Coverage for cas_server/views.py: 99%

1# -*- coding: utf-8 -*- 

2# This program is distributed in the hope that it will be useful, but WITHOUT 

3# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS 

4# FOR A PARTICULAR PURPOSE. See the GNU General Public License version 3 for 

5# more details. 

6# 

7# You should have received a copy of the GNU General Public License version 3 

8# along with this program; if not, write to the Free Software Foundation, Inc., 51 

9# Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 

10# 

11# (c) 2015-2016 Valentin Samir 

12"""views for the app""" 

13from .default_settings import settings, SessionStore 

14 

15from django.shortcuts import render, redirect 

16from django.http import HttpResponse, HttpResponseRedirect 

17from django.contrib import messages 

18from django.utils.decorators import method_decorator 

19from django.utils import timezone 

20from django.views.decorators.csrf import csrf_exempt 

21from django.middleware.csrf import CsrfViewMiddleware 

22from django.views.generic import View 

23try: 

24 from django.utils.encoding import python_2_unicode_compatible 

25 from django.utils.translation import ugettext as _ 

26except ImportError: 

27 def python_2_unicode_compatible(func): 

28 """ 

29 We use Django >= 3.0 with Python >= 3.4, we don't need Python 2 compatibility. 

30 """ 

31 return func 

32 from django.utils.translation import gettext as _ 

33from django.utils.safestring import mark_safe 

34try: 

35 from django.urls import reverse 

36except ImportError: 

37 from django.core.urlresolvers import reverse 

38 

39import re 

40import logging 

41import pprint 

42import requests 

43from lxml import etree 

44from datetime import timedelta 

45 

46import cas_server.utils as utils 

47import cas_server.forms as forms 

48import cas_server.models as models 

49 

50from .utils import json_response 

51from .models import Ticket, ServiceTicket, ProxyTicket, ProxyGrantingTicket 

52from .models import ServicePattern, FederatedIendityProvider, FederatedUser 

53from .federate import CASFederateValidateUser 

54 

55logger = logging.getLogger(__name__) 

56 

57 

58class LogoutMixin(object): 

59 """destroy CAS session utils""" 

60 

61 def logout(self, all_session=False): 

62 """ 

63 effectively destroy a CAS session 

64 

65 :param boolean all_session: If ``True`` destroy all the user sessions, otherwise 

66 destroy the current user session. 

67 :return: The number of destroyed sessions 

68 :rtype: int 

69 """ 

70 # initialize the counter of the number of destroyed sesisons 

71 session_nb = 0 

72 # save the current user username before flushing the session 

73 username = self.request.session.get("username") 

74 if username: 

75 if all_session: 

76 logger.info("Logging out user %s from all sessions." % username) 

77 else: 

78 logger.info("Logging out user %s." % username) 

79 users = [] 

80 # try to get the user from the current session 

81 try: 

82 users.append( 

83 models.User.objects.get( 

84 username=username, 

85 session_key=self.request.session.session_key 

86 ) 

87 ) 

88 except models.User.DoesNotExist: 

89 # if user not found in database, flush the session anyway 

90 self.request.session.flush() 

91 

92 # If all_session is set, search all of the user sessions 

93 if all_session: 

94 users.extend( 

95 models.User.objects.filter( 

96 username=username 

97 ).exclude( 

98 session_key=self.request.session.session_key 

99 ) 

100 ) 

101 

102 # Iterate over all user sessions that have to be logged out 

103 for user in users: 

104 # get the user session 

105 session = SessionStore(session_key=user.session_key) 

106 # flush the session 

107 session.flush() 

108 # send SLO requests 

109 user.logout(self.request) 

110 # delete the user 

111 user.delete() 

112 # increment the destroyed session counter 

113 session_nb += 1 

114 if username: 

115 logger.info("User %s logged out" % username) 

116 return session_nb 

117 

118 

119class CsrfExemptView(View): 

120 """base class for csrf exempt class views""" 

121 

122 @method_decorator(csrf_exempt) # csrf is disabled for allowing SLO requests reception 

123 def dispatch(self, request, *args, **kwargs): 

124 """ 

125 dispatch different http request to the methods of the same name 

126 

127 :param django.http.HttpRequest request: The current request object 

128 """ 

129 return super(CsrfExemptView, self).dispatch(request, *args, **kwargs) 

130 

131 

132class LogoutView(View, LogoutMixin): 

133 """destroy CAS session (logout) view""" 

134 

135 #: current :class:`django.http.HttpRequest` object 

136 request = None 

137 #: service GET parameter 

138 service = None 

139 #: url GET paramet 

140 url = None 

141 #: ``True`` if the HTTP_X_AJAX http header is sent and ``settings.CAS_ENABLE_AJAX_AUTH`` 

142 #: is ``True``, ``False`` otherwise. 

143 ajax = None 

144 

145 def init_get(self, request): 

146 """ 

147 Initialize the :class:`LogoutView` attributes on GET request 

148 

149 :param django.http.HttpRequest request: The current request object 

150 """ 

151 self.request = request 

152 self.service = request.GET.get('service') 

153 self.url = request.GET.get('url') 

154 self.ajax = settings.CAS_ENABLE_AJAX_AUTH and 'HTTP_X_AJAX' in request.META 

155 

156 @staticmethod 

157 def delete_cookies(response): 

158 if settings.CAS_REMOVE_DJANGO_SESSION_COOKIE_ON_LOGOUT: 158 ↛ 159line 158 didn't jump to line 159, because the condition on line 158 was never true

159 response.delete_cookie(settings.SESSION_COOKIE_NAME) 

160 if settings.CAS_REMOVE_DJANGO_CSRF_COOKIE_ON_LOGOUT: 160 ↛ 161line 160 didn't jump to line 161, because the condition on line 160 was never true

161 response.delete_cookie(settings.CSRF_COOKIE_NAME) 

162 if settings.CAS_REMOVE_DJANGO_LANGUAGE_COOKIE_ON_LOGOUT: 162 ↛ 163line 162 didn't jump to line 163, because the condition on line 162 was never true

163 response.delete_cookie(settings.LANGUAGE_COOKIE_NAME) 

164 return response 

165 

166 def get(self, request, *args, **kwargs): 

167 """ 

168 method called on GET request on this view 

169 

170 :param django.http.HttpRequest request: The current request object 

171 """ 

172 logger.info("logout requested") 

173 # initialize the class attributes 

174 self.init_get(request) 

175 # if CAS federation mode is enable, bakup the provider before flushing the sessions 

176 if settings.CAS_FEDERATE: 

177 try: 

178 user = FederatedUser.get_from_federated_username( 

179 self.request.session.get("username") 

180 ) 

181 auth = CASFederateValidateUser(user.provider, service_url="") 

182 except FederatedUser.DoesNotExist: 

183 auth = None 

184 session_nb = self.logout(self.request.GET.get("all")) 

185 # if CAS federation mode is enable, redirect to user CAS logout page, appending the 

186 # current querystring 

187 if settings.CAS_FEDERATE: 

188 if auth is not None: 

189 params = utils.copy_params(request.GET, ignore={"forget_provider"}) 

190 url = auth.get_logout_url() 

191 response = HttpResponseRedirect(utils.update_url(url, params)) 

192 if request.GET.get("forget_provider"): 

193 response.delete_cookie("remember_provider") 

194 return self.delete_cookies(response) 

195 # if service is set, redirect to service after logout 

196 if self.service: 

197 list(messages.get_messages(request)) # clean messages before leaving the django app 

198 return self.delete_cookies(HttpResponseRedirect(self.service)) 

199 # if service is not set but url is set, redirect to url after logout 

200 elif self.url: 

201 list(messages.get_messages(request)) # clean messages before leaving the django app 

202 return self.delete_cookies(HttpResponseRedirect(self.url)) 

203 else: 

204 # build logout message depending of the number of sessions the user logs out 

205 if session_nb == 1: 

206 logout_msg = mark_safe(_( 

207 "<h3>Logout successful</h3>" 

208 "You have successfully logged out from the Central Authentication Service. " 

209 "For security reasons, close your web browser." 

210 )) 

211 elif session_nb > 1: 

212 logout_msg = mark_safe(_( 

213 "<h3>Logout successful</h3>" 

214 "You have successfully logged out from %d sessions of the Central " 

215 "Authentication Service. " 

216 "For security reasons, close your web browser." 

217 ) % session_nb) 

218 else: 

219 logout_msg = mark_safe(_( 

220 "<h3>Logout successful</h3>" 

221 "You were already logged out from the Central Authentication Service. " 

222 "For security reasons, close your web browser." 

223 )) 

224 

225 # depending of settings, redirect to the login page with a logout message or display 

226 # the logout page. The default is to display tge logout page. 

227 if settings.CAS_REDIRECT_TO_LOGIN_AFTER_LOGOUT: 

228 messages.add_message(request, messages.SUCCESS, logout_msg) 

229 if self.ajax: 

230 url = reverse("cas_server:login") 

231 data = { 

232 'status': 'success', 

233 'detail': 'logout', 

234 'url': url, 

235 'session_nb': session_nb 

236 } 

237 return self.delete_cookies(json_response(request, data)) 

238 else: 

239 return self.delete_cookies(redirect("cas_server:login")) 

240 else: 

241 if self.ajax: 

242 data = {'status': 'success', 'detail': 'logout', 'session_nb': session_nb} 

243 return self.delete_cookies(json_response(request, data)) 

244 else: 

245 return self.delete_cookies(render( 

246 request, 

247 settings.CAS_LOGOUT_TEMPLATE, 

248 utils.context({'logout_msg': logout_msg}) 

249 )) 

250 

251 

252class FederateAuth(CsrfExemptView): 

253 """ 

254 view to authenticated user against a backend CAS then CAS_FEDERATE is True 

255 

256 csrf is disabled for allowing SLO requests reception. 

257 """ 

258 

259 #: current URL used as service URL by the CAS client 

260 service_url = None 

261 

262 def get_cas_client(self, request, provider, renew=False): 

263 """ 

264 return a CAS client object matching provider 

265 

266 :param django.http.HttpRequest request: The current request object 

267 :param cas_server.models.FederatedIendityProvider provider: the user identity provider 

268 :return: The user CAS client object 

269 :rtype: :class:`federate.CASFederateValidateUser 

270 <cas_server.federate.CASFederateValidateUser>` 

271 """ 

272 # compute the current url, ignoring ticket dans provider GET parameters 

273 service_url = utils.get_current_url(request, {"ticket", "provider"}) 

274 self.service_url = service_url 

275 return CASFederateValidateUser(provider, service_url, renew=renew) 

276 

277 def post(self, request, provider=None, *args, **kwargs): 

278 """ 

279 method called on POST request 

280 

281 :param django.http.HttpRequest request: The current request object 

282 :param unicode provider: Optional parameter. The user provider suffix. 

283 """ 

284 # if settings.CAS_FEDERATE is not True redirect to the login page 

285 if not settings.CAS_FEDERATE: 

286 logger.warning("CAS_FEDERATE is False, set it to True to use federation") 

287 return redirect("cas_server:login") 

288 # POST with a provider suffix, this is probably an SLO request. csrf is disabled for 

289 # allowing SLO requests reception 

290 try: 

291 provider = FederatedIendityProvider.objects.get(suffix=provider) 

292 auth = self.get_cas_client(request, provider) 

293 try: 

294 auth.clean_sessions(request.POST['logoutRequest']) 

295 except (KeyError, AttributeError): 

296 pass 

297 return HttpResponse("ok") 

298 # else, a User is trying to log in using an identity provider 

299 except FederatedIendityProvider.DoesNotExist: 

300 # Manually checking for csrf to protect the code below 

301 reason = CsrfViewMiddleware(lambda request: HttpResponse()) \ 

302 .process_view(request, None, (), {}) 

303 if reason is not None: # pragma: no cover (csrf checks are disabled during tests) 

304 return reason # Failed the test, stop here. 

305 form = forms.FederateSelect(request.POST) 

306 if form.is_valid(): 

307 params = utils.copy_params( 

308 request.POST, 

309 ignore={"provider", "csrfmiddlewaretoken", "ticket", "lt"} 

310 ) 

311 if params.get("renew") == "False": 

312 del params["renew"] 

313 url = utils.reverse_params( 

314 "cas_server:federateAuth", 

315 kwargs=dict(provider=form.cleaned_data["provider"].suffix), 

316 params=params 

317 ) 

318 return HttpResponseRedirect(url) 

319 else: 

320 return redirect("cas_server:login") 

321 

322 def get(self, request, provider=None): 

323 """ 

324 method called on GET request 

325 

326 :param django.http.HttpRequestself. request: The current request object 

327 :param unicode provider: Optional parameter. The user provider suffix. 

328 """ 

329 # if settings.CAS_FEDERATE is not True redirect to the login page 

330 if not settings.CAS_FEDERATE: 

331 logger.warning("CAS_FEDERATE is False, set it to True to use federation") 

332 return redirect("cas_server:login") 

333 renew = bool(request.GET.get('renew') and request.GET['renew'] != "False") 

334 # Is the user is already authenticated, no need to request authentication to the user 

335 # identity provider. 

336 if self.request.session.get("authenticated") and not renew: 

337 logger.warning("User already authenticated, dropping federated authentication request") 

338 return redirect("cas_server:login") 

339 try: 

340 # get the identity provider from its suffix 

341 provider = FederatedIendityProvider.objects.get(suffix=provider) 

342 # get a CAS client for the user identity provider 

343 auth = self.get_cas_client(request, provider, renew) 

344 # if no ticket submited, redirect to the identity provider CAS login page 

345 if 'ticket' not in request.GET: 

346 logger.info("Trying to authenticate %s again" % auth.provider.server_url) 

347 return HttpResponseRedirect(auth.get_login_url()) 

348 else: 

349 ticket = request.GET['ticket'] 

350 try: 

351 # if the ticket validation succeed 

352 if auth.verify_ticket(ticket): 

353 logger.info( 

354 "Got a valid ticket for %s from %s" % ( 

355 auth.username, 

356 auth.provider.server_url 

357 ) 

358 ) 

359 params = utils.copy_params(request.GET, ignore={"ticket", "remember"}) 

360 request.session["federate_username"] = auth.federated_username 

361 request.session["federate_ticket"] = ticket 

362 auth.register_slo( 

363 auth.federated_username, 

364 request.session.session_key, 

365 ticket 

366 ) 

367 # redirect to the the login page for the user to become authenticated 

368 # thanks to the `federate_username` and `federate_ticket` session parameters 

369 url = utils.reverse_params("cas_server:login", params) 

370 response = HttpResponseRedirect(url) 

371 # If the user has checked "remember my identity provider" store it in a 

372 # cookie 

373 if request.GET.get("remember"): 

374 max_age = settings.CAS_FEDERATE_REMEMBER_TIMEOUT 

375 utils.set_cookie( 

376 response, 

377 "remember_provider", 

378 provider.suffix, 

379 max_age 

380 ) 

381 return response 

382 # else redirect to the identity provider CAS login page 

383 else: 

384 logger.info( 

385 ( 

386 "Got an invalid ticket %s from %s for service %s. " 

387 "Retrying authentication" 

388 ) % ( 

389 ticket, 

390 auth.provider.server_url, 

391 self.service_url 

392 ) 

393 ) 

394 return HttpResponseRedirect(auth.get_login_url()) 

395 # both xml.etree.ElementTree and lxml.etree exceptions inherit from SyntaxError 

396 except SyntaxError as error: 

397 messages.add_message( 

398 request, 

399 messages.ERROR, 

400 _( 

401 u"Invalid response from your identity provider CAS upon " 

402 u"ticket %(ticket)s validation: %(error)r" 

403 ) % {'ticket': ticket, 'error': error} 

404 ) 

405 response = redirect("cas_server:login") 

406 response.delete_cookie("remember_provider") 

407 return response 

408 except FederatedIendityProvider.DoesNotExist: 

409 logger.warning("Identity provider suffix %s not found" % provider) 

410 # if the identity provider is not found, redirect to the login page 

411 return redirect("cas_server:login") 

412 

413 

414class LoginView(View, LogoutMixin): 

415 """credential requestor / acceptor""" 

416 

417 # pylint: disable=too-many-instance-attributes 

418 # Nine is reasonable in this case. 

419 

420 #: The current :class:`models.User<cas_server.models.User>` object 

421 user = None 

422 #: The form to display to the user 

423 form = None 

424 

425 #: current :class:`django.http.HttpRequest` object 

426 request = None 

427 #: service GET/POST parameter 

428 service = None 

429 #: ``True`` if renew GET/POST parameter is present and not "False" 

430 renew = None 

431 #: the warn GET/POST parameter 

432 warn = None 

433 #: the gateway GET/POST parameter 

434 gateway = None 

435 #: the method GET/POST parameter 

436 method = None 

437 

438 #: ``True`` if the HTTP_X_AJAX http header is sent and ``settings.CAS_ENABLE_AJAX_AUTH`` 

439 #: is ``True``, ``False`` otherwise. 

440 ajax = None 

441 

442 #: ``True`` if the user has just authenticated 

443 renewed = False 

444 #: ``True`` if renew GET/POST parameter is present and not "False" 

445 warned = False 

446 

447 #: The :class:`FederateAuth` transmited username (only used if ``settings.CAS_FEDERATE`` 

448 #: is ``True``) 

449 username = None 

450 #: The :class:`FederateAuth` transmited ticket (only used if ``settings.CAS_FEDERATE`` is 

451 #: ``True``) 

452 ticket = None 

453 

454 INVALID_LOGIN_TICKET = 1 

455 USER_LOGIN_OK = 2 

456 USER_LOGIN_FAILURE = 3 

457 USER_ALREADY_LOGGED = 4 

458 USER_AUTHENTICATED = 5 

459 USER_NOT_AUTHENTICATED = 6 

460 

461 def init_post(self, request): 

462 """ 

463 Initialize POST received parameters 

464 

465 :param django.http.HttpRequest request: The current request object 

466 """ 

467 self.request = request 

468 self.service = request.POST.get('service') 

469 self.renew = bool(request.POST.get('renew') and request.POST['renew'] != "False") 

470 self.gateway = request.POST.get('gateway') 

471 self.method = request.POST.get('method') 

472 self.ajax = settings.CAS_ENABLE_AJAX_AUTH and 'HTTP_X_AJAX' in request.META 

473 if request.POST.get('warned') and request.POST['warned'] != "False": 

474 self.warned = True 

475 self.warn = request.POST.get('warn') 

476 if settings.CAS_FEDERATE: 

477 self.username = request.POST.get('username') 

478 # in federated mode, the valdated indentity provider CAS ticket is used as password 

479 self.ticket = request.POST.get('password') 

480 

481 def gen_lt(self): 

482 """Generate a new LoginTicket and add it to the list of valid LT for the user""" 

483 self.request.session['lt'] = self.request.session.get('lt', []) + [utils.gen_lt()] 

484 if len(self.request.session['lt']) > 100: 

485 self.request.session['lt'] = self.request.session['lt'][-100:] 

486 

487 def check_lt(self): 

488 """ 

489 Check is the POSTed LoginTicket is valid, if yes invalide it 

490 

491 :return: ``True`` if the LoginTicket is valid, ``False`` otherwise 

492 :rtype: bool 

493 """ 

494 # save LT for later check 

495 lt_valid = self.request.session.get('lt', []) 

496 lt_send = self.request.POST.get('lt') 

497 # generate a new LT (by posting the LT has been consumed) 

498 self.gen_lt() 

499 # check if send LT is valid 

500 if lt_send not in lt_valid: 

501 return False 

502 else: 

503 self.request.session['lt'].remove(lt_send) 

504 # we need to redo the affectation for django to detect that the list has changed 

505 # and for its new value to be store in the session 

506 self.request.session['lt'] = self.request.session['lt'] 

507 return True 

508 

509 def post(self, request, *args, **kwargs): 

510 """ 

511 method called on POST request on this view 

512 

513 :param django.http.HttpRequest request: The current request object 

514 """ 

515 # initialize class parameters 

516 self.init_post(request) 

517 # process the POST request 

518 ret = self.process_post() 

519 if ret == self.INVALID_LOGIN_TICKET: 

520 messages.add_message( 

521 self.request, 

522 messages.ERROR, 

523 _(u"Invalid login ticket, please try to log in again") 

524 ) 

525 elif ret == self.USER_LOGIN_OK: 

526 # On successful login, update the :class:`models.User<cas_server.models.User>` ``date`` 

527 # attribute by saving it. (``auto_now=True``) 

528 self.user = models.User.objects.get_or_create( 

529 username=self.request.session['username'], 

530 session_key=self.request.session.session_key 

531 )[0] 

532 self.user.last_login = timezone.now() 

533 self.user.save() 

534 elif ret == self.USER_LOGIN_FAILURE: # bad user login 

535 if settings.CAS_FEDERATE: 

536 self.ticket = None 

537 self.username = None 

538 self.init_form() 

539 # preserve valid LoginTickets from session flush 

540 lt = self.request.session.get('lt', []) 

541 # On login failure, flush the session 

542 self.logout() 

543 # restore valid LoginTickets 

544 self.request.session['lt'] = lt 

545 elif ret == self.USER_ALREADY_LOGGED: 

546 pass 

547 else: # pragma: no cover (should no happen) 

548 raise EnvironmentError("invalid output for LoginView.process_post") 

549 # call the GET/POST common part 

550 response = self.common() 

551 if self.warn: 

552 utils.set_cookie( 

553 response, 

554 "warn", 

555 "on", 

556 10 * 365 * 24 * 3600 

557 ) 

558 else: 

559 response.delete_cookie("warn") 

560 return response 

561 

562 def process_post(self): 

563 """ 

564 Analyse the POST request: 

565 

566 * check that the LoginTicket is valid 

567 * check that the user sumited credentials are valid 

568 

569 :return: 

570 * :attr:`INVALID_LOGIN_TICKET` if the POSTed LoginTicket is not valid 

571 * :attr:`USER_ALREADY_LOGGED` if the user is already logged and do no request 

572 reauthentication. 

573 * :attr:`USER_LOGIN_FAILURE` if the user is not logged or request for 

574 reauthentication and his credentials are not valid 

575 * :attr:`USER_LOGIN_OK` if the user is not logged or request for 

576 reauthentication and his credentials are valid 

577 :rtype: int 

578 """ 

579 if not self.check_lt(): 

580 self.init_form(self.request.POST) 

581 logger.warning("Received an invalid login ticket") 

582 return self.INVALID_LOGIN_TICKET 

583 elif not self.request.session.get("authenticated") or self.renew: 

584 # authentication request receive, initialize the form to use 

585 self.init_form(self.request.POST) 

586 if self.form.is_valid(): 

587 self.request.session.set_expiry(0) 

588 self.request.session["username"] = self.form.cleaned_data['username'] 

589 self.request.session["warn"] = True if self.form.cleaned_data.get("warn") else False 

590 self.request.session["authenticated"] = True 

591 self.renewed = True 

592 self.warned = True 

593 logger.info("User %s successfully authenticated" % self.request.session["username"]) 

594 return self.USER_LOGIN_OK 

595 else: 

596 logger.warning("A login attempt failed") 

597 return self.USER_LOGIN_FAILURE 

598 else: 

599 logger.warning("Received a login attempt for an already-active user") 

600 return self.USER_ALREADY_LOGGED 

601 

602 def init_get(self, request): 

603 """ 

604 Initialize GET received parameters 

605 

606 :param django.http.HttpRequest request: The current request object 

607 """ 

608 self.request = request 

609 self.service = request.GET.get('service') 

610 self.renew = bool(request.GET.get('renew') and request.GET['renew'] != "False") 

611 self.gateway = request.GET.get('gateway') 

612 self.method = request.GET.get('method') 

613 self.ajax = settings.CAS_ENABLE_AJAX_AUTH and 'HTTP_X_AJAX' in request.META 

614 self.warn = request.GET.get('warn') 

615 if settings.CAS_FEDERATE: 

616 # here username and ticket are fetch from the session after a redirection from 

617 # FederateAuth.get 

618 self.username = request.session.get("federate_username") 

619 self.ticket = request.session.get("federate_ticket") 

620 if self.username: 

621 del request.session["federate_username"] 

622 if self.ticket: 

623 del request.session["federate_ticket"] 

624 

625 def get(self, request, *args, **kwargs): 

626 """ 

627 method called on GET request on this view 

628 

629 :param django.http.HttpRequest request: The current request object 

630 """ 

631 # initialize class parameters 

632 self.init_get(request) 

633 # process the GET request 

634 self.process_get() 

635 # call the GET/POST common part 

636 return self.common() 

637 

638 def process_get(self): 

639 """ 

640 Analyse the GET request 

641 

642 :return: 

643 * :attr:`USER_NOT_AUTHENTICATED` if the user is not authenticated or is requesting 

644 for authentication renewal 

645 * :attr:`USER_AUTHENTICATED` if the user is authenticated and is not requesting 

646 for authentication renewal 

647 :rtype: int 

648 """ 

649 # generate a new LT 

650 self.gen_lt() 

651 if not self.request.session.get("authenticated") or self.renew: 

652 # authentication will be needed, initialize the form to use 

653 self.init_form() 

654 return self.USER_NOT_AUTHENTICATED 

655 return self.USER_AUTHENTICATED 

656 

657 def init_form(self, values=None): 

658 """ 

659 Initialization of the good form depending of POST and GET parameters 

660 

661 :param django.http.QueryDict values: A POST or GET QueryDict 

662 """ 

663 if values: 

664 values = values.copy() 

665 values['lt'] = self.request.session['lt'][-1] 

666 form_initial = { 

667 'service': self.service, 

668 'method': self.method, 

669 'warn': ( 

670 self.warn or self.request.session.get("warn") or self.request.COOKIES.get('warn') 

671 ), 

672 'lt': self.request.session['lt'][-1], 

673 'renew': self.renew 

674 } 

675 if settings.CAS_FEDERATE: 

676 if self.username and self.ticket: 

677 form_initial['username'] = self.username 

678 form_initial['password'] = self.ticket 

679 form_initial['ticket'] = self.ticket 

680 self.form = forms.FederateUserCredential( 

681 values, 

682 initial=form_initial 

683 ) 

684 else: 

685 self.form = forms.FederateSelect(values, initial=form_initial) 

686 else: 

687 self.form = forms.UserCredential( 

688 values, 

689 initial=form_initial 

690 ) 

691 

692 def service_login(self): 

693 """ 

694 Perform login against a service 

695 

696 :return: 

697 * The rendering of the ``settings.CAS_WARN_TEMPLATE`` if the user asked to be 

698 warned before ticket emission and has not yep been warned. 

699 * The redirection to the service URL with a ticket GET parameter 

700 * The redirection to the service URL without a ticket if ticket generation failed 

701 and the :attr:`gateway` attribute is set 

702 * The rendering of the ``settings.CAS_LOGGED_TEMPLATE`` template with some error 

703 messages if the ticket generation failed (e.g: user not allowed). 

704 :rtype: django.http.HttpResponse 

705 """ 

706 try: 

707 # is the service allowed 

708 service_pattern = ServicePattern.validate(self.service) 

709 # is the current user allowed on this service 

710 service_pattern.check_user(self.user) 

711 # if the user has asked to be warned before any login to a service 

712 if self.request.session.get("warn", True) and not self.warned: 

713 messages.add_message( 

714 self.request, 

715 messages.WARNING, 

716 _(u"Authentication has been required by service %(name)s (%(url)s)") % 

717 {'name': service_pattern.name, 'url': self.service} 

718 ) 

719 if self.ajax: 

720 data = {"status": "error", "detail": "confirmation needed"} 

721 return json_response(self.request, data) 

722 else: 

723 warn_form = forms.WarnForm(initial={ 

724 'service': self.service, 

725 'renew': self.renew, 

726 'gateway': self.gateway, 

727 'method': self.method, 

728 'warned': True, 

729 'lt': self.request.session['lt'][-1] 

730 }) 

731 return render( 

732 self.request, 

733 settings.CAS_WARN_TEMPLATE, 

734 utils.context({'form': warn_form}) 

735 ) 

736 else: 

737 # redirect, using method ? 

738 list(messages.get_messages(self.request)) # clean messages before leaving django 

739 redirect_url = self.user.get_service_url( 

740 self.service, 

741 service_pattern, 

742 renew=self.renewed 

743 ) 

744 if not self.ajax: 

745 return HttpResponseRedirect(redirect_url) 

746 else: 

747 data = {"status": "success", "detail": "auth", "url": redirect_url} 

748 return json_response(self.request, data) 

749 except ServicePattern.DoesNotExist: 

750 error = 1 

751 messages.add_message( 

752 self.request, 

753 messages.ERROR, 

754 _(u'Service %(url)s not allowed.') % {'url': self.service} 

755 ) 

756 except models.BadUsername: 

757 error = 2 

758 messages.add_message( 

759 self.request, 

760 messages.ERROR, 

761 _(u"Username not allowed") 

762 ) 

763 except models.BadFilter: 

764 error = 3 

765 messages.add_message( 

766 self.request, 

767 messages.ERROR, 

768 _(u"User characteristics not allowed") 

769 ) 

770 except models.UserFieldNotDefined: 

771 error = 4 

772 messages.add_message( 

773 self.request, 

774 messages.ERROR, 

775 _(u"The attribute %(field)s is needed to use" 

776 u" that service") % {'field': service_pattern.user_field} 

777 ) 

778 

779 # if gateway is set and auth failed redirect to the service without authentication 

780 if self.gateway and not self.ajax: 

781 list(messages.get_messages(self.request)) # clean messages before leaving django 

782 return HttpResponseRedirect(self.service) 

783 

784 if not self.ajax: 

785 return render( 

786 self.request, 

787 settings.CAS_LOGGED_TEMPLATE, 

788 utils.context({'session': self.request.session}) 

789 ) 

790 else: 

791 data = {"status": "error", "detail": "auth", "code": error} 

792 return json_response(self.request, data) 

793 

794 def authenticated(self): 

795 """ 

796 Processing authenticated users 

797 

798 :return: 

799 * The returned value of :meth:`service_login` if :attr:`service` is defined 

800 * The rendering of ``settings.CAS_LOGGED_TEMPLATE`` otherwise 

801 :rtype: django.http.HttpResponse 

802 """ 

803 # Try to get the current :class:`models.User<cas_server.models.User>` object for the current 

804 # session 

805 try: 

806 self.user = models.User.objects.get( 

807 username=self.request.session.get("username"), 

808 session_key=self.request.session.session_key 

809 ) 

810 # if not found, flush the session and redirect to the login page 

811 except models.User.DoesNotExist: 

812 logger.warning( 

813 "User %s seems authenticated but is not found in the database." % ( 

814 self.request.session.get("username"), 

815 ) 

816 ) 

817 self.logout() 

818 if self.ajax: 

819 data = { 

820 "status": "error", 

821 "detail": "login required", 

822 "url": utils.reverse_params("cas_server:login", params=self.request.GET) 

823 } 

824 return json_response(self.request, data) 

825 else: 

826 return utils.redirect_params("cas_server:login", params=self.request.GET) 

827 

828 # if login against a service 

829 if self.service: 

830 return self.service_login() 

831 # else display the logged template 

832 else: 

833 if self.ajax: 

834 data = {"status": "success", "detail": "logged"} 

835 return json_response(self.request, data) 

836 else: 

837 return render( 

838 self.request, 

839 settings.CAS_LOGGED_TEMPLATE, 

840 utils.context({'session': self.request.session}) 

841 ) 

842 

843 def not_authenticated(self): 

844 """ 

845 Processing non authenticated users 

846 

847 :return: 

848 * The rendering of ``settings.CAS_LOGIN_TEMPLATE`` with various messages 

849 depending of GET/POST parameters 

850 * The redirection to :class:`FederateAuth` if ``settings.CAS_FEDERATE`` is ``True`` 

851 and the "remember my identity provider" cookie is found 

852 :rtype: django.http.HttpResponse 

853 """ 

854 if self.service: 

855 try: 

856 service_pattern = ServicePattern.validate(self.service) 

857 if self.gateway and not self.ajax: 

858 # clean messages before leaving django 

859 list(messages.get_messages(self.request))