAME = 'certificate_request'
+    GET_TRUSTROOTS_PARAM_KEYNAME = 'get_trustroots'
+    GET_TRUSTROOTS_TRUE_STR = '1'
     
     # Option prefixes
@@ -193 +197 @@
                           requestMethod)
                 raise HttpBasicAuthResponseException(response, 
-                                                     httplib.METHOD_NOT_ALLOWED) 
-            
-            wsgiInput = environ[MyProxyClientMiddleware.WSGI_INPUT_ENV_KEYNAME]
-                
-            contentLength = int(environ.get('CONTENT_LENGTH', -1))
-            if contentLength == -1:
-                raise MyProxyClientMiddlewareError('No "CONTENT_LENGTH" '
-                                                   'setting found in '
-                                                   'environ')
-                
-            pemCertReq = wsgiInput.read(contentLength)
-            
-            # Restore WSGI file object with duck typing(!)
-            wsgiInput = StringIO()
-            wsgiInput.write(pemCertReq)
-            wsgiInput.seek(0)
+                                                     httplib.METHOD_NOT_ALLOWED)
+            
+            request = Request(environ)
+            certReqKey = self.__class__.CERTIFICATE_REQUST_POST_PARAM_KEYNAME
+            pemCertReq = request.POST.get(certReqKey)
+            if pemCertReq is None:
+                response = "No %r form variable set" % certReqKey
+                log.error(response)
+                raise HttpBasicAuthResponseException(response, 
+                                                     httplib.BAD_REQUEST)
+            log.debug("cert req = %r", pemCertReq)
+            getTrustRootsKey = self.__class__.GET_TRUSTROOTS_PARAM_KEYNAME
+            getTrustRoots = (request.postvars.get(getTrustRootsKey) == 
+                             self.__class__.GET_TRUSTROOTS_TRUE_STR)
             
             # Expecting PEM encoded request
@@ -224 +226 @@
             asn1CertReq = crypto.dump_certificate_request(crypto.FILETYPE_ASN1, 
                                                           certReq)
- 
+            
             try:
+                if getTrustRoots:
+                    trustRootsDict = self.myProxyClient.getTrustRoots()
+                    
+                    trustRoots = '\n'.join([
+                        "FILEDATA_%s=%s" % (fileName, fileContents) 
+                        for fileName, fileContents in trustRootsDict.items()
+                    ])
+                else:
+                    trustRoots = ''
+                
                 credentials = self.myProxyClient.logon(username, 
                                                        password,
@@ -231 +243 @@
                 status = self.getStatusMessage(httplib.OK)
                 response = '\n'.join(credentials)
+                response += '\n'+trustRoots
                 
                 start_response(status,