blob: 8971f431a352be35e195cf1dcedfc34c76f76eba [file] [log] [blame]
mblighe8819cd2008-02-15 16:48:40 +00001from django.contrib.auth.models import User, Group, check_password
showarda5288b42009-07-28 20:06:08 +00002from django.contrib.auth import backends
mblighe8819cd2008-02-15 16:48:40 +00003from django.contrib import auth
4from django import http
5
Hsinyu Chaoe0b08e62015-08-11 10:50:37 +00006from autotest_lib.client.cros import constants
showarda5288b42009-07-28 20:06:08 +00007from autotest_lib.frontend import thread_local
8from autotest_lib.frontend.afe import models, management
Simran Basi85f4c362014-04-08 13:40:57 -07009from autotest_lib.server import utils
mblighe8819cd2008-02-15 16:48:40 +000010
11DEBUG_USER = 'debug_user'
12
showarda5288b42009-07-28 20:06:08 +000013class SimpleAuthBackend(backends.ModelBackend):
jadmanski0afbb632008-06-06 21:10:57 +000014 """
15 Automatically allows any login. This backend is for use when Apache is
16 doing the real authentication. Also ensures logged-in user exists in
17 frontend.afe.models.User database.
18 """
19 def authenticate(self, username=None, password=None):
20 try:
21 user = User.objects.get(username=username)
22 except User.DoesNotExist:
23 # password is meaningless
24 user = User(username=username,
25 password='apache authentication')
26 user.is_staff = True
27 user.save() # need to save before adding groups
28 user.groups.add(Group.objects.get(
29 name=management.BASIC_ADMIN))
mblighe8819cd2008-02-15 16:48:40 +000030
jadmanski0afbb632008-06-06 21:10:57 +000031 SimpleAuthBackend.check_afe_user(username)
32 return user
mblighe8819cd2008-02-15 16:48:40 +000033
34
jadmanski0afbb632008-06-06 21:10:57 +000035 @staticmethod
36 def check_afe_user(username):
showard3dd47c22008-07-10 00:41:36 +000037 user, created = models.User.objects.get_or_create(login=username)
38 if created:
39 user.save()
mblighe8819cd2008-02-15 16:48:40 +000040
jadmanski0afbb632008-06-06 21:10:57 +000041 def get_user(self, user_id):
42 try:
43 return User.objects.get(pk=user_id)
44 except User.DoesNotExist:
45 return None
mblighe8819cd2008-02-15 16:48:40 +000046
47
showard6f1593c2008-07-11 16:56:16 +000048class GetApacheUserMiddleware(object):
jadmanski0afbb632008-06-06 21:10:57 +000049 """
50 Middleware for use when Apache is doing authentication. Looks for
showard6f1593c2008-07-11 16:56:16 +000051 REMOTE_USER in headers and passed the username found to
52 thread_local.set_user(). If no such header is found, looks for
53 HTTP_AUTHORIZATION header with username (this allows CLI to authenticate).
54 If neither of those are found, DEBUG_USER is used.
jadmanski0afbb632008-06-06 21:10:57 +000055 """
mblighe8819cd2008-02-15 16:48:40 +000056
jadmanski0afbb632008-06-06 21:10:57 +000057 def process_request(self, request):
58 # look for a username from Apache
59 user = request.META.get('REMOTE_USER')
60 if user is None:
61 # look for a user in headers. This is insecure but
62 # it's our temporarily solution for CLI auth.
63 user = request.META.get('HTTP_AUTHORIZATION')
64 if user is None:
65 # no user info - assume we're in development mode
Simran Basi85f4c362014-04-08 13:40:57 -070066 user = constants.MOBLAB_USER if utils.is_moblab() else DEBUG_USER
showard6f1593c2008-07-11 16:56:16 +000067 thread_local.set_user(user)
68
69
70class ApacheAuthMiddleware(GetApacheUserMiddleware):
71 """
72 Like GetApacheUserMiddleware, but also logs the user into Django's auth
73 system, and replaces the username in thread_local with the actual User model
74 object.
75 """
76
showarda79583c2008-07-17 17:01:15 +000077
showard6f1593c2008-07-11 16:56:16 +000078 def process_request(self, request):
79 super(ApacheAuthMiddleware, self).process_request(request)
80 username = thread_local.get_user()
showarda79583c2008-07-17 17:01:15 +000081 thread_local.set_user(None)
showard6f1593c2008-07-11 16:56:16 +000082 user_object = auth.authenticate(username=username,
jadmanski0afbb632008-06-06 21:10:57 +000083 password='')
84 auth.login(request, user_object)
showard6f1593c2008-07-11 16:56:16 +000085 thread_local.set_user(models.User.objects.get(login=username))