3 # Copyright (C) 2014 Simo Sorce <simo@redhat.com>
5 # see file 'COPYING' for use and warranty information
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation, either version 3 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
20 from ipsilon.login.common import LoginPageBase, LoginManagerBase
24 class Krb(LoginPageBase):
26 def root(self, *args, **kwargs):
27 # Someone typed manually or a robot is walking th tree.
28 # Redirect to default page
29 return self.lm.redirect_to_path(self.lm.path)
32 class KrbAuth(LoginPageBase):
34 def root(self, *args, **kwargs):
35 # If we can get here, we must be authenticated and remote_user
36 # was set. Check the session has a user set already or error.
37 if self.user and self.user.name:
38 userdata = {'krb_principal_name': self.user.name}
39 return self.lm.auth_successful(self.user.name, userdata)
41 return self.lm.auth_failed()
44 class KrbError(LoginPageBase):
46 def root(self, *args, **kwargs):
47 cherrypy.log.error('REQUEST: %s' % cherrypy.request.headers)
48 # If we have no negotiate header return whatever mod_auth_kerb
49 # generated and wait for the next request
51 if not 'WWW-Authenticate' in cherrypy.request.headers:
52 cherrypy.response.status = 401
54 if self.lm.next_login:
55 return self.lm.next_login.page.root(*args, **kwargs)
57 conturl = '%s/login' % self.basepath
58 return self._template('login/krb.html',
59 title='Kerberos Login',
62 # If we get here, negotiate failed
63 return self.lm.auth_failed()
66 class LoginManager(LoginManagerBase):
68 def __init__(self, *args, **kwargs):
69 super(LoginManager, self).__init__(*args, **kwargs)
71 self.path = 'krb/negotiate'
73 self.description = """
74 Kereros Negotiate authentication plugin. Relies on the mod_auth_kerb apache
75 plugin for actual authentication. """
77 def get_tree(self, site):
78 self.page = Krb(site, self)
79 self.page.__dict__['negotiate'] = KrbAuth(site, self)
80 self.page.__dict__['unauthorized'] = KrbError(site, self)
84 class Installer(object):
90 def install_args(self, group):
91 group.add_argument('--krb', choices=['yes', 'no'], default='no',
92 help='Configure Kerberos authentication')
94 def configure(self, opts):
95 if opts['krb'] != 'yes':