Changeset 9:41f264620073 in OKFNAnnotator (for Zope)

Timestamp:

Feb 12, 2015, 6:46:55 PM (10 years ago)

Author:

casties

Branch:

default

Tags:

tip

Message:

adds user's groups from LDAP to generated token.

File:

• AuthTokenGenerator.py (modified) (5 diffs)

AuthTokenGenerator.py

@@ -45 +45 @@
     def index_html(self, user='anonymous'):
         """returns authentication token for user (Zope style)"""
-        if self._user_allowed(user=user):
-            token = self._generate_token(user)
+        zUser = self._allowed_user(user=user)
+        logging.debug("allowed user: %s"%repr(zUser))
+        if zUser:
+            token = self._generate_token(zUser)
             # set CORS headers
             origin = self.REQUEST.getHeader("Origin", None)
@@ -71 +73 @@
 
         self.REQUEST.RESPONSE.setHeader("Access-Control-Allow-Credentials", "true")
-        if self._user_allowed(user=user, password=password):
-            token = self._generate_token(user)
+        zUser = self._allowed_user(user=user, password=password)
+        logging.debug("allowed user: %s"%repr(zUser))
+        if zUser:
+            token = self._generate_token(zUser)
             logging.debug("token for user %s: %s"%(user, token))
             self.REQUEST.RESPONSE.setHeader("Content-Type", "text/plain")
@@ -80 +84 @@
             return "Please Authenticate!"
 
-    def _user_allowed(self, user=None, password=None):
+    def _allowed_user(self, user=None, password=None):
         # check the login
         if user == 'anonymous':
@@ -91 +95 @@
         if authname == user:
             # user is logged in
-            return authname
+            return authuser
         
         if password:
@@ -108 +112 @@
         return None
 
-    def _generate_token(self, user_id):
+    def _generate_token(self, user):
         #return JSON-token
         issue_time = datetime.datetime.now(UTC).replace(microsecond=0)
+        if isinstance(user, basestring):
+            # not a real User object
+            user_id = user
+        else:
+            user_id = user.getUserName()
+            
+        payload = {
+            'consumerKey':self.consumer_key, 
+            'userId':user_id, 
+            'issuedAt':issue_time.isoformat(), 
+            'ttl':self.tokenTtl}
         
-        return jwt.encode({
-           'consumerKey': self.consumer_key,
-           'userId': user_id,
-           'issuedAt': issue_time.isoformat(),
-           'ttl': self.tokenTtl
-           }, self.consumer_secret)
+        if hasattr(user, '_getLDAPGroups'):
+            # add groups from LDAP
+            groups = user._getLDAPGroups()
+            payload['memberOf'] = groups
+            
+        logging.debug("token payload=%s"%repr(payload))
+        return jwt.encode(payload, self.consumer_secret)