cas_provider/views.py

   1 from lxml import etree
   2 from urllib import urlencode
   3 import urllib2
   4 import urlparse
   5 from django.conf import settings
   6 from django.contrib.auth import login as auth_login, logout as auth_logout
   7 from django.core.urlresolvers import get_callable
   8 from django.http import HttpResponse, HttpResponseRedirect
   9 from django.shortcuts import render_to_response
  10 from django.template import RequestContext
  11 from cas_provider.attribute_formatters import NSMAP, CAS
  12 from cas_provider.models import ProxyGrantingTicket, ProxyTicket
  13 from forms import LoginForm
  14 from models import ServiceTicket, LoginTicket
  15
  16
  17 __all__ = ['login', 'validate', 'logout', 'service_validate']
  18
  19 INVALID_TICKET = 'INVALID_TICKET'
  20 INVALID_SERVICE = 'INVALID_SERVICE'
  21 INVALID_REQUEST = 'INVALID_REQUEST'
  22 INTERNAL_ERROR = 'INTERNAL_ERROR'
  23
  24 ERROR_MESSAGES = (
  25     (INVALID_TICKET, u'The provided ticket is invalid.'),
  26     (INVALID_SERVICE, u'Service is invalid'),
  27     (INVALID_REQUEST, u'Not all required parameters were sent.'),
  28     (INTERNAL_ERROR, u'An internal error occurred during ticket validation'),
  29     )
  30
  31
  32 def login(request, template_name='cas/login.html',\
  33           success_redirect=settings.LOGIN_REDIRECT_URL,
  34           warn_template_name='cas/warn.html',
  35           form_class=LoginForm):
  36     service = request.GET.get('service', None)
  37     if request.user.is_authenticated():
  38         if service is not None:
  39             if request.GET.get('warn', False):
  40                 return render_to_response(warn_template_name, {
  41                     'service': service,
  42                     'warn': False
  43                 }, context_instance=RequestContext(request))
  44             ticket = ServiceTicket.objects.create(service=service, user=request.user)
  45             return HttpResponseRedirect(ticket.get_redirect_url())
  46         else:
  47             return HttpResponseRedirect(success_redirect)
  48     if request.method == 'POST':
  49         form = form_class(data=request.POST, request=request)
  50         if form.is_valid():
  51             user = form.get_user()
  52             auth_login(request, user)
  53             service = form.cleaned_data.get('service')
  54             if service is not None:
  55                 ticket = ServiceTicket.objects.create(service=service, user=user)
  56                 success_redirect = ticket.get_redirect_url()
  57             return HttpResponseRedirect(success_redirect)
  58     else:
  59         form = form_class(request=request, initial={
  60             'service': service,
  61             'lt': LoginTicket.objects.create()
  62         })
  63     if hasattr(request, 'session') and hasattr(request.session, 'set_test_cookie'):
  64         request.session.set_test_cookie()
  65     return render_to_response(template_name, {
  66         'form': form,
  67         'errors': form.get_errors() if hasattr(form, 'get_errors') else None,
  68         }, context_instance=RequestContext(request))
  69
  70
  71 def validate(request):
  72     """Validate ticket via CAS v.1 protocol"""
  73     service = request.GET.get('service', None)
  74     ticket_string = request.GET.get('ticket', None)
  75     if service is not None and ticket_string is not None:
  76         #renew = request.GET.get('renew', True)
  77         #if not renew:
  78         # TODO: check user SSO session
  79         try:
  80             ticket = ServiceTicket.objects.get(ticket=ticket_string)
  81             assert ticket.service == service
  82             username = ticket.user.username
  83             return HttpResponse("yes\n%s\n" % username)
  84         except:
  85             pass
  86     return HttpResponse("no\n\n")
  87
  88
  89 def logout(request, template_name='cas/logout.html',
  90            auto_redirect=settings.CAS_AUTO_REDIRECT_AFTER_LOGOUT):
  91     url = request.GET.get('url', None)
  92     if request.user.is_authenticated():
  93         for ticket in ServiceTicket.objects.filter(user=request.user):
  94             ticket.delete()
  95         auth_logout(request)
  96         if url and auto_redirect:
  97             return HttpResponseRedirect(url)
  98     return render_to_response(template_name, {'url': url},
  99         context_instance=RequestContext(request))
 100
 101
 102 def proxy(request):
 103     targetService = request.GET['targetService']
 104     pgt_id = request.GET['pgt']
 105
 106     try:
 107         proxyGrantingTicket = ProxyGrantingTicket.objects.get(ticket=pgt_id)
 108     except ProxyGrantingTicket.DoesNotExist:
 109         return _cas2_error_response(INVALID_TICKET)
 110
 111     pt = ProxyTicket.objects.create(proxyGrantingTicket=proxyGrantingTicket,
 112         user=proxyGrantingTicket.serviceTicket.user,
 113         service=targetService)
 114     return _cas2_proxy_success(pt.ticket)
 115
 116
 117 def ticket_validate(service, ticket_string, pgtUrl):
 118     if service is None or ticket_string is None:
 119         return _cas2_error_response(INVALID_REQUEST)
 120
 121     try:
 122         if ticket_string.startswith('ST'):
 123             ticket = ServiceTicket.objects.get(ticket=ticket_string)
 124         elif ticket_string.startswith('PT'):
 125             ticket = ProxyTicket.objects.get(ticket=ticket_string)
 126         else:
 127             return _cas2_error_response(INVALID_TICKET,
 128                 '%(ticket)s is neither Service (ST-...) nor Proxy Ticket (PT-...)' % {
 129                     'ticket': ticket_string})
 130     except ServiceTicket.DoesNotExist:
 131         return _cas2_error_response(INVALID_TICKET)
 132
 133     ticketUrl =  urlparse.urlparse(ticket.service)
 134     serviceUrl =  urlparse.urlparse(service)
 135
 136     if not(ticketUrl.hostname == serviceUrl.hostname and ticketUrl.path == serviceUrl.path and ticketUrl.port == serviceUrl.port):
 137         return _cas2_error_response(INVALID_SERVICE)
 138
 139     pgtIouId = None
 140     proxies = ()
 141     if pgtUrl is not None:
 142         pgt = generate_proxy_granting_ticket(pgtUrl, ticket)
 143         if pgt:
 144             pgtIouId = pgt.pgtiou
 145
 146     if hasattr(ticket, 'proxyticket'):
 147         pgt = ticket.proxyticket.proxyGrantingTicket
 148         # I am issued by this proxy granting ticket
 149         if hasattr(pgt.serviceTicket, 'proxyticket'):
 150             while pgt:
 151                 if hasattr(pgt.serviceTicket, 'proxyticket'):
 152                     proxies += (pgt.serviceTicket.service,)
 153                     pgt = pgt.serviceTicket.proxyticket.proxyGrantingTicket
 154                 else:
 155                     pgt = None
 156
 157     user = ticket.user
 158     return _cas2_sucess_response(user, pgtIouId, proxies)
 159
 160
 161 def service_validate(request):
 162     """Validate ticket via CAS v.2 protocol"""
 163     service = request.GET.get('service', None)
 164     ticket_string = request.GET.get('ticket', None)
 165     pgtUrl = request.GET.get('pgtUrl', None)
 166     if ticket_string.startswith('PT-'):
 167         return _cas2_error_response(INVALID_TICKET, "serviceValidate cannot verify proxy tickets")
 168     else:
 169         return ticket_validate(service, ticket_string, pgtUrl)
 170
 171
 172 def proxy_validate(request):
 173     """Validate ticket via CAS v.2 protocol"""
 174     service = request.GET.get('service', None)
 175     ticket_string = request.GET.get('ticket', None)
 176     pgtUrl = request.GET.get('pgtUrl', None)
 177     return ticket_validate(service, ticket_string, pgtUrl)
 178
 179
 180 def generate_proxy_granting_ticket(pgt_url, ticket):
 181     proxy_callback_good_status = (200, 202, 301, 302, 304)
 182     uri = list(urlparse.urlsplit(pgt_url))
 183
 184     pgt = ProxyGrantingTicket()
 185     pgt.serviceTicket = ticket
 186     pgt.targetService = pgt_url
 187
 188     if hasattr(ticket, 'proxyGrantingTicket'):
 189         # here we got a proxy ticket! tata!
 190         pgt.pgt = ticket.proxyGrantingTicket
 191
 192     params = {'pgtId': pgt.ticket, 'pgtIou': pgt.pgtiou}
 193
 194     query = dict(urlparse.parse_qsl(uri[4]))
 195     query.update(params)
 196
 197     uri[3] = urlencode(query)
 198
 199     try:
 200         response = urllib2.urlopen(urlparse.urlunsplit(uri))
 201     except urllib2.HTTPError, e:
 202         if not e.code in proxy_callback_good_status:
 203             return
 204     except urllib2.URLError, e:
 205         return
 206
 207     pgt.save()
 208     return pgt
 209
 210
 211 def _cas2_proxy_success(pt):
 212     return HttpResponse(proxy_success(pt))
 213
 214
 215 def _cas2_sucess_response(user, pgt=None, proxies=None):
 216     return HttpResponse(auth_success_response(user, pgt, proxies), mimetype='text/xml')
 217
 218
 219 def _cas2_error_response(code, message=None):
 220     return HttpResponse(u'''<cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas">
 221             <cas:authenticationFailure code="%(code)s">
 222                 %(message)s
 223             </cas:authenticationFailure>
 224         </cas:serviceResponse>''' % {
 225         'code': code,
 226         'message': message if message else dict(ERROR_MESSAGES).get(code)
 227     }, mimetype='text/xml')
 228
 229
 230 def proxy_success(pt):
 231     response = etree.Element(CAS + 'serviceResponse', nsmap=NSMAP)
 232     proxySuccess = etree.SubElement(response, CAS + 'proxySuccess')
 233     proxyTicket = etree.SubElement(proxySuccess, CAS + 'proxyTicket')
 234     proxyTicket.text = pt
 235     return unicode(etree.tostring(response, encoding='utf-8'), 'utf-8')
 236
 237
 238 def auth_success_response(user, pgt, proxies):
 239     response = etree.Element(CAS + 'serviceResponse', nsmap=NSMAP)
 240     auth_success = etree.SubElement(response, CAS + 'authenticationSuccess')
 241     username = etree.SubElement(auth_success, CAS + 'user')
 242     username.text = user.username
 243
 244     if settings.CAS_CUSTOM_ATTRIBUTES_CALLBACK:
 245         callback = get_callable(settings.CAS_CUSTOM_ATTRIBUTES_CALLBACK)
 246         attrs = callback(user)
 247         if len(attrs) > 0:
 248             formater = get_callable(settings.CAS_CUSTOM_ATTRIBUTES_FORMATER)
 249             formater(auth_success, attrs)
 250
 251     if pgt:
 252         pgtElement = etree.SubElement(auth_success, CAS + 'proxyGrantingTicket')
 253         pgtElement.text = pgt
 254
 255     if proxies:
 256         proxiesElement = etree.SubElement(auth_success, CAS + "proxies")
 257         for proxy in proxies:
 258             proxyElement = etree.SubElement(proxiesElement, CAS + "proxy")
 259             proxyElement.text = proxy
 260
 261     return unicode(etree.tostring(response, encoding='utf-8'), 'utf-8')