2 logger = logging.getLogger('cas_provider.views')
5 from urllib.error import HTTPError, URLError
6 from urllib.parse import parse_qsl, urlencode, urlparse, urlsplit, urlunsplit
7 from urllib.request import urlopen
9 from urllib import urlencode
10 from urllib2 import HTTPError, URLError, urlopen
11 from urlparse import parse_qsl, urlparse, urlsplit, urlunsplit
12 from functools import wraps
14 from django.utils.decorators import available_attrs
15 from django.views.decorators.debug import sensitive_post_parameters
16 from django.views.decorators.cache import cache_control
17 from django.utils.cache import patch_cache_control
18 from django.views.decorators.csrf import csrf_protect
20 from django.http import HttpResponse, HttpResponseRedirect
21 from django.conf import settings
22 from django.contrib.auth import login as auth_login, logout as auth_logout
23 from django.core.urlresolvers import get_callable
24 from django.shortcuts import render_to_response
25 from django.utils.translation import ugettext as _
26 from django.template import RequestContext
27 from django.contrib.auth import authenticate
28 from django.core.urlresolvers import reverse
30 from lxml import etree
31 from cas_provider.attribute_formatters import NSMAP, CAS
32 from cas_provider.models import ProxyGrantingTicket, ProxyTicket
33 from cas_provider.models import ServiceTicket
35 from cas_provider.forms import LoginForm, MergeLoginForm
39 __all__ = ['login', 'validate', 'logout', 'service_validate']
41 INVALID_TICKET = 'INVALID_TICKET'
42 INVALID_SERVICE = 'INVALID_SERVICE'
43 INVALID_REQUEST = 'INVALID_REQUEST'
44 INTERNAL_ERROR = 'INTERNAL_ERROR'
47 (INVALID_TICKET, u'The provided ticket is invalid.'),
48 (INVALID_SERVICE, u'Service is invalid'),
49 (INVALID_REQUEST, u'Not all required parameters were sent.'),
50 (INTERNAL_ERROR, u'An internal error occurred during ticket validation'),
54 logger = logging.getLogger(__name__)
57 _never_cache = cache_control(no_cache=True, must_revalidate=True)
60 def never_cache(view_func):
62 Decorator that adds headers to a response so that it will
65 @wraps(view_func, assigned=available_attrs(view_func))
66 def _wrapped_view_func(request, *args, **kwargs):
67 response = view_func(request, *args, **kwargs)
68 patch_cache_control(response, no_cache=True,
69 must_revalidate=True, proxy_revalidate=True)
70 response['Pragma'] = 'no-cache'
72 return _wrapped_view_func
75 @sensitive_post_parameters()
78 def login(request, template_name='cas/login.html',
79 success_redirect=settings.LOGIN_REDIRECT_URL,
80 warn_template_name='cas/warn.html', **kwargs):
81 merge = kwargs.get('merge', False)
82 logging.debug('CAS Provider Login view. Method is %s, merge is %s, template is %s.',
83 request.method, merge, template_name)
85 service = request.GET.get('service', None)
86 if service is not None:
87 # Save the service on the session, for later use if we end up
88 # in one of the more complicated workflows.
89 request.session['service'] = service
95 if request.method == 'POST':
97 form = MergeLoginForm(request.POST, request=request)
99 form = LoginForm(request.POST, request=request)
102 service = form.cleaned_data.get('service', None)
104 auth_args = dict(username=form.cleaned_data['username'],
105 password=form.cleaned_data['password'])
107 # We only want to send the merge argument if it's
108 # True. If it it's False, we want it to propagate
109 # through the auth backends properly.
110 auth_args['merge'] = merge
111 user = authenticate(**auth_args)
113 # Need to merge the accounts?
115 # We shouldn't get here...
118 base_url = reverse('cas_provider_merge')
120 success_redirect=success_redirect,
121 username=form.cleaned_data['username'],
123 if service is not None:
124 args['service'] = service
125 args = urlencode(args)
127 url = '%s?%s' % (base_url, args)
128 logging.debug('Redirecting to %s', url)
129 return HttpResponseRedirect(url)
132 errors.append(_('Incorrect username and/or password.'))
135 auth_login(request, user)
137 else: # Not a POST...
139 form = MergeLoginForm(initial={'service': service, 'username': request.GET.get('username')})
141 form = LoginForm(initial={'service': service})
143 if user is not None and user.is_authenticated():
144 # We have an authenticated user.
145 if not user.is_active:
146 errors.append(_('This account is disabled. Please contact us if you feel it should be enabled again.'))
148 # Send the on_cas_login signal. If we get an HttpResponse, return that.
149 for receiver, response in signals.on_cas_login.send(sender=login, request=request, **kwargs):
150 if isinstance(response, HttpResponse):
154 # Try and pull the service off the session
155 service = request.session.pop('service', service)
157 signals.on_cas_login_success.send(sender=login, request=request,
158 service=service, **kwargs)
161 # Normal internal success redirection.
162 logging.debug('Redirecting to %s', success_redirect)
163 return HttpResponseRedirect(success_redirect)
165 if request.GET.get('warn', False):
166 return render_to_response(warn_template_name, {
169 }, context_instance=RequestContext(request))
171 # Create a service ticket and redirect to the service.
172 ticket = ServiceTicket.objects.create(service=service, user=user)
173 if 'service' in request.session:
174 # Don't need this any more.
175 del request.session['service']
177 url = ticket.get_redirect_url()
178 logging.debug('Redirecting to %s', url)
179 return HttpResponseRedirect(url)
181 logging.debug('Rendering response on %s, merge is %s', template_name, merge)
182 return render_to_response(template_name, {'form': form, 'errors': errors}, context_instance=RequestContext(request))
186 def validate(request):
187 """Validate ticket via CAS v.1 protocol
189 service = request.GET.get('service', None)
190 ticket_string = request.GET.get('ticket', None)
191 logger.info('Validating ticket %s for %s', ticket_string, service)
192 if service is not None and ticket_string is not None:
193 #renew = request.GET.get('renew', True)
195 # TODO: check user SSO session
197 ticket = ServiceTicket.objects.get(ticket=ticket_string)
198 assert ticket.service == service
199 except ServiceTicket.DoesNotExist:
200 logger.exception("Tried to validate with an invalid ticket %s for %s", ticket_string, service)
201 except Exception as e:
202 logger.exception('Got an exception: %s', e)
204 username = ticket.user.username
207 results = signals.on_cas_collect_histories.send(sender=validate, for_user=ticket.user)
208 histories = '\n'.join('\n'.join(rs) for rc, rs in results)
209 logger.info('Validated %s %s', username, "(also %s)" % histories if histories else '')
210 return HttpResponse("yes\n%s\n%s" % (username, histories))
212 logger.info('Validation failed.')
213 return HttpResponse("no\n\n")
217 def logout(request, template_name='cas/logout.html',
218 auto_redirect=settings.CAS_AUTO_REDIRECT_AFTER_LOGOUT):
219 url = request.GET.get('url', None)
220 if request.user.is_authenticated():
221 for ticket in ServiceTicket.objects.filter(user=request.user):
224 if url and auto_redirect:
225 return HttpResponseRedirect(url)
226 return render_to_response(template_name, {'url': url},
227 context_instance=RequestContext(request))
232 targetService = request.GET['targetService']
233 pgt_id = request.GET['pgt']
236 proxyGrantingTicket = ProxyGrantingTicket.objects.get(ticket=pgt_id)
237 except ProxyGrantingTicket.DoesNotExist:
238 return _cas2_error_response(INVALID_TICKET)
240 pt = ProxyTicket.objects.create(proxyGrantingTicket=proxyGrantingTicket,
241 user=proxyGrantingTicket.serviceTicket.user,
242 service=targetService)
243 return _cas2_proxy_success(pt.ticket)
246 def ticket_validate(service, ticket_string, pgtUrl):
247 if service is None or ticket_string is None:
248 return _cas2_error_response(INVALID_REQUEST)
251 if ticket_string.startswith('ST'):
252 ticket = ServiceTicket.objects.get(ticket=ticket_string)
253 elif ticket_string.startswith('PT'):
254 ticket = ProxyTicket.objects.get(ticket=ticket_string)
256 return _cas2_error_response(INVALID_TICKET,
257 '%(ticket)s is neither Service (ST-...) nor Proxy Ticket (PT-...)' % {
258 'ticket': ticket_string})
259 except ServiceTicket.DoesNotExist:
260 return _cas2_error_response(INVALID_TICKET)
262 ticketUrl = urlparse(ticket.service)
263 serviceUrl = urlparse(service)
265 if not(ticketUrl.hostname == serviceUrl.hostname and ticketUrl.path == serviceUrl.path and ticketUrl.port == serviceUrl.port):
266 return _cas2_error_response(INVALID_SERVICE)
270 if pgtUrl is not None:
271 pgt = generate_proxy_granting_ticket(pgtUrl, ticket)
273 pgtIouId = pgt.pgtiou
275 if hasattr(ticket, 'proxyticket'):
276 pgt = ticket.proxyticket.proxyGrantingTicket
277 # I am issued by this proxy granting ticket
278 if hasattr(pgt.serviceTicket, 'proxyticket'):
280 if hasattr(pgt.serviceTicket, 'proxyticket'):
281 proxies += (pgt.serviceTicket.service,)
282 pgt = pgt.serviceTicket.proxyticket.proxyGrantingTicket
288 return _cas2_sucess_response(user, pgtIouId, proxies)
292 def service_validate(request):
293 """Validate ticket via CAS v.2 protocol"""
294 service = request.GET.get('service', None)
295 ticket_string = request.GET.get('ticket', None)
296 pgtUrl = request.GET.get('pgtUrl', None)
297 if ticket_string.startswith('PT-'):
298 return _cas2_error_response(INVALID_TICKET, "serviceValidate cannot verify proxy tickets")
300 return ticket_validate(service, ticket_string, pgtUrl)
304 def proxy_validate(request):
305 """Validate ticket via CAS v.2 protocol"""
306 service = request.GET.get('service', None)
307 ticket_string = request.GET.get('ticket', None)
308 pgtUrl = request.GET.get('pgtUrl', None)
309 return ticket_validate(service, ticket_string, pgtUrl)
312 def generate_proxy_granting_ticket(pgt_url, ticket):
313 proxy_callback_good_status = (200, 202, 301, 302, 304)
314 uri = list(urlsplit(pgt_url))
316 pgt = ProxyGrantingTicket()
317 pgt.serviceTicket = ticket
318 pgt.targetService = pgt_url
320 if hasattr(ticket, 'proxyGrantingTicket'):
321 # here we got a proxy ticket! tata!
322 pgt.pgt = ticket.proxyGrantingTicket
324 params = {'pgtId': pgt.ticket, 'pgtIou': pgt.pgtiou}
326 query = dict(parse_qsl(uri[4]))
329 uri[3] = urlencode(query)
332 urlopen(urlunsplit(uri))
333 except HTTPError as e:
334 if not e.code in proxy_callback_good_status:
335 logger.debug('Checking Proxy Callback URL {} returned {}. Not issuing PGT.'.format(uri, e.code))
337 except URLError as e:
338 logger.debug('Checking Proxy Callback URL {} raised URLError. Not issuing PGT.'.format(uri))
345 def _cas2_proxy_success(pt):
346 return HttpResponse(proxy_success(pt))
349 def _cas2_sucess_response(user, pgt=None, proxies=None):
350 return HttpResponse(auth_success_response(user, pgt, proxies), content_type='text/xml')
353 def _cas2_error_response(code, message=None):
354 return HttpResponse(u'''<cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas">
355 <cas:authenticationFailure code="%(code)s">
357 </cas:authenticationFailure>
358 </cas:serviceResponse>''' % {
360 'message': message if message else dict(ERROR_MESSAGES).get(code)
361 }, content_type='text/xml')
364 def proxy_success(pt):
365 response = etree.Element(CAS + 'serviceResponse', nsmap=NSMAP)
366 proxySuccess = etree.SubElement(response, CAS + 'proxySuccess')
367 proxyTicket = etree.SubElement(proxySuccess, CAS + 'proxyTicket')
368 proxyTicket.text = pt
369 return etree.tostring(response, encoding='unicode')
372 def auth_success_response(user, pgt, proxies):
373 response = etree.Element(CAS + 'serviceResponse', nsmap=NSMAP)
374 auth_success = etree.SubElement(response, CAS + 'authenticationSuccess')
375 username = etree.SubElement(auth_success, CAS + 'user')
376 username.text = user.username
379 for receiver, custom in signals.cas_collect_custom_attributes.send(sender=auth_success_response, user=user):
383 identifiers = [i for sr, rr in signals.on_cas_collect_histories.send(sender=validate, for_user=user)
387 # Singular `identifier`, as that is the name of the element tag(s).
388 attrs['identifier'] = identifiers
391 formatter = get_callable(settings.CAS_CUSTOM_ATTRIBUTES_FORMATER)
392 formatter(auth_success, attrs)
395 pgtElement = etree.SubElement(auth_success, CAS + 'proxyGrantingTicket')
396 pgtElement.text = pgt
399 proxiesElement = etree.SubElement(auth_success, CAS + "proxies")
400 for proxy in proxies:
401 proxyElement = etree.SubElement(proxiesElement, CAS + "proxy")
402 proxyElement.text = proxy
404 return etree.tostring(response, encoding='unicode')