25
25
# Has a plugin interface for authentication modules.
26
26
# An authentication module is a Python module with an "auth" function,
27
27
# which accepts 3 positional arguments.
28
# plugin_module.auth(store, login, password, user)
29
# store is an open store connected to the IVLE database.
28
# plugin_module.auth(dbconn, login, password, user)
29
# dbconn is an open connection to the IVLE database.
30
30
# login and password are required strings, password is cleartext.
31
31
# user is a User object or None.
32
32
# If it's a User object, it must return the same object if it returns a user.
46
from ivle.auth import AuthError
46
from autherror import AuthError
50
def authenticate(store, login, password):
51
def authenticate(login, password):
51
52
"""Determines whether a particular login/password combination is
52
valid for the given database. The password is in cleartext.
53
valid. The password is in cleartext.
54
55
Returns a User object containing the user's details on success.
55
56
Raises an AuthError containing an appropriate error message on failure.
57
'store' is expected to be a storm.store.Store connected to the IVLE
58
database to which we should authenticate.
60
58
The User returned is guaranteed to be in the IVLE database.
61
59
This could be from reading or writing to the DB. If authenticate can't
62
60
find the user in the DB, it may get user data from some other source
70
68
# Spawn a DB object just for making this call.
71
69
# (This should not spawn a DB connection on each page reload, only when
72
70
# there is no session object to begin with).
74
user = ivle.database.User.get_by_login(store, login)
76
for modname, m in auth_modules:
77
# May raise an AuthError - allow to propagate
78
auth_result = m(store, login, password, user)
79
if auth_result is None:
80
# Can't auth with this module; try another
82
elif auth_result == False:
84
elif isinstance(auth_result, ivle.database.User):
85
if user is not None and auth_result is not user:
86
# If user is not None, then it must return the same user
74
user = dbconn.get_user(login)
75
except ivle.db.DBException:
76
# If our attempt to get the named user from the db fails,
77
# then set user to None.
78
# We may still auth (eg. by pulling details from elsewhere and writing
82
for modname, m in auth_modules:
83
# May raise an AuthError - allow to propagate
84
auth_result = m(dbconn, login, password, user)
85
if auth_result is None:
86
# Can't auth with this module; try another
88
elif auth_result == False:
90
elif isinstance(auth_result, ivle.user.User):
91
if user is not None and auth_result is not user:
92
# If user is not None, then it must return the same user
93
raise AuthError("Internal error: "
94
"Bad authentication module %s (changed user)"
97
# We just got ourselves some user details from an external
98
# source. Put them in the DB.
99
dbconn.create_user(auth_result)
87
103
raise AuthError("Internal error: "
88
"Bad authentication module %s (changed user)"
104
"Bad authentication module %s (bad return type)"
91
# We just got ourselves some user details from an external
92
# source. Put them in the DB.
93
store.add(auth_result)
97
raise AuthError("Internal error: "
98
"Bad authentication module %s (bad return type)"
100
# No auths checked out; fail.
106
# No auths checked out; fail.
103
def simple_db_auth(store, login, password, user):
111
def simple_db_auth(dbconn, login, password, user):
105
113
A plugin auth function, as described above.
106
114
This one just authenticates against the local database.
112
120
# The login doesn't exist. Therefore return None so we can try other
113
121
# means of authentication.
116
# They should always match, but it's best to be sure!
117
assert(user.login == login)
119
auth_result = user.authenticate(password)
123
auth_result = dbconn.user_authenticate(login, password)
120
124
# auth_result is either True, False (fail) or None (try another)
121
125
if auth_result is None:
added
removed
ivle/auth/authenticate.py
