lib/004075000002250000156000000000000700555111700113075ustar00zentsg00002630000002lib/CVS/004075000002250000156000000000000700555112000117345ustar00zentsg00002630000002lib/CVS/Root010064000002250000156000000000230700555111700126010ustar00zentsg00002630000002/share/src/cvsroot lib/CVS/Repository010064000002250000156000000000400700555111700140340ustar00zentsg00002630000002rmit/zope/GenericUserFolder/lib lib/CVS/Entries010064000002250000156000000000150700555112000132620ustar00zentsg00002630000002D/python//// lib/python/004075000002250000156000000000000700555111700126305ustar00zentsg00002630000002lib/python/CVS/004075000002250000156000000000000700555112000132555ustar00zentsg00002630000002lib/python/CVS/Root010064000002250000156000000000230700555111700141220ustar00zentsg00002630000002/share/src/cvsroot lib/python/CVS/Repository010064000002250000156000000000470700555111700153640ustar00zentsg00002630000002rmit/zope/GenericUserFolder/lib/python lib/python/CVS/Entries010064000002250000156000000000170700555112000146050ustar00zentsg00002630000002D/Products//// lib/python/Products/004075000002250000156000000000000700717230600144345ustar00zentsg00002630000002lib/python/Products/CVS/004075000002250000156000000000000700555112000150605ustar00zentsg00002630000002lib/python/Products/CVS/Root010064000002250000156000000000230700555111700157250ustar00zentsg00002630000002/share/src/cvsroot lib/python/Products/CVS/Repository010064000002250000156000000000600700555111700171620ustar00zentsg00002630000002rmit/zope/GenericUserFolder/lib/python/Products lib/python/Products/CVS/Entries010064000002250000156000000000300700555112000164030ustar00zentsg00002630000002D/GenericUserFolder//// lib/python/Products/GenericUserFolder/004075000002250000156000000000000701616070200200005ustar00zentsg00002630000002lib/python/Products/GenericUserFolder/CVS/004075000002250000156000000000000701470742100204365ustar00zentsg00002630000002lib/python/Products/GenericUserFolder/CVS/Root010064000002250000156000000000230700555111700212740ustar00zentsg00002630000002/share/src/cvsroot lib/python/Products/GenericUserFolder/CVS/Repository010064000002250000156000000001020700555111700225260ustar00zentsg00002630000002rmit/zope/GenericUserFolder/lib/python/Products/GenericUserFolder lib/python/Products/GenericUserFolder/CVS/Entries010064000002250000156000000012620701470742100217710ustar00zentsg00002630000002D/templates//// /Makefile/1.3/Tue Nov 16 03:07:42 1999// /__init__.py/1.1.1.1/Tue Nov 16 03:07:42 1999// /addGenericUserFolder.dtml/1.5/Tue Nov 16 03:07:42 1999// /folder.gif/1.1.1.1/Tue Nov 16 03:07:42 1999// /manage_cache.dtml/1.1/Tue Nov 16 03:07:42 1999// /manage_properties.dtml/1.3/Tue Nov 16 03:07:42 1999// /priv/1.1.1.1/Tue Nov 16 03:07:42 1999// /user.gif/1.1.1.1/Tue Nov 16 03:07:42 1999// /manage_listUsers.dtml/1.3/Tue Nov 16 03:08:54 1999// /manage_userInfo.dtml/1.4/Tue Nov 16 03:09:18 1999// /version.txt/1.3/Tue Nov 16 08:11:56 1999// /GenericUserFolder.py/1.13/Wed Nov 17 07:23:37 1999// /User.py/1.5/Wed Nov 17 07:23:37 1999// /README.txt/1.11/Thu Nov 18 05:01:44 1999// lib/python/Products/GenericUserFolder/Makefile010064400002250000156000000005330701414517600214510ustar00zentsg00002630000002DEST = /www/zope/zope2/lib/python/Products/GenericUserFolder INSTOPTS = -g zope -o zope all: echo Stoopid install: install -d ${INSTOPTS} -m 750 ${DEST} install ${INSTOPTS} -m 640 *.py *.txt *.dtml *.gif ${DEST} install -d ${INSTOPTS} -m 750 ${DEST}/templates/dumb install ${INSTOPTS} -m 640 templates/dumb/*.dtml ${DEST}/templates/dumb lib/python/Products/GenericUserFolder/README.txt010064400002250000156000000120460701470407000215030ustar00zentsg00002630000002

GenericUserFolder

The GenericUserFolder is a roll-your-own user folder. It provides hooks to:

Method Name Method Parameters Method Description Output format
userList None Retrieve a list of valid usernames
  • Usernames seperated by whitespace
  • A sequence of strings
  • A sequence of objects with a 'username' attribute
  • A sequence of objects with a 'uname' attribute
userRoles username Return list of roles for the given user
  • Roles seperated by whitespace
  • A sequence of strings
  • A sequence of objects with a 'role' attribute
  • A sequence of objects with a 'r' attribute
userAuthenticate username, password Authenticate a user The integer value '0' for failure, or '1' for success.
userDomains username Return a list of domains the user can log in from
  • Domains seperated by whitespace
  • A sequence of strings
  • A sequence of objects with a 'domain' attribute
  • A sequence of objects with a 'd' attribute
docLogin None The initial login screen Should contain a form that POSTs the _gufauth_name & _gufauth_password parameters.
docLogout None The screen displayed on logout None

These hooks can be DTML methods, or any other Zope method that uses the same calling convention as DTML methods. The hooks are called in this format: gufHook(GUFFolder,REQUEST,parameter=value).

Any other Zope method (eg. ZSQL methods, External methods or Python methods) can be called by using a DTML method as glue. If you reference another method or object from a hook, the hook needs to be given a proxy role with sufficient rights to access this other method. Generally, a proxy role of 'Manager' is used. For example, to do Radius authentication, I need a ZRadius object ('MyRadius') and a DTML method ('userAuthentication'). The DTML method simply would contain the following: <dtml-return "MyRadius(username=username,password=password)">

Security

No rights are needed on the acl_users folder in order to log in. To ensure that no one can access your security information, you should keep all the hooks, methods and objects required for authentication inside the acl_users folder and perform the following steps:

  1. Go to the Security tab on the management screen of your GenericUserFolder.
  2. Uncheck any 'Acquire permission settings?' checkboxes that are selected.
  3. Ensure that the Manager role has access to all permissions
  4. Ensure that no other roles have been granted any permissions
  5. Click on the 'Change' button down the very bottom

It is possible to use aquisition to locate hooks (eg. sharing a ZSQL DA in the root folder amongst a number of GenericUserFolders), but you will need to be careful about permissions on these objects.

Don't give your users access to create GenericUserFolders. It is a trivial excercise to steal passwords if you have this permission.

Login/Logout screens

The GenericUserFolder has methods called 'login' and 'logout' which expire the cached authentication information and call the 'docLogin' and 'docLogout' hooks respectivly.

If the URL to the folder containing acl_users is 'http://www.example.com/subsite', then the URL to the logout screen is 'http://www.example.com/subsite/acl_users/logout' and the URL to the login screen in 'http://www.example.com/subsite/acl_users/login'. The login screen will automatically be displayed as soon as a user tries to access a protected resource in the 'subsite' folder or below.

Debug mode

If you are running Zope in Debug mode (with the -D option specified on the command line, which is the default with the Zope 2.0 distributions), then you will see traceback errors on your login screen. If you are not running in Debug mode, then these tracebacks will not be visible (they are still there, but hidden in comments). This is due to the rather odd method that has to be used to display this screen if an unauthorized user tries to access a protected resource. Accessing the login screen URL directly displays a login page without these tracebacks.

currentThread() warnings

These are being generated from python's threading module, as Zope's threads were not created using the newer API. I don't think that they are harmful, and they only appear once per Zope thread.

Todo

  1. Need a way of automatically attaching as a passwordless user with roles depending on the domain they are from. At the moment, do this with a higher level BasicUserFolder (eg. the root BasicUserFolder).
  2. Fix wierdness when running in REMOTE_USER mode (todo with accessing higher-than-guf resources using Anonymous role?)
lib/python/Products/GenericUserFolder/User.py010064400002250000156000000116340701445377100213100ustar00zentsg00002630000002''' $Id: User.py,v 1.5 1999/11/17 07:23:37 zen Exp $ ''' import Globals, App.Undo from string import split,join from base64 import decodestring, encodestring from urllib import quote, unquote from AccessControl.User import BasicUser, BasicUserFolder, \ _remote_user_mode, domainSpecMatch from AccessControl.PermissionRole import _what_not_even_god_should_do import types import whrandom from zLOG import LOG from time import time import sha #def _debug(msg): pass #def _debug(msg): LOG('GUF',0,msg) class User(BasicUser): icon='misc_/GenericUserFolder/User_icon' # Hmm.... def __init__(self, name, guf): self.name =name self._guf = guf self._getRolesRecurse = 0 self._exptime = time() self._rolecache = None self._domaincache = None self.__ = None def getUserName(self): return self.name def _expire(self): t = time() guf = self._guf if t > self._exptime + guf.user_expires: self._rolecache = None self._domaincache = None self.__ = None self._exptime = t + guf.user_expires return 1 return 0 def getRoles(self): '''Return a list of roles this user belongs to''' self._expire() if self._rolecache is not None: return self._rolecache # If our userRoles method needs to access another method, # Zope will call this again, so we need to detect this to # avoid infinite recursion and core dump. Returns a dummy # role. In this special case, you need to assign a proxy # role to the userRoles method so *it* has the required rights, # as since we have no authenticated user yet, there is nowhere else # to get the rights from. The alternative is to allow anonymous # access to the second method, which is not a good thing to # do with your security subsystem :-) if self._getRolesRecurse: return ['Anonymous',] self._getRolesRecurse = 1 if hasattr(self._guf,'userRoles'): data = self._guf.userRoles(self._guf, self._guf.REQUEST, username=self.name) if type(data) == types.StringType: data = split(data) else: data = list(data) if len(data) > 0 and type(data[0] != types.StringType): if hasattr(data[0],'role'): for i in range(0,len(data)): data[i] = data[i].role elif hasattr(data[0],'r'): for i in range(0,len(data)): data[i] = data[i].r if type(data[0] != types.StringType): raise 'Unsupported Type',\ 'userRoles returned an unsupported type' if 'Anonymous' not in data: data.insert(0,'Anonymous') data.sort() #data = tuple(data) # Faster access? NFI self._rolecache = data return data else: LOG('GUF',100,'No userRoles method available') return ['Anonymous',] def getDomains(self): '''Return a list of domains this user can log in from''' self._expire() if self._domaincache is not None: return self._domaincache if hasattr(self._guf,'userDomains'): data = self._guf.userDomains( self._guf, self._guf.REQUEST, username=self.getUserName()) if type(data) == types.StringType: data = split(data) else: data = list(data) if len(data) > 0 and type(data[0] != types.StringType): if hasattr(data[0],'domain'): for i in range(0,len(data)): data[i] = data[i].domain elif hasattr(data[0],'d'): for i in range(0,len(data)): data[i] = data[i].domain if type(data[0] != types.StringType): raise 'Unsupported Type',\ 'userDomains returned an unsupported type' if data and not self._guf.domainSpecValidate(data): raise 'Illegal domain spec (%s) for %s' \ % (str(data),self.getUserName()) self._domaincache = data return data self._domaincache = [] return self._domaincache def authenticate(self, password, request): '''Authenticate a user''' self._expire() #_debug('Authenticating user %s' % self.getUserName()) if not hasattr(self._guf,'userAuthenticate'): LOG('GUF',100,'No userAuthenticate method - %s auth failed' \ % getUserName()) return 0 # Don't even bother checking password if we are from a dud # domain domains=self.getDomains() if domains and not domainSpecMatch(domains,request): return 0 # If we have a cached hash, we can shortcut # Don't bother logging, as we have already logged success # and we don't want too much spam if self.__ is not None: return self.__ == sha.new(password).digest() if self._guf.userAuthenticate(self._guf, request, username=self.getUserName(), password=password): # Log a message - this might spam if not using cookie # authentication? Is tune your logs a good response? I don't # want a toggle to turn this off via the web as it could ease # security breaches LOG('GUF',0,'Successful authentication for user %s (%s)' \ % (self.getUserName(),self._guf.absolute_url())) self.__ = sha.new(password).digest() # Cache the hash only return 1 # Note we can't log failed authentication atempts here due to the # 'stacked' nature of Zope's UserFolders. return 0 lib/python/Products/GenericUserFolder/__init__.py010064400002250000156000000021770701414517600221300ustar00zentsg00002630000002# $Id: __init__.py,v 1.1.1.1 1999/10/27 10:21:39 zen Exp $ # __doc__ = ''' $Id: __init__.py,v 1.1.1.1 1999/10/27 10:21:39 zen Exp $ ''' import GenericUserFolder def initialize(context): try: context.registerClass( GenericUserFolder.GenericUserFolder, constructors=(GenericUserFolder.manage_addGenericUserFolderForm, GenericUserFolder.manage_addGenericUserFolder), icon='folder.gif' ) context.registerBaseClass(GenericUserFolder.GenericUserFolder) context.registerBaseClass(GenericUserFolder.User) except: """If you can't register the product, tell someone. Zope will sometimes provide you with access to "broken product" and a backtrace of what went wrong, but not always; I think that only works for errors caught in your main product module. This code provides traceback for anything that happened in registerClass(), assuming you're running Zope in debug mode.""" import sys, traceback, string type, val, tb = sys.exc_info() sys.stderr.write(string.join( traceback.format_exception(type, val, tb),'')) del type, val, tb lib/python/Products/GenericUserFolder/addGenericUserFolder.dtml010064400002250000156000000016330701414517600247150ustar00zentsg00002630000002 Add Generic User Folder

Add a Generic User Folder

Authentication Type standard basic authentication
cookie-based authentication
Userlist Expires (secs)
User Details Expires (secs)
Inactive Cookie Expires (secs)

lib/python/Products/GenericUserFolder/folder.gif010064400002250000156000000016250701414517600217560ustar00zentsg00002630000002GIF89aPPP@@@@@!,@rH@,Bŋ-JD0F GenericUserFolder Caching
Flush Authentication Tokens (logout everyone)

lib/python/Products/GenericUserFolder/manage_listUsers.dtml010064400002250000156000000010400701414530600241650ustar00zentsg00002630000002 User List

The following users have been defined.

There are no users defined.

lib/python/Products/GenericUserFolder/manage_properties.dtml010064400002250000156000000027410701414517600244020ustar00zentsg00002630000002 Properties

Authentication Type CHECKED> standard basic authentication (and REMOTE_USER based authentication)
CHECKED> cookie-based authentication
Userlist Expires (secs)
User Details Expires (secs)
Inactive Cookie Expires (secs)
lib/python/Products/GenericUserFolder/priv010064400002250000156000000000000701414517600207010ustar00zentsg00002630000002lib/python/Products/GenericUserFolder/user.gif010064400002250000156000000015400701414517600214550ustar00zentsg00002630000002GIF89aPPP@@@@@!,=HA8XPBBpE3>Q#CAN1ȇ !VD`K 1 ;lib/python/Products/GenericUserFolder/templates/004075000002250000156000000000000700555112000217725ustar00zentsg00002630000002lib/python/Products/GenericUserFolder/templates/CVS/004075000002250000156000000000000700555112000224255ustar00zentsg00002630000002lib/python/Products/GenericUserFolder/templates/CVS/Root010064000002250000156000000000230700555112000232640ustar00zentsg00002630000002/share/src/cvsroot lib/python/Products/GenericUserFolder/templates/CVS/Repository010064000002250000156000000001140700555112000245210ustar00zentsg00002630000002rmit/zope/GenericUserFolder/lib/python/Products/GenericUserFolder/templates lib/python/Products/GenericUserFolder/templates/CVS/Entries010064000002250000156000000000130700555112000237510ustar00zentsg00002630000002D/dumb//// lib/python/Products/GenericUserFolder/templates/dumb/004075000002250000156000000000000701411416100227215ustar00zentsg00002630000002lib/python/Products/GenericUserFolder/templates/dumb/CVS/004075000002250000156000000000000701416501300233565ustar00zentsg00002630000002lib/python/Products/GenericUserFolder/templates/dumb/CVS/Root010064000002250000156000000000230700555112000242130ustar00zentsg00002630000002/share/src/cvsroot lib/python/Products/GenericUserFolder/templates/dumb/CVS/Repository010064000002250000156000000001210700555112000254460ustar00zentsg00002630000002rmit/zope/GenericUserFolder/lib/python/Products/GenericUserFolder/templates/dumb lib/python/Products/GenericUserFolder/templates/dumb/CVS/Entries010064000002250000156000000004470701416501300247150ustar00zentsg00002630000002/docLogout.dtml/1.1/Fri Nov 12 23:48:42 1999// /docLogin.dtml/1.2/Mon Nov 15 08:19:43 1999// /userList.dtml/1.1.1.1/Mon Nov 15 23:33:55 1999// /userAuthenticate.dtml/1.5/Mon Nov 15 23:33:36 1999// /userDomains.dtml/1.3/Mon Nov 15 23:33:48 1999// /userRoles.dtml/1.3/Mon Nov 15 23:34:07 1999// D lib/python/Products/GenericUserFolder/templates/dumb/userAuthenticate.dtml010064400002250000156000000006630701411412000271220ustar00zentsg00002630000002 'username' and 'password' are passed to this method Return '1' if 'password' is the correct password for user 'username' Return '0' otherwise Failing to return 0 by default could compromise the security of your Zope installation. lib/python/Products/GenericUserFolder/templates/dumb/userDomains.dtml010064400002250000156000000004170701411413400261000ustar00zentsg00002630000002 'username' is passed to this method Return a list of domains that the given user is allowed to log in from. This can be a real list, or a whitespace seperated list Returning an empty list defaults to any domain lib/python/Products/GenericUserFolder/templates/dumb/userList.dtml010064400002250000156000000005410701411414300254170ustar00zentsg00002630000002 Return a list of usernames. This can either be a real list:: or just usernames seperated by whitespace:: fred jorge or a list of objects defining either the 'username' or 'uname' attribute (useful if you replace this DTML method with a ZSQL method or Tiny Table) fred jorge lib/python/Products/GenericUserFolder/templates/dumb/userRoles.dtml010064400002250000156000000007710701411415700256020ustar00zentsg00002630000002 'username' is passed to this method. Return a list of roles for the given user. This may either be a real list:: or a whitespace seperated word list Note that roles returned by this method will have little effect unless a role with the same name exists in the Zope tree and has been granted priviledges. See the Zope Content Managers Guide for details. specialrole defaultrole lib/python/Products/GenericUserFolder/templates/dumb/docLogin.dtml010064000002250000156000000025260701374103700253530ustar00zentsg00002630000002 Login If you reference any Zope objects from here (eg. standard_html_header), you will need to make sure that they are either accessible by the Anonymous role, or this method has a proxy role with enough permissions. This form should always use METHOD=POST, as otherwise you might find your usernames & passwords embedded as cleartext in someones proxy server. The variable names _gufauth_name and _gufauth_password are required - if you need to pass blanks, use fields.

Login

You will need to login before you can continue

Name
Password
lib/python/Products/GenericUserFolder/templates/dumb/docLogout.dtml010064000002250000156000000010110701312353200255320ustar00zentsg00002630000002 Logout Note that the authentication cookie has already been flagged for destruction before getting here. If this method raises an exception, the user will not be logged out, as the request to destroy the authentication cookie will not be passed onto the browser. This method is rendered whilst still logged in.

You have been logged out of the system.
lib/python/Products/GenericUserFolder/version.txt010064400002250000156000000000060701421071400222210ustar00zentsg000026300000021-0-0 lib/python/Products/GenericUserFolder/manage_userInfo.dtml010064400002250000156000000017240701414533600237760ustar00zentsg00002630000002 User Information
Username:
Roles:
None
Domains:
Anywhere

User does not exist in this authenticator

Username:

lib/python/Products/GenericUserFolder/GenericUserFolder.py010064400002250000156000000441140701616046400237340ustar00zentsg00002630000002''' $Id: GenericUserFolder.py,v 1.13 1999/11/17 07:23:37 zen Exp $ ''' import Globals, App.Undo from Globals import HTMLFile, MessageDialog from string import split,join from Acquisition import Implicit from OFS.SimpleItem import Item from OFS.Document import Document from base64 import decodestring, encodestring from urllib import quote, unquote from ImageFile import ImageFile from AccessControl.Role import RoleManager from AccessControl.User \ import BasicUser, BasicUserFolder, _remote_user_mode,nobody from AccessControl.PermissionRole import _what_not_even_god_should_do from OFS.Folder import Folder from time import time import types import sha import whrandom import Globals import threading from zLOG import LOG from User import User # Our user object # Moved to thread shared caches rather than _v_ variables for everything, # as this allows us to flush our caches _hashmap = {} # _hashmap[gufid][hash] == (username,lastseentime) _expires = {} _usermapcache = {} _usernamecache = {} _userlistcache = {} _lock = {} _locklock = threading.RLock() # A lock for the _lock map for catch22 # concurrency paranoia. def _clen(obj = None): 'GenericUserFolder.cachestats helper function' if obj is None: return 0 else: return len(obj) def _debug(msg): pass #def _debug(msg): LOG('GUF',0,msg) class GenericUserFolder(Folder,BasicUserFolder): '''A Generic User authentication userlist''' meta_type='Generic User Folder' id ='acl_users' title ='Generic User Folder' icon ='misc_/GenericUserFolder/Folder_icon' isPrincipiaFolderish=1 isAUserFolder=1 isAGenericUserFolder=1 __ac_permissions__=( ('View management screens', ['cachestats','flushcache','manage_cache'],['Manager',]), ('Manage users', ['getUserNames','getUser','getUsers','manage_listUsers', 'manage_userInfo','manage_main'],['Manager',]), ('Manage properties', ['manage_edit','manage_properties'],['Manager',]), ('Can Login and Logout', ['login','logout'],['Anonymous','Manager'])) manage_options=( {'label':'Contents', 'action':'manage_main'}, {'label':'User List', 'action':'manage_listUsers'}, {'label':'Cache', 'action':'manage_cache'}, {'label':'User Info', 'action':'manage_userInfo'}, {'label':'Properties', 'action':'manage_properties'}, {'label':'Security', 'action':'manage_access'}, {'label':'Undo', 'action':'manage_UndoForm'} ) manage_properties=HTMLFile('manage_properties', globals()) manage_listUsers=HTMLFile('manage_listUsers',globals()) manage_userInfo=HTMLFile('manage_userInfo',globals()) manage_cache=HTMLFile('manage_cache',globals()) _gufid = None def __init__(self, cookie_mode=0, REQUEST=None): self.cookie_mode=cookie_mode self.userlist_expires=900 self.user_expires=900 self.cookie_expires=900 self.roles = ['Anonymous',] # Do we already have a unique, unchanging ID per object? self._gufid = encodestring(sha.new('%f%f%s%s' \ % (time(),whrandom.random(),str(self),str(REQUEST))).digest()) self._init_caches() def __setstate__(self,state): "Initialize on reload from ZODB" Folder.__setstate__(self,state) self._init_caches() def _init_caches(self): gufid = self._gufid _locklock.acquire() try: if not _lock.has_key(gufid): _lock[gufid] = threading.RLock() _expires[gufid] = 0 _usermapcache[gufid] = {} _usernamecache[gufid] = None _userlistcache[gufid] = None _hashmap[gufid] = {} finally: _locklock.release() def _expire(self,flush=0): '''Expire old objects. We do lots of caching, as the methods we use to populate our userfolder could be very, very expensive. Especially for those of us integrating with badly designed databases :-)''' gufid = self._gufid _lock[gufid].acquire() try: if flush or time() > _expires[gufid] + self.user_expires: _expires[gufid] = time() _usernamecache[gufid] = None _userlistcache[gufid] = None if flush: _usermapcache[gufid] = {} else: # Create a thread to do this if it blocks for too long usermap = _usermapcache[gufid] for k in usermap.keys(): if (usermap[k] is None) or usermap[k]._expire(): del usermap[k] hashmap = _hashmap[gufid] for k in hashmap.keys(): if time() > hashmap[k][1] + self.cookie_expires: del hashmap[k] finally: _lock[gufid].release() def cachestats(self): 'Return meaningless statistics' gufid = self._gufid _lock[gufid].acquire() try: self._expire() ulexpire = str(_expires[gufid] + self.userlist_expires - time()) return (\ {'text': 'Items in Authorization Token cache', 'value': _clen(_hashmap[gufid])}, {'text': 'Cached User objects', 'value': _clen(_usermapcache[gufid])}, {'text': 'Items in getUserNames cache', 'value': _clen(_usernamecache[gufid])}, {'text': 'Items in getUsers cache', 'value': _clen(_userlistcache[gufid])}, {'text': 'Seconds until userlist expiry', 'value': str(ulexpire)}, {'text':'Seconds for unseen Authentication token to expire', 'value': self.cookie_expires}, {'text': 'Seconds before a cached user is expired', 'value': self.user_expires}) finally: _lock[gufid].release() def flushcache(self,REQUEST): 'Flush the caches' gufid = self._gufid _lock[gufid].acquire() try: self._expire(1) if REQUEST.has_key('flushcookies') and REQUEST.flushcookies: _hashmap[gufid] = {} LOG('GUF',0,"Authentication tokens flushed by %s" \ % REQUEST.AUTHENTICATED_USER.getUserName()) finally: _lock[gufid].release() if REQUEST: return MessageDialog( title ='GenericUserFolder Caches Flushed', message='GenericUserFolder caches have been flushed', action = './manage_cache') def getUserNames(self): '''Returns a list of user names or [] if no users exist''' gufid = self._gufid _lock[gufid].acquire() try: self._expire() if _usernamecache[gufid] is not None: return _usernamecache[gufid] if hasattr(self,'userList'): data = self.userList(self,self.REQUEST) if type(data) == types.StringType: data = split(data) data = list(data) if len(data) > 0 and type(data[0]) != types.StringType: if hasattr(data[0],'username'): for i in range(0,len(data)): data[i] = data[i].username elif hasattr(data[0],'uname'): for i in range(0,len(data)): data[i] = data[i].uname if type(data[0]) != types.StringType: raise 'Unsupported Type',\ 'userList method returned an unsupported type' else: _usernamecache[gufid] = [] return _usernamecache[gufid] data.sort() _usernamecache[gufid] = data return data finally: _lock[gufid].release() def getUsers(self): """Return a list of user objects or [] if no users exist""" gufid = self._gufid _lock[gufid].acquire() try: # Expire caches if necessary self._expire() # If we have a valid cached version, return it if _userlistcache[gufid] is not None: return _userlistcache[gufid] data = self.getUserNames() # Note this is sorted already userlist = [] usermap = _usermapcache[gufid] for name in data: if usermap.has_key(name): user = usermap[name] else: user = User(name,self) usermap[name] = user user = user.__of__(self) userlist.append(user) _userlistcache[gufid] = userlist return userlist finally: _lock[gufid].release() def getUser(self, name): """Return the named user object or None if no such user exists""" gufid = self._gufid _lock[gufid].acquire() try: self._expire() cache = _usermapcache[gufid] # Special case for the superuser. Useless unless we can # somehow make this the top folder. super = self._super if self._isTop() and (name==super.getUserName()): return super if cache.has_key(name): return cache[name] data = self.getUserNames() if name in data: user = User(name,self) cache[name] = user user = user.__of__(self) return user else: cache[name] = None return None finally: _lock[gufid].release() def _stashhash(self,username,passwd,request): '''stash the hash in our _hashmap cache. Set the cookie.''' gufid = self._gufid response = request['RESPONSE'] hash = encodestring(sha.new('%s%s%f%f%s' \ % (username,passwd,time(),whrandom.random(),str(request))).digest()) hashmap = _hashmap[gufid] # The Universe will probably end before a sha hash isn't unique, # but call me paranoid while hashmap.has_key(hash): hash = encode_string(decode_string(hash) \ + chr(whrandom.randint(ord('A'),ord('Z')))) hashmap[hash] = [username,time()]# List rather than tuple so its mutable # TODO: Calculate path so that cookie only gets passed to the # acl_users folder's parent folder and below? response.setCookie('_gufauth',quote(hash),path='/') def _recurse_validate(self,request,auth,roles,\ username=None,passwd=None,hash=None): '''Try validating locally, or crawl up the tree until we succeed or reach the top''' gufid = self._gufid # Check from BasicUserFolder.validate. I don't actually know # what it does except that in some circumstances it will deny # access (better safe than sorry) if roles is _what_not_even_god_should_do: _debug('_what_not_even_god_should_do request') request.response.notFoundError() parents = [] if request.has_key('PARENTS'): parents=request['PARENTS'] parent=parents[0] else: parent=self.aq_parent # If we have a password, then someone has just submitted the login # form if passwd is not None: user = self.getUser(username) if user is not None and user.authenticate(passwd,request) \ and user.allowed(parent,roles): self._stashhash(username,passwd,request) _debug('Authenticated %s using _guf_password field' \ % user.getUserName()) return user # If we have a hash, then we are confirming the validity of a cookie if hash is not None: hashmap = _hashmap[gufid] _lock[gufid].acquire() try: # If we are using cookie authentication, check our hashmap # stash. We do it this way so that our hashes are shared # between threads (otherwise, you would have to authenticate # once for each thread that handles one of your requests). if hashmap.has_key(hash): if time() > hashmap[hash][1] + self.cookie_expires: # Our cookie has expired! del hashmap[hash] else: # Update our lastseen time hashmap[hash][1] = time() username = hashmap[hash][0] user = self.getUser(username) if user is not None and user.allowed(parent,roles): _debug('Cookie authorized for %s' \ % user.getUserName()) return user finally: _lock[gufid].release() # We have failed to validate here. We now need to climb the # tree and try validating with other acl_users folders. # Although Zope also does this, we can't use it: The only way # of displaying a nice HTML login screen is by throwing an exception # out of the validate method, which has the side effect of causing # 'higher' acl_users folders to not be checked. # # Other UserFolder products that handle cookies (etcUserFolder and # UserDB) will just return 'None' from this function if auth is # not none - however, this doesn't work with REMOTE_USER # authentication. return None if auth is not None and auth != '': _debug('Auth set - returning None from _recurse_validate') return None lastuserfolder = self if hasattr(parent,'aq_parent'): c = parent.aq_parent while c is not None: if hasattr(c,'aq_explicit') \ and hasattr(c.aq_explicit,'acl_users'): u = c.aq_explicit.acl_users # This check is probably just paranoia if u.absolute_url() != lastuserfolder.absolute_url(): #_debug("Found new acl_users: %s" % u.absolute_url()) lastuserfolder = u if hasattr(u,'isAGenericUserFolder'): # If we find a GUF above, we won't need to # crawl up any further as its validate method # will do it for us user = u.validate(request,auth,roles) if user: return user else: return None if hasattr(u,'isAUserFolder') and u.isAUserFolder: user = u.validate(request,auth,roles) if user: return user if hasattr(c,'aq_parent'): c = c.aq_parent else: c = None return None def _cookie_validate(self,request,auth,roles=None): response=request['RESPONSE'] cname = '_gufauth' nameparm = cname + '_name' passparm = cname + '_password' username = None password = None hash = None gufid = self._gufid if request.form.has_key(nameparm): # # Pull username & cleartext from form input. # Ensure cleartext isn't left in the REQUEST for # malicious DTML # username = request[nameparm] del request.form[nameparm] request[nameparm] = 'This space intentionally blank' if request.form.has_key(passparm): password = request[passparm] del request.form[passparm] request[passparm] = 'This space intentionally blank' e = request.environ if _remote_user_mode and e.has_key('REMOTE_USER'): username = e['REMOTE_USER'] _debug('REMOTE_USER mode detected - forcing username to %s' % username) if request.cookies.has_key(cname): # Pull username & hash from cookie hash = unquote(request.cookies[cname]) if username is not None and password is not None: # # Try validating with username & password, or fall through to # using 'auth' on our parent folders. # user = self._recurse_validate(request,auth,roles,username,password) if user is not None: # If user is relogging in again, nuke their # old cookie right now if hash is not None: try: del _hashmap[gufid][hash] except KeyError: pass return user if hash is not None: user = self._recurse_validate(request,auth,roles,hash=hash) if user: return user else: response.expireCookie('_gufauth', path='/') if auth is not None and auth != '': return None # We can log a message here, as we already have tried to authenticate # against 'higher' acl_users folders. A nice side effect of having # to do this work ourselves. This log message might mean a bad # password, or a valid user trying to access something they have # no rights to see. if username is not None and username != '': LOG('GUF',0,'Failed authorization for user %s (%s)' \ % (username,self.absolute_url())) raise 'LoginRequired', self.docLogin(self, request) def validate(self,request,auth='',roles=None): # No docstring for a reason _debug('Validate auth=%s,roles=%s' % (str(auth),str(roles))) # Two days later, I finally get a work around. If I get None # passed as the auth information, fake a Basic Authentication # auth string for no username and no password. I still don't # understand why this is needed or why it is working, but I have # other projects to get going on... # # If you are feeling brave, comment out the next two lines. # Then authentication to a GUF section of your web site and try # and access object/manage_workspace. # #if auth is None: # auth = 'Basic Og==' if auth is None: auth = '' if self.cookie_mode: u = self._cookie_validate(request, auth, roles) else: u = BasicUserFolder.validate(self,request, auth, roles) return u def __len__(self): return len(self.getUserNames()) def manage_edit(self, cookie_mode, userlist_expires,user_expires, cookie_expires, REQUEST=None): """Change properties""" self.cookie_mode=cookie_mode self.userlist_expires=userlist_expires self.user_expires=user_expires self.cookie_expires=cookie_expires if REQUEST: return MessageDialog( title ='GenericUserFolder Changed', message='GenericUserFolder properties have been updated', action =REQUEST['URL1']+'/manage_properties', target ='manage_main') # Multiple inheritance wierdness # def manage_beforeDelete(self,item,container): Folder.manage_beforeDelete(self,item,container) BasicUserFolder.manage_beforeDelete(self,item,container) def manage_afterAdd(self,item,container): Folder.manage_afterAdd(self,item,container) BasicUserFolder.manage_afterAdd(self,item,container) def _killcookie(self,request): 'Helper method to login and logoff' if not self.cookie_mode: raise 'Method only works in cookie mode' cname='_gufauth' if request.cookies.has_key(cname): # Pull username & hash from cookie hash = unquote(request.cookies[cname]) del _hashmap[self._gufid][hash] request['RESPONSE'].expireCookie(cname,path='/') def login(self, REQUEST): """Login""" self._killcookie(REQUEST) return self.docLogin(self, REQUEST) def logout(self, REQUEST): """Logout""" self._killcookie(REQUEST) return self.docLogout(self, REQUEST) def _templateFile(self,file,title='',template='dumb'): t = HTMLFile('templates/%s/%s' % (template,file),globals()) self.manage_addDTMLMethod(file,title,t) def _templateReset(self, template='dumb'): self._templateFile('userList','List Users',template) self._templateFile('userRoles',"Return a user's roles",template) self._templateFile('userDomains','Return domains a user can login from', template) self._templateFile('userAuthenticate','Authenticate a user',template) self._templateFile('docLogin','Cookie mode login screen',template) self._templateFile('docLogout','Cookie mode logout screen',template) manage_addGenericUserFolderForm=HTMLFile('addGenericUserFolder', globals()) def manage_addGenericUserFolder(self,cookie_mode=0, template='dumb',REQUEST=None): 'Create a GenericUserFolder object' if hasattr(self.aq_base, 'acl_users'): return MessageDialog( title ='Item Exists', message='This object already contains a User Folder', action ='%s/manage_main' % REQUEST['PARENT_URL']) ob=GenericUserFolder(cookie_mode, REQUEST) self._setObject('acl_users', ob) self.__allow_groups__=self.acl_users ob._templateReset(template) if REQUEST: return self.manage_main(self,REQUEST,update_menu=1) lease() def _stashhash(self,username,passwd,request): '''stash the hash in our _hashmap cache. Set the cookie.''' gufid = self._gufid response = request['RESPONSE'] hash = encodestring(sha.new('%s%s%f%f%s' \ % (username,passwd,time(),whrandom.random(),str(request))).digest()) hashmap = _hashmap[gufid] # The Universe will probably end before a sha hash isn't unique, # but call me paranoid while hashmap.has_key(h