Python Server.decodeRequest方法代码示例

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
def openid_server(request):
    """
    This view is the actual OpenID server - running at the URL pointed to by
    the <link rel="openid.server"> tag.
    """
    server = Server(get_store(request),
        op_endpoint=request.build_absolute_uri(
            reverse('openid-provider-root')))

    # Cancellation
    if 'cancel' in request.REQUEST:
        if 'OPENID_REQUEST' in request.session:
            return oresponse_to_response(server,
                request.session['OPENID_REQUEST'].answer(False))
        else:
            return HttpResponseRedirect('/')

    # Clear AuthorizationInfo session var, if it is set
    if request.session.get('AuthorizationInfo', None):
        del request.session['AuthorizationInfo']

    querydict = dict(request.REQUEST.items())
    try:
        orequest = server.decodeRequest(querydict)
    except ProtocolError, why:
        logger.error('Invalid OpenID message %s' % querydict)
        return oresponse_to_response(server, why)

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
def openid_decide(request):
    """
    The page that asks the user if they really want to sign in to the site, and
    lets them add the consumer to their trusted whitelist.
    # If user is logged in, ask if they want to trust this trust_root
    # If they are NOT logged in, show the landing page
    """
    custom_log(request, "User entered openid_decide page", level="debug")
    server = Server(get_store(request),
	op_endpoint=request.build_absolute_uri(reverse('openid-provider-root')))
    orequest = server.decodeRequest(request.session.get('OPENID_REQUEST'))
    trust_root_valid = request.session.get('OPENID_TRUSTROOT_VALID')

    if not (request.browser and request.browser.user and request.browser.is_authenticated() and request.user.is_authenticated()):
        custom_log(request, "User is not authenticated. Redirect to sign-in page", level="debug")
        return landing_page(request, orequest)

    if not orequest:
        custom_log(request, "Entered decide page with no OpenID session in progress", level="warn")
        return error_page(request, "You don't have OpenID login session in progress.")

    openid = openid_get_identity(request, orequest.identity)
    if openid is None:
        custom_log(request, "No OpenID exists for user %s" % request.browser.user, level="warn")
        return error_page(
            request, "You are signed in but you don't have OpenID here!")

    if request.method == 'POST' and request.POST.get('decide_page', False):
        if request.POST.get("cancel"):
            custom_log(request, "User cancelled authentication from the decide page", level="info")
            for k in ["AuthorizationInfo", "OPENID_TRUSTROOT_VALID", "OPENID_REQUEST", get_trust_session_key(orequest)]:
                try:
                    del request.session[k]
                except KeyError:
                    pass
            custom_log(request, "Cancelled. Redirect to front page", level="debug")
            return HttpResponseRedirect(reverse("login_frontend.views.indexview"))
        (obj, created) = TrustedRoot.objects.get_or_create(
            openid=openid, trust_root=orequest.trust_root)
        if created:
            custom_log(request, "Created a new TrustRoot for %s" % orequest.trust_root)
        else:
            custom_log(request, "Old TrustRoot for %s exists" % orequest.trust_root)
        if not conf.FAILED_DISCOVERY_AS_VALID:
            custom_log(request, "Setting %s=True" % (get_trust_session_key(orequest)), level="debug")
            request.session[get_trust_session_key(orequest)] = True
        custom_log(request, "Redirecting to OpenID server root", level="debug")
        return HttpResponseRedirect(reverse('openid-provider-root'))

    custom_log(request, "Showing decide page", level="info")
    return render_to_response('openid_provider/decide.html', {
        'title': _('Trust this site?'),
        'trust_root': orequest.trust_root,
        'trust_root_valid': trust_root_valid,
        'return_to': orequest.return_to,
        'identity': orequest.identity,
        'sreg': get_default_sreg_data(request, orequest),
    }, context_instance=RequestContext(request))

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
def openid_server(req):
    """
    This view is the actual OpenID server - running at the URL pointed to by 
    the <link rel="openid.server"> tag. 
    """
    host = get_base_uri(req)
    try:
        # if we have django_openid_auth in applications directory
        # then we can use DjangoOpenIDStore
        from django_openid_auth.store import DjangoOpenIDStore
        store = DjangoOpenIDStore()
    except:
        # otherwise use FileOpenIDStore
        OPENID_FILESTORE = '/tmp/openid-filestore'
        from openid.store.filestore import FileOpenIDStore
        store = FileOpenIDStore(OPENID_FILESTORE)
    server = Server(store, op_endpoint="%s%s" % (host, reverse('openid-provider-root')))
    # Clear AuthorizationInfo session var, if it is set
    if req.session.get('AuthorizationInfo', None):
        del req.session['AuthorizationInfo']
    querydict = dict(req.REQUEST.items())
    orequest = server.decodeRequest(querydict)
    if not orequest:
        orequest = req.session.get('OPENID_REQUEST', None)
        if not orequest:
            # not request, render info page:
            return render_to_response('openid_provider/server.html',
                {'host': host,},
                context_instance=RequestContext(req))
        else:
            # remove session stored data:
            del req.session['OPENID_REQUEST']
    if orequest.mode in ("checkid_immediate", "checkid_setup"):
        if not req.user.is_authenticated():
            return landing_page(req, orequest)
        #openid = openid_is_authorized(req, orequest.identity, orequest.trust_root)
        #if openid is not None:
        oresponse = orequest.answer(True, identity="%s%s" % (
                    host, reverse('openid-provider-identity', args=[req.user.username])))
        fullname = "%s %s" % (req.user.first_name, req.user.last_name)
        if fullname == " ":
            fullname = req.user.username
        if fullname.strip().find(" ") == -1:
            fullname = "%s %s" % (fullname, fullname)
        sreg_data = { 'fullname': fullname , 'email': req.user.email, 'nickname': req.user.username, }
        sreg_req = sreg.SRegRequest.fromOpenIDRequest(orequest)
        sreg_resp = sreg.SRegResponse.extractResponse(sreg_req, sreg_data)
        oresponse.addExtension(sreg_resp)
        #elif orequest.immediate:
        #    raise Exception('checkid_immediate mode not supported')
        #else:
        #    req.session['OPENID_REQUEST'] = orequest
        #    return HttpResponseRedirect(reverse('openid-provider-decide'))
    else:
        oresponse = server.handleRequest(orequest)
    webresponse = server.encodeResponse(oresponse)
    return django_response(webresponse)

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
def endpoint(request):
    """
    Respond to low-level OpenID protocol messages.
    """
    s = Server(OpenIDStore(), request.build_absolute_uri(reverse(endpoint)))

    query = request.GET or request.POST

    # First, decode the incoming request into something the OpenID
    # library can use.
    try:
        openid_request = s.decodeRequest(query)
    except ProtocolError, why:
        # This means the incoming request was invalid.
        return direct_to_template(
            request,
            'endpoint.html',
            {'error': str(why)})

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
def endpoint():
    endpoint_url = url_for('.endpoint', _external=True)
    openid = OpenIDServer(OpenIDStore(), endpoint_url)
    query = request.args if request.method == 'GET' else request.form
    try:
        oid_req = openid.decodeRequest(query)
    except ProtocolError as e:
        return openid_exception(e)
    if not oid_req:
        return render_template('papersplease/openid/index.html')
    if oid_req.mode in ('checkid_immediate', 'checkid_setup'):
        if current_user.is_authenticated():
            return openid_response(openid, oid_req.answer(True))
        elif oid_req.immediate:
            return openid_response(openid, oid_req.answer(False))
        else:
            return login_manager.unauthorized()
    else:
        return openid_response(openid, openid.handleRequest(oid_req))

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
def index():
    oidstore = Web2pyStore(db)
    cache.ram('oid_cleanup', lambda: oidstore.cleanup(), time_expire=25200) #call cleanup approx. every 7h
    oserver = Server(oidstore, OID_SERVER)
    orequest = oserver.decodeRequest(request.vars)
    
    #if another controller asked to cancel this authentication request do so
    if session.oid_cancel:
       session.oid_cancel = None
       return redirect(orequest.getCancelURL())
    
    user_is_logged_in = auth.is_logged_in()
    user_owns_id = user_is_logged_in and auth.user['nickname'] == orequest.identity.split('/').pop().lower() #lazy eval
    user_trusts_root = user_is_logged_in and _userTrustsRoot(orequest.trust_root) #lazy eval

    if orequest.mode in ['checkid_immediate', 'checkid_setup']:
        if user_is_logged_in and user_owns_id and user_trusts_root:
            resp = orequest.answer(True)
        elif orequest.immediate:
            resp = orequest.answer(False)
        else:
            #populate oid session with details as required by other controllers such as the url to
            #redirect to after logon or after approving data transfer to the relying party.
            session.oid_url = URL(r=request, args=request.args, vars=request.vars)
            #redirect user to authenticate herself or to authorise request 
            if user_is_logged_in:
                session.oid_orequest = orequest
                session.oid_user_owns_id = user_owns_id
                return redirect(URL(r=request, c='auth', f='data'))
            else:
                return redirect(URL(r=request, c='auth', f='user', args=['login']))            
    else:
        #let the library handle it
        resp = oserver.handleRequest(orequest)
    
    oresp = oserver.encodeResponse(resp)
    if oresp.code==200:
        return oresp.body
    else:
        return redirect(oresp.headers['location'], oresp.code)

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
def provider_login(request):
    """
    OpenID login endpoint
    """

    # make and validate endpoint
    endpoint = get_xrds_url('login', request)
    if not endpoint:
        return default_render_failure(request, "Invalid OpenID request")

    # initialize store and server
    store = DjangoOpenIDStore()
    server = Server(store, endpoint)

    # first check to see if the request is an OpenID request.
    # If so, the client will have specified an 'openid.mode' as part
    # of the request.
    if request.method == 'GET':
        querydict = dict(request.GET.items())
    else:
        querydict = dict(request.POST.items())
    error = False
    if 'openid.mode' in request.GET or 'openid.mode' in request.POST:
        # decode request
        try:
            openid_request = server.decodeRequest(querydict)
        except (UntrustedReturnURL, ProtocolError):
            openid_request = None

        if not openid_request:
            return default_render_failure(request, "Invalid OpenID request")

        # don't allow invalid and non-trusted trust roots
        if not validate_trust_root(openid_request):
            return default_render_failure(request, "Invalid OpenID trust root")

        # checkid_immediate not supported, require user interaction
        if openid_request.mode == 'checkid_immediate':
            return provider_respond(server, openid_request,
                                    openid_request.answer(False), {})

        # checkid_setup, so display login page
        # (by falling through to the provider_login at the
        # bottom of this method).
        elif openid_request.mode == 'checkid_setup':
            if openid_request.idSelect():
                # remember request and original path
                request.session['openid_setup'] = {
                    'request': openid_request,
                    'url': request.get_full_path(),
                    'post_params': request.POST,
                }

                # user failed login on previous attempt
                if 'openid_error' in request.session:
                    error = True
                    del request.session['openid_error']

        # OpenID response
        else:
            return provider_respond(server, openid_request,
                                    server.handleRequest(openid_request), {})

    # handle login redirection:  these are also sent to this view function,
    # but are distinguished by lacking the openid mode.  We also know that
    # they are posts, because they come from the popup
    elif request.method == 'POST' and 'openid_setup' in request.session:
        # get OpenID request from session
        openid_setup = request.session['openid_setup']
        openid_request = openid_setup['request']
        openid_request_url = openid_setup['url']
        post_params = openid_setup['post_params']
        # We need to preserve the parameters, and the easiest way to do this is
        # through the URL
        url_post_params = {
            param: post_params[param] for param in post_params if param.startswith('openid')
        }

        encoded_params = urllib.urlencode(url_post_params)

        if '?' not in openid_request_url:
            openid_request_url = openid_request_url + '?' + encoded_params
        else:
            openid_request_url = openid_request_url + '&' + encoded_params

        del request.session['openid_setup']

        # don't allow invalid trust roots
        if not validate_trust_root(openid_request):
            return default_render_failure(request, "Invalid OpenID trust root")

        # check if user with given email exists
        # Failure is redirected to this method (by using the original URL),
        # which will bring up the login dialog.
        email = request.POST.get('email', None)
        try:
            user = User.objects.get(email=email)
        except User.DoesNotExist:
            request.session['openid_error'] = True
            if settings.FEATURES['SQUELCH_PII_IN_LOGS']:
#.........这里部分代码省略.........

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
class OpenIDProvider(object):
    # OpenID service type URIs, listed in order of preference.  The
    # ordering of this list affects yadis and XRI service discovery.
    openid_type_uris = [
        #discover.OPENID_IDP_2_0_TYPE,
        discover.OPENID_2_0_TYPE,
        discover.OPENID_1_1_TYPE,
        discover.OPENID_1_0_TYPE,
        sreg.ns_uri,
    ]

    def __init__(self, request):
        self.request = request
        self.openid_server = Server(SFOpenIDStore(self.request.db_session),
                                    request.route_url('openid_provider'))
        userid = authenticated_userid(request)
        self.auth_userid = userid or request.session.get('auth_userid')
        if self.auth_userid:
            query = self.request.db_session.query(UserProfile)
            self.auth_user = query.get(self.auth_userid)
        else:
            self.auth_user = None

    def process(self, request_params):
        logger.debug('Processing openid request: %s', request_params)
        if request_params.get('openid.identity'):
            home_url = self.request.route_url('home')
            if request_params['openid.identity'] == request_params['openid.claimed_id'] and \
               request_params['openid.identity'] == home_url:
                username = self.request.user and self.request.user.username or \
                           self.auth_userid
                if username:
                    username = username.lower()
                    user_url = self.request.route_url('user_profile',
                                                      username=username)
                    request_params['openid.identity'] = user_url
                    request_params['openid.claimed_id'] = user_url
        try:
            openid_request = self.openid_server.decodeRequest(request_params)
        # MalformedReturnURL, UntrustedReturnURL, etc.
        except ProtocolError as e:
            logger.info(
                'Unable to decode request: %s %s',
                e.__class__,
                e.openid_message
            )
            return ''
        logger.debug('Decoded request: %s', openid_request)

        if openid_request is None:
            return ''

        if openid_request.mode in ["checkid_immediate", "checkid_setup"]:
            if self.request.user or self.auth_userid:
                openid_response = self.handleCheckIDRequest(openid_request)
            else:
                # If the user has not logged in yet, stash the OpenID
                # consuming site request (if there isn't one already) and
                # send them to the login view. The openid_tween will take
                # care of sending them back to the OpenID consuming site.
                rp_dict = dict(request_params.items())
                self.request.session['openid_request'] = rp_dict
                self.request.session.save()
                return HTTPFound(location=self.request.route_url('login'))
        else:
            openid_response = self.openid_server.handleRequest(openid_request)

        logger.debug('Decoded response: %s', openid_response)
        encoded_response = self.openid_server.encodeResponse(openid_response)

        if 'location' in encoded_response.headers:
            response = HTTPFound(location=encoded_response.headers['location'])
            return response
        return encoded_response.body

    def get(self):
        return self.process(self.request.GET)

    def post(self):
        if self.request.method != "POST":
            return HTTPMethodNotAllowed()
        return self.process(self.request.POST)

    def approved(self, request, identifier=None):
        response = request.answer(True, identity=identifier)
        self.addSRegResponse(request, response)
        return response

    def handleCheckIDRequest(self, request):
        is_authorized = self.isAuthorized(request.identity, request.trust_root)
        if is_authorized:
            return self.approved(request, request.identity)
        else:
            return request.answer(False, identity=request.identity)

    def isAuthorized(self, identity_url, trust_root):
        if not self.auth_userid:
            return False

        self.request.registry.notify(CheckIDAuthorized(self.request,
#.........这里部分代码省略.........

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
def openid_server(request):
    """
    This view is the actual OpenID server - running at the URL pointed to by 
    the <link rel="openid.server"> tag. 
    """
    custom_log(request, "Server request: %s: %s" % (request.method, request.POST or request.GET), level="debug")

    server = Server(get_store(request),
        op_endpoint=request.build_absolute_uri(reverse('openid-provider-root')))

    if not request.is_secure():
        # if request is not secure allow only encrypted association sessions
        custom_log(request, "Request is not secure. Switching to encrypted negotiator", level="debug")
        server.negotiator = encrypted_negotiator

    # Clear AuthorizationInfo session var, if it is set
    if request.session.get('AuthorizationInfo', None):
        custom_log(request, "Clearing AuthorizationInfo session var", level="debug")
        del request.session['AuthorizationInfo']

    querydict = dict(request.REQUEST.items())
    orequest = server.decodeRequest(querydict)
    if not orequest:
        orequest = server.decodeRequest(request.session.get('OPENID_REQUEST', None))
        if orequest:
            # remove session stored data:
            custom_log(request, "Removing stored data from session", level="debug")
            del request.session['OPENID_REQUEST']
        else:
            # not request, render info page:
            data = {
                'host': request.build_absolute_uri('/'),
                'xrds_location': request.build_absolute_uri(
                    reverse('openid-provider-xrds')),
            }
            custom_log(request, "Not an OpenID request, sending info: %s" % data, level="info")
            if request.browser and request.browser.user:
                data["openid_identifier"] = "https://" + request.get_host() +  reverse('openid-provider-identity', args=[request.browser.user.username])
            else:
                data["page_url"] = request.build_absolute_uri()
            return render_to_response('openid_provider/server.html',
                                      data,
                                      context_instance=RequestContext(request))

    custom_log(request, "orequest.mode: %s" % orequest.mode, level="debug")

    if orequest.mode in BROWSER_REQUEST_MODES:
        if not (request.browser and request.browser.user and request.browser.is_authenticated() and request.user.is_authenticated()):
            custom_log(request, "no local authentication, sending landing page", level="debug")
            return landing_page(request, orequest)

        openid = openid_is_authorized(request, orequest.identity,
                                      orequest.trust_root)

        # verify return_to:
        trust_root_valid = trust_root_validation(orequest)
        custom_log(request, "trust_root_valid=%s" % trust_root_valid, level="debug")
        validated = False

        # Allow per-url exceptions for trust roots.
        for global_trusted_root in settings.OPENID_TRUSTED_ROOTS:
            if orequest.trust_root.startswith(global_trusted_root):
                custom_log(request, "Trust root %s is in always trusted roots. Set validated=True" % orequest.trust_root, level="debug")
                validated = True
                break

        if conf.FAILED_DISCOVERY_AS_VALID:
            if trust_root_valid == 'DISCOVERY_FAILED' or trust_root_valid == 'Unreachable':
                custom_log(request, "Setting validated=True as FAILED_DISCOVERY_AS_VALID is True", level="debug")
                validated = True
        else:
            # if in decide already took place, set as valid:
            if request.session.get(get_trust_session_key(orequest), False):
                custom_log(request, "Setting validated=True as session var %s is True" % (get_trust_session_key(orequest)), level="debug")
                validated = True

        custom_log(request, "Session key: %s=%s" % (get_trust_session_key(orequest), request.session.get(get_trust_session_key(orequest))), level="debug")

        custom_log(request, "OpenID is %s" % openid, level="debug")
        if openid is not None and (validated or trust_root_valid == 'Valid'):
            id_url = request.build_absolute_uri(
                reverse('openid-provider-identity', args=[openid.openid]))
            try:
                oresponse = orequest.answer(True, identity=id_url)
            except ValueError, e:
                return render_to_response("openid_provider/error.html", {"title": "Invalid identity URL", "msg": e.message}, context_instance=RequestContext(request))
            custom_log(request, 'orequest.answer(True, identity="%s")' % id_url, level="debug")
        elif orequest.immediate:
            custom_log(request, 'checkid_immediate mode not supported', level="debug")
            raise Exception('checkid_immediate mode not supported')
        else:
            request.session['OPENID_REQUEST'] = orequest.message.toPostArgs()
            request.session['OPENID_TRUSTROOT_VALID'] = trust_root_valid
            custom_log(request, "redirecting to decide page", level="debug")
            return HttpResponseRedirect(reverse('openid-provider-decide'))

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
class StubOpenIDProvider(HTTPFetcher):

    def __init__(self, base_url):
        self.store = MemoryStore()
        self.identity_url = base_url + 'identity'
        self.localid_url = base_url + 'localid'
        self.endpoint_url = base_url + 'endpoint'
        self.server = Server(self.store, self.endpoint_url)
        self.last_request = None
        self.type_uris = ['http://specs.openid.net/auth/2.0/signon']

    def fetch(self, url, body=None, headers=None):
        if url == self.identity_url:
            # Serve an XRDS document directly, pointing at our endpoint.
            type_uris = ['<Type>%s</Type>' % uri for uri in self.type_uris]
            return HTTPResponse(
                url, 200, {'content-type': 'application/xrds+xml'}, """\
<?xml version="1.0"?>
<xrds:XRDS
    xmlns="xri://$xrd*($v*2.0)"
    xmlns:xrds="xri://$xrds">
  <XRD>
    <Service priority="0">
      %s
      <URI>%s</URI>
      <LocalID>%s</LocalID>
    </Service>
  </XRD>
</xrds:XRDS>
""" % ('\n'.join(type_uris), self.endpoint_url, self.localid_url))
        elif url.startswith(self.endpoint_url):
            # Gather query parameters
            query = {}
            if '?' in url:
                query.update(cgi.parse_qsl(url.split('?', 1)[1]))
            if body is not None:
                query.update(cgi.parse_qsl(body))
            self.last_request = self.server.decodeRequest(query)

            # The browser based requests should not be handled through
            # the fetcher interface.
            assert self.last_request.mode not in BROWSER_REQUEST_MODES

            response = self.server.handleRequest(self.last_request)
            webresponse = self.server.encodeResponse(response)
            return HTTPResponse(url,  webresponse.code, webresponse.headers,
                                webresponse.body)
        else:
            raise HTTPFetchingError('unknown URL %s' % url)

    def parseFormPost(self, content):
        """Parse an HTML form post to create an OpenID request."""
        # Hack to make the javascript XML compliant ...
        content = content.replace('i < elements.length',
                                  'i &lt; elements.length')
        tree = ET.XML(content)
        form = tree.find('.//form')
        assert form is not None, 'No form in document'
        assert form.get('action') == self.endpoint_url, (
            'Form posts to %s instead of %s' % (form.get('action'),
                                                self.endpoint_url))
        query = {}
        for input in form.findall('input'):
            if input.get('type') != 'hidden':
                continue
            query[input.get('name').encode('UTF-8')] = \
                input.get('value').encode('UTF-8')
        self.last_request = self.server.decodeRequest(query)
        return self.last_request

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
def provider_login(request):
    """
    OpenID login endpoint
    """

    # make and validate endpoint
    endpoint = get_xrds_url('login', request)
    if not endpoint:
        return default_render_failure(request, "Invalid OpenID request")

    # initialize store and server
    store = DjangoOpenIDStore()
    server = Server(store, endpoint)

    # first check to see if the request is an OpenID request.
    # If so, the client will have specified an 'openid.mode' as part
    # of the request.
    querydict = dict(request.REQUEST.items())
    error = False
    if 'openid.mode' in request.GET or 'openid.mode' in request.POST:
        # decode request
        try:
            openid_request = server.decodeRequest(querydict)
        except (UntrustedReturnURL, ProtocolError):
            openid_request = None

        if not openid_request:
            return default_render_failure(request, "Invalid OpenID request")

        # don't allow invalid and non-trusted trust roots
        if not validate_trust_root(openid_request):
            return default_render_failure(request, "Invalid OpenID trust root")

        # checkid_immediate not supported, require user interaction
        if openid_request.mode == 'checkid_immediate':
            return provider_respond(server, openid_request,
                                    openid_request.answer(False), {})

        # checkid_setup, so display login page
        # (by falling through to the provider_login at the
        # bottom of this method).
        elif openid_request.mode == 'checkid_setup':
            if openid_request.idSelect():
                # remember request and original path
                request.session['openid_setup'] = {
                    'request': openid_request,
                    'url': request.get_full_path()
                }

                # user failed login on previous attempt
                if 'openid_error' in request.session:
                    error = True
                    del request.session['openid_error']

        # OpenID response
        else:
            return provider_respond(server, openid_request,
                                    server.handleRequest(openid_request), {})

    # handle login redirection:  these are also sent to this view function,
    # but are distinguished by lacking the openid mode.  We also know that
    # they are posts, because they come from the popup
    elif request.method == 'POST' and 'openid_setup' in request.session:
        # get OpenID request from session
        openid_setup = request.session['openid_setup']
        openid_request = openid_setup['request']
        openid_request_url = openid_setup['url']
        del request.session['openid_setup']

        # don't allow invalid trust roots
        if not validate_trust_root(openid_request):
            return default_render_failure(request, "Invalid OpenID trust root")

        # check if user with given email exists
        # Failure is redirected to this method (by using the original URL),
        # which will bring up the login dialog.
        email = request.POST.get('email', None)
        try:
            user = User.objects.get(email=email)
        except User.DoesNotExist:
            request.session['openid_error'] = True
            msg = "OpenID login failed - Unknown user email: %s"
            AUDIT_LOG.warning(msg, email)
            return HttpResponseRedirect(openid_request_url)

        # attempt to authenticate user (but not actually log them in...)
        # Failure is again redirected to the login dialog.
        username = user.username
        password = request.POST.get('password', None)
        try:
            user = authenticate(username=username, password=password, request=request)
        except RateLimitException:
            AUDIT_LOG.warning('OpenID - Too many failed login attempts.')
            return HttpResponseRedirect(openid_request_url)

        if user is None:
            request.session['openid_error'] = True
            msg = "OpenID login failed - password for %s is invalid"
            AUDIT_LOG.warning(msg, email)
            return HttpResponseRedirect(openid_request_url)
#.........这里部分代码省略.........

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
def openid_server(request):
    """
    This view is the actual OpenID server - running at the URL pointed to by
    the <link rel="openid.server"> tag.
    """
    logger.debug('server request %s: %s',
                 request.method, request.POST or request.GET)
    server = Server(get_store(request),
        op_endpoint=request.build_absolute_uri(reverse('openid-provider-root')))

    if not request.is_secure():
        # if request is not secure allow only encrypted association sessions
        server.negotiator = encrypted_negotiator

    # Clear AuthorizationInfo session var, if it is set
    if request.session.get('AuthorizationInfo', None):
        del request.session['AuthorizationInfo']

    querydict = dict(request.POST.items())
    orequest = server.decodeRequest(querydict)
    if not orequest:
        orequest = request.session.get('OPENID_REQUEST', None)
        if orequest:
            # remove session stored data:
            del request.session['OPENID_REQUEST']
        else:
            # not request, render info page:
            data = {
                'host': request.build_absolute_uri('/'),
                'xrds_location': request.build_absolute_uri(
                    reverse('openid-provider-xrds')),
            }
            # Return empty string
            return HttpResponse("", content_type="text/plain")

    if orequest.mode in BROWSER_REQUEST_MODES:
        if not request.user.is_authenticated:
            logger.debug('no local authentication, sending landing page')
            return landing_page(request, orequest)

        openid = openid_is_authorized(request, orequest.identity,
                                      orequest.trust_root)

        if openid is not None:
            id_url = request.build_absolute_uri(
                reverse('openid-provider-identity', args=[openid.openid]))
            oresponse = orequest.answer(True, identity=id_url)
            logger.debug('orequest.answer(True, identity="%s")', id_url)
        elif orequest.immediate:
            logger.debug('checkid_immediate mode not supported')
            raise Exception('checkid_immediate mode not supported')
        else:
            request.session['OPENID_REQUEST'] = orequest
            logger.debug('redirecting to decide page')
            return HttpResponseRedirect(reverse('openid-provider-decide'))
    else:
        oresponse = server.handleRequest(orequest)
    if request.user.is_authenticated:
        add_sreg_data(request, orequest, oresponse)
        if conf.AX_EXTENSION:
            add_ax_data(request, orequest, oresponse)
    # Convert a webresponse from the OpenID library in to a Django HttpResponse
    webresponse = server.encodeResponse(oresponse)
    if webresponse.code == 200 and orequest.mode in BROWSER_REQUEST_MODES:
        response = render(request, 'openid_provider/response.html', {
            'body': webresponse.body,
        })
        logger.debug('rendering browser response')
    else:
        response = HttpResponse(webresponse.body)
        response.status_code = webresponse.code
        for key, value in webresponse.headers.items():
            response[key] = value
        logger.debug('rendering raw response')
    return response

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
def cgi_main():
    logger.html_mode()
    global config
    cgi_request = CGIParser()
    response = CGIResponse()

    # Load configuration
    config_file = ConfigManager.find_config_file()

    if not config_file:
        logger.error("No configuration file found")
        response.type = "no_config"
        response.output(None)
        return
    else:
        try:
            config = ConfigManager(config_file)
        except configparser.ParsingError as e:
            logger.error("Unable to parse config file: {0}".format(err))
            response.error = "Error parsing poit configuration file"

    if config:
        # Make sure an endpoint is set
        endpoint = config.get_option("server", "endpoint")
        if not endpoint:
            endpoint = cgi_request.self_uri(https=config.force_https())
            config.set_option("server", "endpoint", endpoint, save=False)

        logger.debug("Endpoint: " + endpoint)
        ostore = FileOpenIDStore(os.path.expanduser(config.get_option("server", "session_dir")))
        oserver = OpenIDServer(ostore, endpoint)
        logger.debug("Initialized server")
    else:
        # Stilll need to create a OpenIDServer to parse the request
        ostore = MemoryStore()
        oserver = OpenIDServer(ostore, "")
        logger.debug("Initialized dummy server")

    # Decode request
    try:
        request = oserver.decodeRequest(cgi_request.openid)
    except server.ProtocolError as err:
        logger.warn("Not an OpenID request: " + str(err))
        request = None

    session = Session(cgi_request)

    # Redirect to HTTPS if required
    if (not session.is_secure()) and config.force_https() and ((not request) or type(request) == CheckIDRequest):
        response.redirect_url = "{endpoint}?{fields}".format(
            endpoint=re.sub("^http:", "https:", endpoint), fields=urllib.urlencode(cgi_request.openid)
        )
        response.output(session)
        return

    action = PoitAction.from_request(cgi_request.post)

    logger.debug("Action: " + str(action))

    if action and action.type == "authenticate" and not session.authenticated:
        session.authenticated = True

    if request:
        handle_openid(session, oserver, request, response, action)
    else:
        handle_normal(session, response, action)

    config.save()
    ostore.cleanup()
    response.output(session)

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
def provider_login(request):
    """
    OpenID login endpoint
    """

    # make and validate endpoint
    endpoint = get_xrds_url("login", request)
    if not endpoint:
        return default_render_failure(request, "Invalid OpenID request")

    # initialize store and server
    store = DjangoOpenIDStore()
    server = Server(store, endpoint)

    # first check to see if the request is an OpenID request.
    # If so, the client will have specified an 'openid.mode' as part
    # of the request.
    querydict = dict(request.REQUEST.items())
    error = False
    if "openid.mode" in request.GET or "openid.mode" in request.POST:
        # decode request
        try:
            openid_request = server.decodeRequest(querydict)
        except (UntrustedReturnURL, ProtocolError):
            openid_request = None

        if not openid_request:
            return default_render_failure(request, "Invalid OpenID request")

        # don't allow invalid and non-trusted trust roots
        if not validate_trust_root(openid_request):
            return default_render_failure(request, "Invalid OpenID trust root")

        # checkid_immediate not supported, require user interaction
        if openid_request.mode == "checkid_immediate":
            return provider_respond(server, openid_request, openid_request.answer(False), {})

        # checkid_setup, so display login page
        # (by falling through to the provider_login at the
        # bottom of this method).
        elif openid_request.mode == "checkid_setup":
            if openid_request.idSelect():
                # remember request and original path
                request.session["openid_setup"] = {"request": openid_request, "url": request.get_full_path()}

                # user failed login on previous attempt
                if "openid_error" in request.session:
                    error = True
                    del request.session["openid_error"]

        # OpenID response
        else:
            return provider_respond(server, openid_request, server.handleRequest(openid_request), {})

    # handle login redirection:  these are also sent to this view function,
    # but are distinguished by lacking the openid mode.  We also know that
    # they are posts, because they come from the popup
    elif request.method == "POST" and "openid_setup" in request.session:
        # get OpenID request from session
        openid_setup = request.session["openid_setup"]
        openid_request = openid_setup["request"]
        openid_request_url = openid_setup["url"]
        del request.session["openid_setup"]

        # don't allow invalid trust roots
        if not validate_trust_root(openid_request):
            return default_render_failure(request, "Invalid OpenID trust root")

        # check if user with given email exists
        # Failure is redirected to this method (by using the original URL),
        # which will bring up the login dialog.
        email = request.POST.get("email", None)
        try:
            user = User.objects.get(email=email)
        except User.DoesNotExist:
            request.session["openid_error"] = True
            if settings.FEATURES["SQUELCH_PII_IN_LOGS"]:
                AUDIT_LOG.warning("OpenID login failed - Unknown user email")
            else:
                msg = "OpenID login failed - Unknown user email: {0}".format(email)
                AUDIT_LOG.warning(msg)
            return HttpResponseRedirect(openid_request_url)

        # attempt to authenticate user (but not actually log them in...)
        # Failure is again redirected to the login dialog.
        username = user.username
        password = request.POST.get("password", None)
        try:
            user = authenticate(username=username, password=password, request=request)
        except RateLimitException:
            AUDIT_LOG.warning("OpenID - Too many failed login attempts.")
            return HttpResponseRedirect(openid_request_url)

        if user is None:
            request.session["openid_error"] = True
            if settings.FEATURES["SQUELCH_PII_IN_LOGS"]:
                AUDIT_LOG.warning("OpenID login failed - invalid password")
            else:
                msg = "OpenID login failed - password for {0} is invalid".format(email)
                AUDIT_LOG.warning(msg)
#.........这里部分代码省略.........

# 需要导入模块: from openid.server.server import Server [as 别名]
# 或者: from openid.server.server.Server import decodeRequest [as 别名]
class OpenIDMixin:
    """A mixin with OpenID helper methods."""

    openid_request = None

    def __init__(self, context, request):
        super(OpenIDMixin, self).__init__(context, request)
        self.server_url = get_server_url()
        self.openid_server = Server(openid_store, self.server_url)

    @property
    def user_identity_url(self):
        return ITestOpenIDPersistentIdentity(self.account).openid_identity_url

    def isIdentityOwner(self):
        """Return True if the user can authenticate as the given ID."""
        assert self.account is not None, "user should be logged in by now."
        return (self.openid_request.idSelect() or
                self.openid_request.identity == self.user_identity_url)

    @cachedproperty
    def openid_parameters(self):
        """A dictionary of OpenID query parameters from request."""
        query = {}
        for key, value in self.request.form.items():
            if key.startswith('openid.'):
                # All OpenID query args are supposed to be ASCII.
                query[key.encode('US-ASCII')] = value.encode('US-ASCII')
        return query

    def getSession(self):
        """Get the session data container that stores the OpenID request."""
        if IUnauthenticatedPrincipal.providedBy(self.request.principal):
            # A dance to assert that we want to break the rules about no
            # unauthenticated sessions. Only after this next line is it
            # safe to set session values.
            allowUnauthenticatedSession(
                self.request, duration=timedelta(minutes=60))
        return ISession(self.request)[SESSION_PKG_KEY]

    def restoreRequestFromSession(self):
        """Get the OpenIDRequest from our session."""
        session = self.getSession()
        cache = get_property_cache(self)
        try:
            cache.openid_parameters = session[OPENID_REQUEST_SESSION_KEY]
        except KeyError:
            raise UnexpectedFormData("No OpenID request in session")

        # Decode the request parameters and create the request object.
        self.openid_request = self.openid_server.decodeRequest(
            self.openid_parameters)
        assert zisinstance(self.openid_request, CheckIDRequest), (
            'Invalid OpenIDRequest in session')

    def saveRequestInSession(self):
        """Save the OpenIDRequest in our session."""
        query = self.openid_parameters
        assert query.get('openid.mode') == 'checkid_setup', (
            'Can only serialise checkid_setup OpenID requests')

        session = self.getSession()
        # If this was meant for use in production we'd have to use a nonce
        # as the key when storing the openid request in the session, but as
        # it's meant to run only on development instances we can simplify
        # things a bit by storing the openid request using a well known key.
        session[OPENID_REQUEST_SESSION_KEY] = query

    def renderOpenIDResponse(self, openid_response):
        """Return a web-suitable response constructed from openid_response."""
        webresponse = self.openid_server.encodeResponse(openid_response)
        response = self.request.response
        response.setStatus(webresponse.code)
        # encodeResponse doesn't generate a content-type, help it out
        if (webresponse.code == 200 and webresponse.body
                and openid_response.whichEncoding() == ENCODE_HTML_FORM):
            response.setHeader('content-type', 'text/html')
        for header, value in webresponse.headers.items():
            response.setHeader(header, value)
        return webresponse.body

    def createPositiveResponse(self):
        """Create a positive assertion OpenIDResponse.

        This method should be called to create the response to
        successful checkid requests.

        If the trust root for the request is in openid_sreg_trustroots,
        then additional user information is included with the
        response.
        """
        assert self.account is not None, (
            'Must be logged in for positive OpenID response')
        assert self.openid_request is not None, (
            'No OpenID request to respond to.')

        if not self.isIdentityOwner():
            return self.createFailedResponse()

        if self.openid_request.idSelect():
#.........这里部分代码省略.........