-
Notifications
You must be signed in to change notification settings - Fork 5
/
Copy pathsecurity.py
210 lines (181 loc) · 8.2 KB
/
security.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
import logging
import warnings
from typing import TYPE_CHECKING
# openid warnings about deprecated 'defusedxml.cElementTree' when trying to find any available implementation
# explicitly marked as safe by openid package, must filter before any import to avoid raising warning
# flake8: noqa: E402
# pylint: disable=C0413
warnings.filterwarnings("ignore", category=DeprecationWarning, module="openid") # isort:skip # noqa: E402
from authomatic import Authomatic, provider_id
from authomatic.providers import oauth2, openid
from pyramid.authentication import AuthTktAuthenticationPolicy
from pyramid.authorization import ACLAuthorizationPolicy
from pyramid.config import Configurator
from pyramid.settings import asbool
from ziggurat_foundations.models import groupfinder
from magpie.api.login import esgfopenid, wso2
from magpie.constants import get_constant
from magpie.models import RootFactory
from magpie.utils import get_logger, get_settings
if TYPE_CHECKING:
# pylint: disable=W0611,unused-import
from typing import List, Optional
from magpie.typedefs import JSON, AnySettingsContainer, Str
AUTHOMATIC_LOGGER = get_logger("magpie.authomatic", level=logging.DEBUG)
LOGGER = get_logger(__name__)
def mask_credentials(container, redact="[REDACTED]", flags=None, parent=None):
# type: (JSON, Str, Optional[List[Str]], Optional[Str]) -> JSON
"""
Masks away any credential matched against :paramref:`flags` recursively from JSON :paramref:`container`.
Matched credential entries are replaced by :paramref:`redact`. List items are all replaced by the same
:paramref:`redact` when their :paramref:`parent` field name is matched.
:param container: JSON container to mask.
If starting with a list on top-level, first level children will not be masked unless parent is provided.
:param redact: string by which to replace flagged fields.
:param flags: field names (partial matches) to flag for masking.
:param parent: reference to contained elements if in a listing format rather than mapping.
:return: masked credentials JSON container.
"""
flags = flags or ["password", "pwd"]
def flagged(_compare):
if isinstance(_compare, (dict, tuple, list, set, type(None))):
return False
return any(_flag in _compare for _flag in flags)
if isinstance(container, (list, tuple, set)):
for i, item in enumerate(container):
container[i] = mask_credentials(item, redact=redact, flags=flags, parent=parent)
return container
if isinstance(container, dict):
for key in list(container):
container[key] = mask_credentials(container[key], redact=redact, flags=flags, parent=key)
return container
if flagged(parent):
return redact
return container
def get_auth_config(container):
# type: (AnySettingsContainer) -> Configurator
"""
Generates Magpie application configuration with all utilities required for security and access control.
"""
settings = get_settings(container)
magpie_secret = get_constant("MAGPIE_SECRET", settings, settings_name="magpie.secret")
magpie_cookie_expire = get_constant("MAGPIE_COOKIE_EXPIRE", settings,
settings_name="magpie.cookie_expire", default_value=None,
raise_missing=False, raise_not_set=False, print_missing=True)
magpie_cookie_name = get_constant("MAGPIE_COOKIE_NAME", settings,
settings_name="magpie.cookie_name", default_value="auth_tkt",
raise_missing=False, raise_not_set=False, print_missing=True)
LOGGER.debug("************************************************************")
LOGGER.debug("Secret: %s, Cookie name: %s, Timeout: %s", magpie_secret, magpie_cookie_name, magpie_cookie_expire)
LOGGER.debug("************************************************************")
authn_policy = AuthTktAuthenticationPolicy(
magpie_secret,
cookie_name=magpie_cookie_name,
callback=groupfinder,
# Protect against JavaScript CSRF attacks attempting cookies retrieval
http_only=True,
# Automatically refresh the cookie unless inactivity reached 'timeout'
timeout=magpie_cookie_expire,
max_age=magpie_cookie_expire,
reissue_time=int(magpie_cookie_expire) / 10 if magpie_cookie_expire else None,
)
authz_policy = ACLAuthorizationPolicy()
# create configurator or use one defined as input to preserve previous setup/include/etc.
config = Configurator() if not isinstance(container, Configurator) else container
config.setup_registry(
settings=settings,
root_factory=RootFactory,
authentication_policy=authn_policy,
authorization_policy=authz_policy
)
return config
def authomatic_setup(request):
magpie_secret = get_constant("MAGPIE_SECRET", request, settings_name="magpie.secret")
return Authomatic(
config=authomatic_config(request),
secret=magpie_secret,
logger=AUTHOMATIC_LOGGER,
report_errors=True,
logging_level=AUTHOMATIC_LOGGER.level
)
def authomatic_config(request=None):
defaults_config = {
"popup": True,
}
openid_config = {
"openid": {
"class_": openid.OpenID,
"display_name": "OpenID",
},
}
esgf_config = {
"dkrz": {
"class_": esgfopenid.ESGFOpenID,
"hostname": "esgf-data.dkrz.de",
"provider_url": "https://{hostname}/esgf-idp/openid/{username}",
"display_name": "DKRZ",
},
"ipsl": {
"class_": esgfopenid.ESGFOpenID,
"hostname": "esgf-node.ipsl.upmc.fr",
"display_name": "IPSL",
},
# former "badc"
"ceda": {
"class_": esgfopenid.ESGFOpenID,
"hostname": "esgf-index1.ceda.ac.uk",
"provider_url": "https://{hostname}/openid/{username}",
"display_name": "CEDA",
},
# former "pcmdi"
"llnl": {
"class_": esgfopenid.ESGFOpenID,
"hostname": "esgf-node.llnl.gov",
"display_name": "LLNL",
},
"smhi": {
"class_": esgfopenid.ESGFOpenID,
"hostname": "esg-dn1.nsc.liu.se",
"display_name": "SMHI",
},
}
_get_const_info = dict(raise_missing=False, raise_not_set=False, print_missing=True)
oauth2_config = {
"github": {
"class_": oauth2.GitHub,
"display_name": "GitHub",
"consumer_key": get_constant("GITHUB_CLIENT_ID", **_get_const_info),
"consumer_secret": get_constant("GITHUB_CLIENT_SECRET", **_get_const_info),
"redirect_uri": request.application_url if request else None,
# "redirect_uri": "{}/providers/github/signin".format(request.application_url) if request else None,
"access_headers": {"User-Agent": "Magpie"},
"id": provider_id(),
"_apis": {},
},
"wso2": {
"class_": wso2.WSO2,
"display_name": "WSO2",
"hostname": get_constant("WSO2_HOSTNAME", **_get_const_info),
"consumer_key": get_constant("WSO2_CLIENT_ID", **_get_const_info),
"consumer_secret": get_constant("WSO2_CLIENT_SECRET", **_get_const_info),
"certificate_file": get_constant("WSO2_CERTIFICATE_FILE", **_get_const_info) or None, # replace if == ""
"ssl_verify": asbool(get_constant("WSO2_SSL_VERIFY", default_value=True, **_get_const_info)),
"redirect_uri": "{}/providers/wso2/signin".format(request.application_url) if request else None,
"id": provider_id(),
}
}
# Concatenate the configs.
config = {} # type: JSON
config.update(oauth2_config)
config.update(openid_config)
config.update(esgf_config)
config["__defaults__"] = defaults_config
return config
def get_providers():
# type: () -> JSON
provider_configs = {}
config = authomatic_config()
for provider, provider_cfg in config.items():
if provider != "__defaults__":
provider_configs[provider.lower()] = provider_cfg.get("display_name", provider)
return provider_configs