3 # Copyright (C) 2014 Simo Sorce <simo@redhat.com>
5 # see file 'COPYING' for use and warranty information
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation, either version 3 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
20 from ipsilon.login.common import LoginPageBase, LoginManagerBase
21 from ipsilon.util.user import UserSession
25 class Krb(LoginPageBase):
27 def root(self, *args, **kwargs):
28 # Someone typed manually or a robot is walking th tree.
29 # Redirect to default page
30 return self.lm.redirect_to_path(self.lm.path)
33 class KrbAuth(LoginPageBase):
35 def root(self, *args, **kwargs):
36 # If we can get here, we must be authenticated and remote_user
37 # was set. Check the session has a user set already or error.
38 if self.user and self.user.name:
39 userdata = { 'krb_principal_name': self.user.name }
40 return self.lm.auth_successful(self.user.name, userdata)
42 return self.lm.auth_failed()
45 class KrbError(LoginPageBase):
47 def root(self, *args, **kwargs):
48 cherrypy.log.error('REQUEST: %s' % cherrypy.request.headers)
49 # If we have no negotiate header return whatever mod_auth_kerb
50 # generated and wait for the next request
52 if not 'WWW-Authenticate' in cherrypy.request.headers:
53 cherrypy.response.status = 401
55 if self.lm.next_login:
56 return self.lm.next_login.page.root(*args, **kwargs)
58 conturl = '%s/login' % self.basepath
59 return self._template('login/krb.html',
60 title='Kerberos Login',
63 # If we get here, negotiate failed
64 return self.lm.auth_failed()
67 class LoginManager(LoginManagerBase):
69 def __init__(self, *args, **kwargs):
70 super(LoginManager, self).__init__(*args, **kwargs)
72 self.path = 'krb/negotiate'
74 self.description = """
75 Kereros Negotiate authentication plugin. Relies on the mod_auth_kerb apache
76 plugin for actual authentication. """
78 def get_tree(self, site):
79 self.page = Krb(site, self)
80 self.page.__dict__['negotiate'] = KrbAuth(site, self)
81 self.page.__dict__['unauthorized'] = KrbError(site, self)