X-Git-Url: http://git.cascardo.info/?p=cascardo%2Fipsilon.git;a=blobdiff_plain;f=ipsilon%2Flogin%2Fauthpam.py;h=0e6a83048617132226c729b7b5862c1b20e1357b;hp=ce60f39a37ffccda6fc766b1d304802c6aaf1303;hb=HEAD;hpb=26af9d1958608fb0237e2d1dd8b1b15d8cb862b7 diff --git a/ipsilon/login/authpam.py b/ipsilon/login/authpam.py old mode 100755 new mode 100644 index ce60f39..0e6a830 --- a/ipsilon/login/authpam.py +++ b/ipsilon/login/authpam.py @@ -1,72 +1,53 @@ -#!/usr/bin/python -# -# Copyright (C) 2013 Simo Sorce -# -# see file 'COPYING' for use and warranty information -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . - -from ipsilon.login.common import LoginPageBase, LoginManagerBase -import cherrypy +# Copyright (C) 2013 Ipsilon project Contributors, for license see COPYING + +from ipsilon.login.common import LoginFormBase, LoginManagerBase, \ + LoginManagerInstaller +from ipsilon.util.plugin import PluginObject +from ipsilon.util import config as pconfig import pam +import subprocess -class Pam(LoginPageBase): +class Pam(LoginFormBase): def _authenticate(self, username, password): if self.lm.service_name: - ok = pam.authenticate(username, password, self.lm.service_name) + ok = pam.pam().authenticate(username, password, self.lm.service_name) else: - ok = pam.authenticate(username, password) + ok = pam.pam().authenticate(username, password) if ok: - cherrypy.log("User %s successfully authenticated." % username) + self.log("User %s successfully authenticated." % username) return username - cherrypy.log("User %s failed authentication." % username) + self.log("User %s failed authentication." % username) return None - def GET(self, *args, **kwargs): - return self._template('login/pam.html', title='Login', - action='%s/login/pam' % self.basepath, - service_name=self.lm.service_name, - username_text=self.lm.username_text, - password_text=self.lm.password_text) - def POST(self, *args, **kwargs): - username = None - password = None + username = kwargs.get("login_name") + password = kwargs.get("login_password") user = None - for key, value in kwargs.iteritems(): - if key == 'login_name': - username = value - elif key == 'login_password': - password = value - if username is not None and password is not None: - user = self._authenticate(username, password) - else: - cherrypy.log.error("Error: Username or password is missing") + error = None - if user: - return self.lm.auth_successful(user) + if username and password: + user = self._authenticate(username, password) + if user: + return self.lm.auth_successful(self.trans, user, 'password') + else: + error = "Authentication failed" + self.error(error) else: - return self.lm.auth_failed() + error = "Username or password is missing" + self.error("Error: " + error) - def root(self, *args, **kwargs): - op = getattr(self, cherrypy.request.method, self.GET) - if callable(op): - return op(*args, **kwargs) + context = self.create_tmpl_context( + username=username, + error=error, + error_password=not password, + error_username=not username + ) + self.lm.set_auth_error() + return self._template('login/form.html', **context) class LoginManager(LoginManagerBase): @@ -79,28 +60,36 @@ class LoginManager(LoginManagerBase): self.description = """ Form based login Manager that uses the system's PAM infrastructure for authentication. """ - self._options = { - 'service name': [ - """ The name of the PAM service used to authenticate. """, - 'string', - 'remote' - ], - 'username text': [ - """ The text shown to ask for the username in the form. """, - 'string', - 'Username' - ], - 'password text': [ - """ The text shown to ask for the password in the form. """, - 'string', - 'Password' - ], - } + self.new_config( + self.name, + pconfig.String( + 'service name', + 'The name of the PAM service used to authenticate.', + 'remote', + readonly=True, + ), + pconfig.String( + 'username text', + 'Text used to ask for the username at login time.', + 'Username'), + pconfig.String( + 'password text', + 'Text used to ask for the password at login time.', + 'Password'), + pconfig.String( + 'help text', + 'Text used to guide the user at login time.', + 'Provide your Username and Password') + ) @property def service_name(self): return self.get_config_value('service name') + @property + def help_text(self): + return self.get_config_value('help text') + @property def username_text(self): return self.get_config_value('username text') @@ -110,5 +99,43 @@ for authentication. """ return self.get_config_value('password text') def get_tree(self, site): - self.page = Pam(site, self) + self.page = Pam(site, self, 'login/pam') return self.page + + +class Installer(LoginManagerInstaller): + + def __init__(self, *pargs): + super(Installer, self).__init__() + self.name = 'pam' + self.pargs = pargs + + def install_args(self, group): + group.add_argument('--pam', choices=['yes', 'no'], default='no', + help='Configure PAM authentication') + group.add_argument('--pam-service', action='store', default='remote', + help='PAM service name to use for authentication') + + def configure(self, opts, changes): + if opts['pam'] != 'yes': + return + + # Add configuration data to database + po = PluginObject(*self.pargs) + po.name = 'pam' + po.wipe_data() + po.wipe_config_values() + config = {'service name': opts['pam_service']} + po.save_plugin_config(config) + + # Update global config to add login plugin + po.is_enabled = True + po.save_enabled_state() + + # for selinux enabled platforms, ignore if it fails just report + try: + subprocess.call(['/usr/sbin/setsebool', '-P', + 'httpd_mod_auth_pam=on', + 'httpd_tmp_exec=on']) + except Exception: # pylint: disable=broad-except + pass