371 lines
15 KiB
Python
371 lines
15 KiB
Python
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
# This file handles all flask-restful resources for /v3/OS-OAUTH1/
|
|
|
|
import flask
|
|
import flask_restful
|
|
import http.client
|
|
from oslo_log import log
|
|
from oslo_utils import timeutils
|
|
from urllib import parse as urlparse
|
|
from werkzeug import exceptions
|
|
|
|
from keystone.api._shared import json_home_relations
|
|
from keystone.common import authorization
|
|
from keystone.common import context
|
|
from keystone.common import provider_api
|
|
from keystone.common import rbac_enforcer
|
|
from keystone.common import validation
|
|
import keystone.conf
|
|
from keystone import exception
|
|
from keystone.i18n import _
|
|
from keystone import notifications
|
|
from keystone.oauth1 import core as oauth1
|
|
from keystone.oauth1 import schema
|
|
from keystone.oauth1 import validator
|
|
from keystone.server import flask as ks_flask
|
|
|
|
|
|
LOG = log.getLogger(__name__)
|
|
PROVIDERS = provider_api.ProviderAPIs
|
|
ENFORCER = rbac_enforcer.RBACEnforcer
|
|
CONF = keystone.conf.CONF
|
|
|
|
|
|
_build_resource_relation = json_home_relations.os_oauth1_resource_rel_func
|
|
_build_parameter_relation = json_home_relations.os_oauth1_parameter_rel_func
|
|
|
|
_ACCESS_TOKEN_ID_PARAMETER_RELATION = _build_parameter_relation(
|
|
parameter_name='access_token_id')
|
|
|
|
|
|
def _normalize_role_list(authorize_roles):
|
|
roles = set()
|
|
for role in authorize_roles:
|
|
if role.get('id'):
|
|
roles.add(role['id'])
|
|
else:
|
|
roles.add(PROVIDERS.role_api.get_unique_role_by_name(
|
|
role['name'])['id'])
|
|
return roles
|
|
|
|
|
|
def _update_url_scheme():
|
|
"""Update request url scheme with base url scheme."""
|
|
url = ks_flask.base_url()
|
|
url_scheme = list(urlparse.urlparse(url))[0]
|
|
req_url_list = list(urlparse.urlparse(flask.request.url))
|
|
req_url_list[0] = url_scheme
|
|
req_url = urlparse.urlunparse(req_url_list)
|
|
return req_url
|
|
|
|
|
|
class _OAuth1ResourceBase(flask_restful.Resource):
|
|
def get(self):
|
|
# GET is not allowed, however flask restful doesn't handle "GET" not
|
|
# being allowed cleanly. Here we explicitly mark is as not allowed. All
|
|
# other methods not defined would raise a method NotAllowed error and
|
|
# this would not be needed.
|
|
raise exceptions.MethodNotAllowed(valid_methods=['POST'])
|
|
|
|
|
|
class ConsumerResource(ks_flask.ResourceBase):
|
|
collection_key = 'consumers'
|
|
member_key = 'consumer'
|
|
api_prefix = '/OS-OAUTH1'
|
|
json_home_resource_rel_func = _build_resource_relation
|
|
json_home_parameter_rel_func = _build_parameter_relation
|
|
|
|
def _list_consumers(self):
|
|
ENFORCER.enforce_call(action='identity:list_consumers')
|
|
return self.wrap_collection(PROVIDERS.oauth_api.list_consumers())
|
|
|
|
def _get_consumer(self, consumer_id):
|
|
ENFORCER.enforce_call(action='identity:get_consumer')
|
|
return self.wrap_member(PROVIDERS.oauth_api.get_consumer(consumer_id))
|
|
|
|
def get(self, consumer_id=None):
|
|
if consumer_id is None:
|
|
return self._list_consumers()
|
|
return self._get_consumer(consumer_id)
|
|
|
|
def post(self):
|
|
ENFORCER.enforce_call(action='identity:create_consumer')
|
|
consumer = (flask.request.get_json(force=True, silent=True) or {}).get(
|
|
'consumer', {})
|
|
consumer = self._normalize_dict(consumer)
|
|
validation.lazy_validate(schema.consumer_create, consumer)
|
|
consumer = self._assign_unique_id(consumer)
|
|
ref = PROVIDERS.oauth_api.create_consumer(
|
|
consumer, initiator=self.audit_initiator)
|
|
return self.wrap_member(ref), http.client.CREATED
|
|
|
|
def delete(self, consumer_id):
|
|
ENFORCER.enforce_call(action='identity:delete_consumer')
|
|
reason = (
|
|
'Invalidating token cache because consumer %(consumer_id)s has '
|
|
'been deleted. Authorization for users with OAuth tokens will be '
|
|
'recalculated and enforced accordingly the next time they '
|
|
'authenticate or validate a token.' %
|
|
{'consumer_id': consumer_id}
|
|
)
|
|
notifications.invalidate_token_cache_notification(reason)
|
|
PROVIDERS.oauth_api.delete_consumer(
|
|
consumer_id, initiator=self.audit_initiator)
|
|
return None, http.client.NO_CONTENT
|
|
|
|
def patch(self, consumer_id):
|
|
ENFORCER.enforce_call(action='identity:update_consumer')
|
|
consumer = (flask.request.get_json(force=True, silent=True) or {}).get(
|
|
'consumer', {})
|
|
validation.lazy_validate(schema.consumer_update, consumer)
|
|
consumer = self._normalize_dict(consumer)
|
|
self._require_matching_id(consumer)
|
|
ref = PROVIDERS.oauth_api.update_consumer(
|
|
consumer_id, consumer, initiator=self.audit_initiator)
|
|
return self.wrap_member(ref)
|
|
|
|
|
|
class RequestTokenResource(_OAuth1ResourceBase):
|
|
@ks_flask.unenforced_api
|
|
def post(self):
|
|
oauth_headers = oauth1.get_oauth_headers(flask.request.headers)
|
|
consumer_id = oauth_headers.get('oauth_consumer_key')
|
|
requested_project_id = flask.request.headers.get(
|
|
'Requested-Project-Id')
|
|
|
|
if not consumer_id:
|
|
raise exception.ValidationError(
|
|
attribute='oauth_consumer_key', target='request')
|
|
if not requested_project_id:
|
|
raise exception.ValidationError(
|
|
attribute='Requested-Project-Id', target='request')
|
|
|
|
# NOTE(stevemar): Ensure consumer and requested project exist
|
|
PROVIDERS.resource_api.get_project(requested_project_id)
|
|
PROVIDERS.oauth_api.get_consumer(consumer_id)
|
|
|
|
url = _update_url_scheme()
|
|
req_headers = {'Requested-Project-Id': requested_project_id}
|
|
req_headers.update(flask.request.headers)
|
|
request_verifier = oauth1.RequestTokenEndpoint(
|
|
request_validator=validator.OAuthValidator(),
|
|
token_generator=oauth1.token_generator)
|
|
h, b, s = request_verifier.create_request_token_response(
|
|
url, http_method='POST', body=flask.request.args,
|
|
headers=req_headers)
|
|
if not b:
|
|
msg = _('Invalid signature')
|
|
raise exception.Unauthorized(message=msg)
|
|
# show the details of the failure.
|
|
oauth1.validate_oauth_params(b)
|
|
request_token_duration = CONF.oauth1.request_token_duration
|
|
token_ref = PROVIDERS.oauth_api.create_request_token(
|
|
consumer_id,
|
|
requested_project_id,
|
|
request_token_duration,
|
|
initiator=notifications.build_audit_initiator())
|
|
|
|
result = ('oauth_token=%(key)s&oauth_token_secret=%(secret)s'
|
|
% {'key': token_ref['id'],
|
|
'secret': token_ref['request_secret']})
|
|
|
|
if CONF.oauth1.request_token_duration > 0:
|
|
expiry_bit = '&oauth_expires_at=%s' % token_ref['expires_at']
|
|
result += expiry_bit
|
|
|
|
resp = flask.make_response(result, http.client.CREATED)
|
|
resp.headers['Content-Type'] = 'application/x-www-form-urlencoded'
|
|
return resp
|
|
|
|
|
|
class AccessTokenResource(_OAuth1ResourceBase):
|
|
@ks_flask.unenforced_api
|
|
def post(self):
|
|
oauth_headers = oauth1.get_oauth_headers(flask.request.headers)
|
|
consumer_id = oauth_headers.get('oauth_consumer_key')
|
|
request_token_id = oauth_headers.get('oauth_token')
|
|
oauth_verifier = oauth_headers.get('oauth_verifier')
|
|
|
|
if not consumer_id:
|
|
raise exception.ValidationError(
|
|
attribute='oauth_consumer_key', target='request')
|
|
if not request_token_id:
|
|
raise exception.ValidationError(
|
|
attribute='oauth_token', target='request')
|
|
if not oauth_verifier:
|
|
raise exception.ValidationError(
|
|
attribute='oauth_verifier', target='request')
|
|
|
|
req_token = PROVIDERS.oauth_api.get_request_token(
|
|
request_token_id)
|
|
|
|
expires_at = req_token['expires_at']
|
|
if expires_at:
|
|
now = timeutils.utcnow()
|
|
expires = timeutils.normalize_time(
|
|
timeutils.parse_isotime(expires_at))
|
|
if now > expires:
|
|
raise exception.Unauthorized(_('Request token is expired'))
|
|
|
|
url = _update_url_scheme()
|
|
access_verifier = oauth1.AccessTokenEndpoint(
|
|
request_validator=validator.OAuthValidator(),
|
|
token_generator=oauth1.token_generator)
|
|
try:
|
|
h, b, s = access_verifier.create_access_token_response(
|
|
url,
|
|
http_method='POST',
|
|
body=flask.request.args,
|
|
headers=dict(flask.request.headers))
|
|
except NotImplementedError:
|
|
# Client key or request token validation failed, since keystone
|
|
# does not yet support dummy client or dummy request token,
|
|
# so we will raise unauthorized exception instead.
|
|
try:
|
|
PROVIDERS.oauth_api.get_consumer(consumer_id)
|
|
except exception.NotFound:
|
|
msg = _('Provided consumer does not exist.')
|
|
LOG.warning('Provided consumer does not exist.')
|
|
raise exception.Unauthorized(message=msg)
|
|
if req_token['consumer_id'] != consumer_id:
|
|
msg = ('Provided consumer key does not match stored consumer '
|
|
'key.')
|
|
tr_msg = _('Provided consumer key does not match stored '
|
|
'consumer key.')
|
|
LOG.warning(msg)
|
|
raise exception.Unauthorized(message=tr_msg)
|
|
# The response body is empty since either one of the following reasons
|
|
if not b:
|
|
if req_token['verifier'] != oauth_verifier:
|
|
msg = 'Provided verifier does not match stored verifier'
|
|
tr_msg = _('Provided verifier does not match stored verifier')
|
|
else:
|
|
msg = 'Invalid signature'
|
|
tr_msg = _('Invalid signature')
|
|
LOG.warning(msg)
|
|
raise exception.Unauthorized(message=tr_msg)
|
|
# show the details of the failure
|
|
oauth1.validate_oauth_params(b)
|
|
if not req_token.get('authorizing_user_id'):
|
|
msg = _('Request Token does not have an authorizing user id.')
|
|
LOG.warning('Request Token does not have an authorizing user id.')
|
|
raise exception.Unauthorized(message=msg)
|
|
|
|
access_token_duration = CONF.oauth1.access_token_duration
|
|
token_ref = PROVIDERS.oauth_api.create_access_token(
|
|
request_token_id,
|
|
access_token_duration,
|
|
initiator=notifications.build_audit_initiator())
|
|
|
|
result = ('oauth_token=%(key)s&oauth_token_secret=%(secret)s'
|
|
% {'key': token_ref['id'],
|
|
'secret': token_ref['access_secret']})
|
|
|
|
if CONF.oauth1.access_token_duration > 0:
|
|
expiry_bit = '&oauth_expires_at=%s' % (token_ref['expires_at'])
|
|
result += expiry_bit
|
|
|
|
resp = flask.make_response(result, http.client.CREATED)
|
|
resp.headers['Content-Type'] = 'application/x-www-form-urlencoded'
|
|
return resp
|
|
|
|
|
|
class AuthorizeResource(_OAuth1ResourceBase):
|
|
def put(self, request_token_id):
|
|
ENFORCER.enforce_call(action='identity:authorize_request_token')
|
|
roles = (flask.request.get_json(force=True, silent=True) or {}).get(
|
|
'roles', [])
|
|
validation.lazy_validate(schema.request_token_authorize, roles)
|
|
ctx = flask.request.environ[context.REQUEST_CONTEXT_ENV]
|
|
if ctx.is_delegated_auth:
|
|
raise exception.Forbidden(
|
|
_('Cannot authorize a request token with a token issued via '
|
|
'delegation.'))
|
|
|
|
req_token = PROVIDERS.oauth_api.get_request_token(request_token_id)
|
|
|
|
expires_at = req_token['expires_at']
|
|
if expires_at:
|
|
now = timeutils.utcnow()
|
|
expires = timeutils.normalize_time(
|
|
timeutils.parse_isotime(expires_at))
|
|
if now > expires:
|
|
raise exception.Unauthorized(_('Request token is expired'))
|
|
|
|
authed_roles = _normalize_role_list(roles)
|
|
|
|
# verify the authorizing user has the roles
|
|
try:
|
|
auth_context = flask.request.environ[
|
|
authorization.AUTH_CONTEXT_ENV]
|
|
user_token_ref = auth_context['token']
|
|
except KeyError:
|
|
LOG.warning("Couldn't find the auth context.")
|
|
raise exception.Unauthorized()
|
|
|
|
user_id = user_token_ref.user_id
|
|
project_id = req_token['requested_project_id']
|
|
user_roles = PROVIDERS.assignment_api.get_roles_for_user_and_project(
|
|
user_id, project_id)
|
|
cred_set = set(user_roles)
|
|
|
|
if not cred_set.issuperset(authed_roles):
|
|
msg = _('authorizing user does not have role required')
|
|
raise exception.Unauthorized(message=msg)
|
|
|
|
# create least of just the id's for the backend
|
|
role_ids = list(authed_roles)
|
|
|
|
# finally authorize the token
|
|
authed_token = PROVIDERS.oauth_api.authorize_request_token(
|
|
request_token_id, user_id, role_ids)
|
|
|
|
to_return = {'token': {'oauth_verifier': authed_token['verifier']}}
|
|
return to_return
|
|
|
|
|
|
class OSAuth1API(ks_flask.APIBase):
|
|
_name = 'OS-OAUTH1'
|
|
_import_name = __name__
|
|
_api_url_prefix = '/OS-OAUTH1'
|
|
resources = [ConsumerResource]
|
|
resource_mapping = [
|
|
ks_flask.construct_resource_map(
|
|
resource=RequestTokenResource,
|
|
url='/request_token',
|
|
resource_kwargs={},
|
|
rel='request_tokens',
|
|
resource_relation_func=_build_resource_relation
|
|
),
|
|
ks_flask.construct_resource_map(
|
|
resource=AccessTokenResource,
|
|
url='/access_token',
|
|
rel='access_tokens',
|
|
resource_kwargs={},
|
|
resource_relation_func=_build_resource_relation
|
|
),
|
|
ks_flask.construct_resource_map(
|
|
resource=AuthorizeResource,
|
|
url='/authorize/<string:request_token_id>',
|
|
resource_kwargs={},
|
|
rel='authorize_request_token',
|
|
resource_relation_func=_build_resource_relation,
|
|
path_vars={
|
|
'request_token_id': _build_parameter_relation(
|
|
parameter_name='request_token_id')
|
|
})]
|
|
|
|
|
|
APIs = (OSAuth1API,)
|