sso/auth.py

import ldap
import logging
import re
from datetime import datetime, timedelta


from cached_property import cached_property
import flask
from flask import Flask, render_template, make_response, flash, redirect, url_for
from flask_oauthlib.provider import OAuth2Provider
from flask_login import LoginManager, login_user, logout_user, \
    login_required, current_user
from flask_sqlalchemy import SQLAlchemy
from flask_wtf import FlaskForm
from wtforms import StringField, PasswordField, BooleanField
from wtforms.validators import DataRequired
import requests


logging.basicConfig(level=logging.DEBUG, format='[%(asctime)-15s] %(name)-10s %(levelname)7s: %(message)s')
app = Flask('auth')
app.config.from_object(__name__)
app.config.from_pyfile('auth.cfg')
oauth = OAuth2Provider(app)
login_manager = LoginManager()
login_manager.init_app(app)
login_manager.login_view = '/login'
db = SQLAlchemy(app)


class Client(db.Model):
    # human readable name
    name = db.Column(db.String(40))
    # human readable description
    description = db.Column(db.String(400))

    client_id = db.Column(db.String(40), primary_key=True)
    client_secret = db.Column(db.String(55), unique=True, index=True,
                              nullable=False)

    # public or confidential
    is_confidential = db.Column(db.Boolean)

    redirect_uris_ = db.Column(db.Text)
    default_scopes_ = db.Column(db.Text)

    # TODO
    # approved = db.Column(db.Boolean, default=False)
    approved = True

    @property
    def client_type(self):
        if self.is_confidential:
            return 'confidential'
        return 'public'

    @property
    def redirect_uris(self):
        if self.redirect_uris_:
            return self.redirect_uris_.split()
        return []

    @property
    def default_redirect_uri(self):
        return self.redirect_uris[0]

    @property
    def default_scopes(self):
        if self.default_scopes_:
            return self.default_scopes_.split()
        return []

    def validate_scopes(self, scopes):
        return {'profile:read', 'profile:write', 'password:write', \
                'users:read'}.issuperset(scopes)


class Grant(db.Model):
    id = db.Column(db.Integer, primary_key=True)

    user = db.Column(db.String(40), nullable=False)

    client_id = db.Column(
        db.String(40), db.ForeignKey('client.client_id'),
        nullable=False,
    )
    client = db.relationship('Client')

    code = db.Column(db.String(255), index=True, nullable=False)

    redirect_uri = db.Column(db.String(255))
    expires = db.Column(db.DateTime)

    _scopes = db.Column(db.Text)

    def delete(self):
        db.session.delete(self)
        db.session.commit()
        return self

    @property
    def scopes(self):
        if self._scopes:
            return self._scopes.split()
        return []


class Token(db.Model):
    id = db.Column(db.Integer, primary_key=True)
    client_id = db.Column(
        db.String(40), db.ForeignKey('client.client_id'),
        nullable=False,
    )
    client = db.relationship('Client')

    user = db.Column(
        db.String(40), nullable=False
    )

    # currently only bearer is supported
    token_type = db.Column(db.String(40))

    access_token = db.Column(db.String(255), unique=True)
    refresh_token = db.Column(db.String(255), unique=True)
    expires = db.Column(db.DateTime)
    _scopes = db.Column(db.Text)

    def delete(self):
        db.session.delete(self)
        db.session.commit()
        return self

    @property
    def scopes(self):
        if self._scopes:
            return self._scopes.split()
        return []


def connect_to_ldap():
    conn = ldap.initialize(app.config['LDAP_URL'])
    conn.start_tls_s()
    conn.simple_bind(app.config['LDAP_BIND_DN'], app.config['LDAP_BIND_PASSWORD'])
    return conn

def check_credentials(username, password):
    conn = ldap.initialize(app.config['LDAP_URL'])
    conn.start_tls_s()
    try:
        conn.simple_bind_s(app.config['DN_STRING'] % username, password)
        return True
    except ldap.LDAPError:
        return False



@oauth.clientgetter
def load_client(client_id):
    return Client.query.filter_by(client_id=client_id).first()


@oauth.grantgetter
def load_grant(client_id, code):
    return Grant.query.filter_by(client_id=client_id, code=code).first()


@oauth.grantsetter
def save_grant(client_id, code, request, *args, **kwargs):
    # decide the expires time yourself
    expires = datetime.utcnow() + timedelta(seconds=100)
    grant = Grant(
        client_id=client_id,
        code=code['code'],
        redirect_uri=request.redirect_uri,
        _scopes=' '.join(request.scopes),
        user=current_user.username,
        expires=expires
    )
    db.session.add(grant)
    db.session.commit()
    return grant


@oauth.tokengetter
def load_token(access_token=None, refresh_token=None):
    if access_token:
        return Token.query.filter_by(access_token=access_token).first()
    elif refresh_token:
        return Token.query.filter_by(refresh_token=refresh_token).first()


@oauth.tokensetter
def save_token(token, request, *args, **kwargs):
    toks = Token.query.filter_by(client_id=request.client.client_id,
                                 user=request.user)
    # make sure that every client has only one token connected to a user
    for t in toks:
        db.session.delete(t)

    expires_in = token.get('expires_in')
    expires = datetime.utcnow() + timedelta(seconds=expires_in)

    tok = Token(
        access_token=token['access_token'],
        refresh_token=token.get('refresh_token'),
        token_type=token['token_type'],
        _scopes=token['scope'],
        expires=expires,
        client_id=request.client.client_id,
        user=request.user,
    )
    db.session.add(tok)
    db.session.commit()
    return tok


@app.route('/oauth/authorize', methods=['GET', 'POST'])
@login_required
@oauth.authorize_handler
def authorize(*args, **kwargs):
    form = FlaskForm()

    if Token.query.filter(
            Token.client_id == kwargs.get('client_id'),
            Token.user == current_user.username).count():
        # User has unrevoked token already - grant by default
        return True

    if not form.validate_on_submit():
        client_id = kwargs.get('client_id')
        client = Client.query.filter_by(client_id=client_id).first()
        kwargs['client'] = client
        kwargs['user'] = current_user
        kwargs['form'] = form
        return render_template('oauthorize.html', **kwargs)

    confirm = flask.request.form.get('confirm', 'no')
    return confirm == 'yes'


@app.route('/oauth/token', methods=['GET', 'POST'])
@oauth.token_handler
def access_token():
    return None


class LDAPUserProxy(object):
    def __init__(self, username):
        self.username = re.sub(app.config['STRIP_RE'], '', username)
        self.is_authenticated = True
        self.is_anonymous = False
        conn = connect_to_ldap()
        res = conn.search_s(app.config['PEOPLE_BASEDN'], ldap.SCOPE_SUBTREE,
                app.config['UID_LDAP_FILTER'] % self.username)
        if len(res) != 1:
            raise Exception('No such username.')
        dn, data = res[0]

        self.username = data.get('uid', [None,])[0]
        self.gecos = data.get('gecos', [None, ])[0]
        self.mifare_hashes = data.get('mifareIDHash', [])
        self.phone = data.get('mobile', [None, ])[0]
        self.personal_email = data.get('mailRoutingAddress', [])

    def __repr__(self):
        active = 'active' if self.is_active else 'inactive'
        return '<LDAPUserProxy {}, {}>'.format(self.username, active)


    @property
    def email(self):
        return self.username + '@hackerspace.pl'

    @cached_property
    def is_active(self):
        url = 'https://kasownik.hackerspace.pl/api/judgement/{}.json'
        try:
            r = requests.get(url.format(self.username))
            return bool(r.json()['content'])
        except Exception as e:
            logging.error("When getting data from Kasownik: {}".format(e))
            # Fail-safe.
            return True

    @cached_property
    def is_staff(self):
        url = 'https://capacifier.hackerspace.pl/staff/{}'
        try:
            r = requests.get(url.format(self.username))
            return 'YES' in r.text
        except Exception as e:
            logging.error("When getting data from Capacifier: {}".format(e))
            return False

    def get_id(self):
        return self.username


class LoginForm(FlaskForm):
    username = StringField('username', validators=[DataRequired()])
    password = PasswordField('password', validators=[DataRequired()])
    remember = BooleanField('remember me')


@app.route('/')
@app.route('/profile')
@login_required
def profile():
    return render_template('profile.html', tokens=Token.query.filter(Token.user == current_user.username))


@app.route('/token/<int:id>/revoke', methods=['POST'])
@login_required
def token_revoke(id):
    token = Token.query.filter(Token.user == current_user.username, Token.id == id).first()
    if not token:
        flask.abort(404)
    token.delete()
    return redirect('/')


@app.route('/login', methods=['GET', 'POST'])
def login():
    form = LoginForm()
    next = flask.request.args.get('next')
    if form.validate_on_submit():
        username, password = form.data['username'], form.data['password']
        if not check_credentials(username, password):
            flash('Invalid username or password')
            return render_template('login_oauth.html', form=form, next=next)
        user = LDAPUserProxy(username)
        if not user.is_active:
            flash('User inactive - have you paid your membership fees?')
            return render_template('login_oauth.html', form=form, next=next)

        login_user(user, form.data['remember'])
        flash('Logged in successfully.')

        return redirect(next or url_for('profile'))

    return render_template('login_oauth.html', form=form, next=next)

@app.route('/logout')
def logout():
    logout_user()
    return redirect('/')


@login_manager.user_loader
def load_user(user_id):
    return LDAPUserProxy(user_id)


# HSWAW specific endpoint
@app.route('/api/profile')
@app.route('/api/1/profile')
@oauth.require_oauth('profile:read')
def api_profile():
    user = LDAPUserProxy(flask.request.oauth.user)
    return flask.jsonify(
            email=user.email, username=user.username,
            gecos=user.gecos, phone=user.phone,
            personal_email=user.personal_email)


# OpenIDConnect userinfo
@app.route('/api/1/userinfo')
@oauth.require_oauth('profile:read')
def api_userinfo():
    user = LDAPUserProxy(flask.request.oauth.user)
    groups = []
    if user.is_staff:
        groups.append('staff')
    return flask.jsonify(sub=user.username, name=user.gecos, email=user.email,
                         preferred_username=user.username, nickname=user.username,
                         user_name=user.username, user_id=user.username, groups=groups)


if __name__ == '__main__':
    app.run('0.0.0.0', 8082, debug=True)