[Update] users认证逻辑迁移到authentication中

apps/authentication/api/__init__.py

@@ -0,0 +1,4 @@
+# -*- coding: utf-8 -*-
+#
+
+from .auth import *

apps/authentication/api/auth.py

@@ -0,0 +1,200 @@
+# -*- coding: utf-8 -*-
+#
+
+import uuid
+
+from django.core.cache import cache
+from django.urls import reverse
+from django.shortcuts import get_object_or_404
+from django.utils.translation import ugettext as _
+
+from rest_framework.permissions import AllowAny
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from common.utils import get_logger, get_request_ip
+from common.permissions import IsOrgAdminOrAppUser
+from orgs.mixins import RootOrgViewMixin
+from authentication.signals import post_auth_success, post_auth_failed
+from users.serializers import UserSerializer
+from users.models import User, LoginLog
+from users.utils import (
+    check_user_valid, check_otp_code, increase_login_failed_count,
+    is_block_login, clean_failed_count
+)
+from users.hands import Asset, SystemUser
+
+
+logger = get_logger(__name__)
+
+
+class UserAuthApi(RootOrgViewMixin, APIView):
+    permission_classes = (AllowAny,)
+    serializer_class = UserSerializer
+
+    def post(self, request):
+        # limit login
+        username = request.data.get('username')
+        ip = request.data.get('remote_addr', None)
+        ip = ip or get_request_ip(request)
+
+        if is_block_login(username, ip):
+            msg = _("Log in frequently and try again later")
+            logger.warn(msg + ': ' + username + ':' + ip)
+            return Response({'msg': msg}, status=401)
+
+        user, msg = self.check_user_valid(request)
+        if not user:
+            username = request.data.get('username', '')
+            exist = User.objects.filter(username=username).first()
+            reason = LoginLog.REASON_PASSWORD if exist else LoginLog.REASON_NOT_EXIST
+            self.send_auth_signal(success=False, username=username, reason=reason)
+            increase_login_failed_count(username, ip)
+            return Response({'msg': msg}, status=401)
+
+        if user.password_has_expired:
+            self.send_auth_signal(
+                success=False, username=username,
+                reason=LoginLog.REASON_PASSWORD_EXPIRED
+            )
+            msg = _("The user {} password has expired, please update.".format(
+                user.username))
+            logger.info(msg)
+            return Response({'msg': msg}, status=401)
+
+        if not user.otp_enabled:
+            self.send_auth_signal(success=True, user=user)
+            # 登陆成功，清除原来的缓存计数
+            clean_failed_count(username, ip)
+            token = user.create_bearer_token(request)
+            return Response(
+                {'token': token, 'user': self.serializer_class(user).data}
+            )
+
+        seed = uuid.uuid4().hex
+        cache.set(seed, user, 300)
+        return Response(
+            {
+                'code': 101,
+                'msg': _('Please carry seed value and '
+                         'conduct MFA secondary certification'),
+                'otp_url': reverse('api-auth:user-otp-auth'),
+                'seed': seed,
+                'user': self.serializer_class(user).data
+            }, status=300
+        )
+
+    @staticmethod
+    def check_user_valid(request):
+        username = request.data.get('username', '')
+        password = request.data.get('password', '')
+        public_key = request.data.get('public_key', '')
+        user, msg = check_user_valid(
+            username=username, password=password,
+            public_key=public_key
+        )
+        return user, msg
+
+    def send_auth_signal(self, success=True, user=None, username='', reason=''):
+        if success:
+            post_auth_success.send(sender=self.__class__, user=user, request=self.request)
+        else:
+            post_auth_failed.send(
+                sender=self.__class__, username=username,
+                request=self.request, reason=reason
+            )
+
+
+class UserConnectionTokenApi(RootOrgViewMixin, APIView):
+    permission_classes = (IsOrgAdminOrAppUser,)
+
+    def post(self, request):
+        user_id = request.data.get('user', '')
+        asset_id = request.data.get('asset', '')
+        system_user_id = request.data.get('system_user', '')
+        token = str(uuid.uuid4())
+        user = get_object_or_404(User, id=user_id)
+        asset = get_object_or_404(Asset, id=asset_id)
+        system_user = get_object_or_404(SystemUser, id=system_user_id)
+        value = {
+            'user': user_id,
+            'username': user.username,
+            'asset': asset_id,
+            'hostname': asset.hostname,
+            'system_user': system_user_id,
+            'system_user_name': system_user.name
+        }
+        cache.set(token, value, timeout=20)
+        return Response({"token": token}, status=201)
+
+    def get(self, request):
+        token = request.query_params.get('token')
+        user_only = request.query_params.get('user-only', None)
+        value = cache.get(token, None)
+
+        if not value:
+            return Response('', status=404)
+
+        if not user_only:
+            return Response(value)
+        else:
+            return Response({'user': value['user']})
+
+    def get_permissions(self):
+        if self.request.query_params.get('user-only', None):
+            self.permission_classes = (AllowAny,)
+        return super().get_permissions()
+
+
+class UserToken(APIView):
+    permission_classes = (AllowAny,)
+
+    def post(self, request):
+        if not request.user.is_authenticated:
+            username = request.data.get('username', '')
+            email = request.data.get('email', '')
+            password = request.data.get('password', '')
+            public_key = request.data.get('public_key', '')
+
+            user, msg = check_user_valid(
+                username=username, email=email,
+                password=password, public_key=public_key)
+        else:
+            user = request.user
+            msg = None
+        if user:
+            token = user.create_bearer_token(request)
+            return Response({'Token': token, 'Keyword': 'Bearer'}, status=200)
+        else:
+            return Response({'error': msg}, status=406)
+
+
+class UserOtpAuthApi(RootOrgViewMixin, APIView):
+    permission_classes = (AllowAny,)
+    serializer_class = UserSerializer
+
+    def post(self, request):
+        otp_code = request.data.get('otp_code', '')
+        seed = request.data.get('seed', '')
+        user = cache.get(seed, None)
+        if not user:
+            return Response(
+                {'msg': _('Please verify the user name and password first')},
+                status=401
+            )
+        if not check_otp_code(user.otp_secret_key, otp_code):
+            self.send_auth_signal(success=False, username=user.username, reason=LoginLog.REASON_MFA)
+            return Response({'msg': _('MFA certification failed')}, status=401)
+        self.send_auth_signal(success=True, user=user)
+        token = user.create_bearer_token(request)
+        data = {'token': token, 'user': self.serializer_class(user).data}
+        return Response(data)
+
+    def send_auth_signal(self, success=True, user=None, username='', reason=''):
+        if success:
+            post_auth_success.send(sender=self.__class__, user=user, request=self.request)
+        else:
+            post_auth_failed.send(
+                sender=self.__class__, username=username,
+                request=self.request, reason=reason
+            )

apps/authentication/authentication.py

@@ -0,0 +1,155 @@
+# -*- coding: utf-8 -*-
+#
+
+import uuid
+import time
+
+from django.core.cache import cache
+from django.conf import settings
+from django.utils.translation import ugettext as _
+from django.utils.six import text_type
+from django.utils.translation import ugettext_lazy as _
+from rest_framework import HTTP_HEADER_ENCODING
+from rest_framework import authentication, exceptions
+from rest_framework.authentication import CSRFCheck
+
+from common.utils import get_object_or_none, make_signature, http_to_unixtime
+from users.models import User, AccessKey, PrivateToken
+
+
+def get_request_date_header(request):
+    date = request.META.get('HTTP_DATE', b'')
+    if isinstance(date, text_type):
+        # Work around django test client oddness
+        date = date.encode(HTTP_HEADER_ENCODING)
+    return date
+
+
+class AccessKeyAuthentication(authentication.BaseAuthentication):
+    """App使用Access key进行签名认证, 目前签名算法比较简单,
+    app注册或者手动建立后,会生成 access_key_id 和 access_key_secret,
+    然后使用 如下算法生成签名:
+    Signature = md5(access_key_secret + '\n' + Date)
+    example: Signature = md5('d32d2b8b-9a10-4b8d-85bb-1a66976f6fdc' + '\n' +
+                    'Thu, 12 Jan 2017 08:19:41 GMT')
+    请求时设置请求header
+    header['Authorization'] = 'Sign access_key_id:Signature' 如:
+    header['Authorization'] =
+        'Sign d32d2b8b-9a10-4b8d-85bb-1a66976f6fdc:OKOlmdxgYPZ9+SddnUUDbQ=='
+
+    验证时根据相同算法进行验证, 取到access_key_id对应的access_key_id, 从request
+    headers取到Date, 然后进行md5, 判断得到的结果是否相同, 如果是认证通过, 否则 认证
+    失败
+    """
+    keyword = 'Sign'
+    model = AccessKey
+
+    def authenticate(self, request):
+        auth = authentication.get_authorization_header(request).split()
+        if not auth or auth[0].lower() != self.keyword.lower().encode():
+            return None
+
+        if len(auth) == 1:
+            msg = _('Invalid signature header. No credentials provided.')
+            raise exceptions.AuthenticationFailed(msg)
+        elif len(auth) > 2:
+            msg = _('Invalid signature header. Signature '
+                    'string should not contain spaces.')
+            raise exceptions.AuthenticationFailed(msg)
+
+        try:
+            sign = auth[1].decode().split(':')
+            if len(sign) != 2:
+                msg = _('Invalid signature header. '
+                        'Format like AccessKeyId:Signature')
+                raise exceptions.AuthenticationFailed(msg)
+        except UnicodeError:
+            msg = _('Invalid signature header. '
+                    'Signature string should not contain invalid characters.')
+            raise exceptions.AuthenticationFailed(msg)
+
+        access_key_id = sign[0]
+        try:
+            uuid.UUID(access_key_id)
+        except ValueError:
+            raise exceptions.AuthenticationFailed('Access key id invalid')
+        request_signature = sign[1]
+
+        return self.authenticate_credentials(
+            request, access_key_id, request_signature
+        )
+
+    @staticmethod
+    def authenticate_credentials(request, access_key_id, request_signature):
+        access_key = get_object_or_none(AccessKey, id=access_key_id)
+        request_date = get_request_date_header(request)
+        if access_key is None or not access_key.user:
+            raise exceptions.AuthenticationFailed(_('Invalid signature.'))
+        access_key_secret = access_key.secret
+
+        try:
+            request_unix_time = http_to_unixtime(request_date)
+        except ValueError:
+            raise exceptions.AuthenticationFailed(
+                _('HTTP header: Date not provide '
+                  'or not %a, %d %b %Y %H:%M:%S GMT'))
+
+        if int(time.time()) - request_unix_time > 15 * 60:
+            raise exceptions.AuthenticationFailed(
+                _('Expired, more than 15 minutes'))
+
+        signature = make_signature(access_key_secret, request_date)
+        if not signature == request_signature:
+            raise exceptions.AuthenticationFailed(_('Invalid signature.'))
+
+        if not access_key.user.is_active:
+            raise exceptions.AuthenticationFailed(_('User disabled.'))
+        return access_key.user, None
+
+
+class AccessTokenAuthentication(authentication.BaseAuthentication):
+    keyword = 'Bearer'
+    model = User
+    expiration = settings.TOKEN_EXPIRATION or 3600
+
+    def authenticate(self, request):
+        auth = authentication.get_authorization_header(request).split()
+        if not auth or auth[0].lower() != self.keyword.lower().encode():
+            return None
+
+        if len(auth) == 1:
+            msg = _('Invalid token header. No credentials provided.')
+            raise exceptions.AuthenticationFailed(msg)
+        elif len(auth) > 2:
+            msg = _('Invalid token header. Sign string '
+                    'should not contain spaces.')
+            raise exceptions.AuthenticationFailed(msg)
+
+        try:
+            token = auth[1].decode()
+        except UnicodeError:
+            msg = _('Invalid token header. Sign string '
+                    'should not contain invalid characters.')
+            raise exceptions.AuthenticationFailed(msg)
+        return self.authenticate_credentials(token)
+
+    @staticmethod
+    def authenticate_credentials(token):
+        user_id = cache.get(token)
+        user = get_object_or_none(User, id=user_id)
+
+        if not user:
+            msg = _('Invalid token or cache refreshed.')
+            raise exceptions.AuthenticationFailed(msg)
+        return user, None
+
+
+class PrivateTokenAuthentication(authentication.TokenAuthentication):
+    model = PrivateToken
+
+
+class SessionAuthentication(authentication.SessionAuthentication):
+    def enforce_csrf(self, request):
+        reason = CSRFCheck().process_view(request, None, (), {})
+        if reason:
+            raise exceptions.AuthenticationFailed(reason)

apps/authentication/urls/api_urls.py

@@ -1 +1,19 @@
+# coding:utf-8
+#
+from __future__ import absolute_import
+
+from django.urls import path
+
+from .. import api
+
+app_name = 'authentication'
+
+
+urlpatterns = [
+    # path('token/', api.UserToken.as_view(), name='user-token'),
+    path('auth/', api.UserAuthApi.as_view(), name='user-auth'),
+    path('connection-token/',
+         api.UserConnectionTokenApi.as_view(), name='connection-token'),
+    path('otp/auth/', api.UserOtpAuthApi.as_view(), name='user-otp-auth'),
+]
 

apps/authentication/urls/view_urls.py

@@ -2,6 +2,7 @@
 #
 
 from django.urls import path
+
 from .. import views
 
 app_name = 'authentication'
@@ -9,6 +10,11 @@ app_name = 'authentication'
 urlpatterns = [
     # openid
     path('openid/login/', views.OpenIDLoginView.as_view(), name='openid-login'),
-    path('openid/login/complete/', views.OpenIDLoginCompleteView.as_view(),
-         name='openid-login-complete'),
+    path('openid/login/complete/',
+         views.OpenIDLoginCompleteView.as_view(), name='openid-login-complete'),
+
+    # login
+    path('login/', views.UserLoginView.as_view(), name='login'),
+    path('login/otp/', views.UserLoginOtpView.as_view(), name='login-otp'),
+    path('logout/', views.UserLogoutView.as_view(), name='logout'),
 ]

apps/authentication/views/__init__.py

@@ -2,3 +2,4 @@
 #
 
 from .openid import *
+from .login import *

apps/authentication/views/login.py

@@ -1,15 +1,11 @@
 # ~*~ coding: utf-8 ~*~
+#
 
 from __future__ import unicode_literals
 import os
 from django.core.cache import cache
-from django.shortcuts import render
-from django.utils import timezone
 from django.contrib.auth import login as auth_login, logout as auth_logout
-from django.contrib.auth.mixins import LoginRequiredMixin
-from django.views.generic import ListView
-from django.core.files.storage import default_storage
-from django.http import HttpResponseRedirect, HttpResponse
+from django.http import HttpResponse
 from django.shortcuts import reverse, redirect
 from django.utils.decorators import method_decorator
 from django.utils.translation import ugettext as _
@@ -19,23 +15,20 @@ from django.views.decorators.debug import sensitive_post_parameters
 from django.views.generic.base import TemplateView
 from django.views.generic.edit import FormView
 from django.conf import settings
-from formtools.wizard.views import SessionWizardView
 
-from common.utils import get_object_or_none, get_request_ip
+from common.utils import get_request_ip
 from authentication.signals import post_auth_success, post_auth_failed
-from users.models import User, LoginLog
-from users.utils import send_reset_password_mail, check_otp_code, \
-    redirect_user_first_login_or_index, get_user_or_tmp_user, \
-    set_tmp_user_to_cache, get_password_check_rules, check_password_rules, \
-    is_block_login, increase_login_failed_count, clean_failed_count
 from users import forms
+from users.models import User, LoginLog
+from users.utils import (
+    check_otp_code, is_block_login, clean_failed_count, get_user_or_tmp_user,
+    set_tmp_user_to_cache, increase_login_failed_count,
+    redirect_user_first_login_or_index,
+)
 
 
 __all__ = [
     'UserLoginView', 'UserLoginOtpView', 'UserLogoutView',
-    'UserForgotPasswordView', 'UserForgotPasswordSendmailSuccessView',
-    'UserResetPasswordView', 'UserResetPasswordSuccessView',
-    'UserFirstLoginView', 'LoginLogListView'
 ]
 
 
@@ -122,7 +115,7 @@ class UserLoginView(FormView):
 
         if user.otp_enabled and user.otp_secret_key:
             # 1,2,mfa_setting & T
-            return reverse('users:login-otp')
+            return reverse('authentication:login-otp')
         elif user.otp_enabled and not user.otp_secret_key:
             # 1,2,mfa_setting & F
             return reverse('users:user-otp-enable-authentication')
@@ -169,7 +162,9 @@ class UserLoginOtpView(FormView):
                 success=False, username=user.username,
                 reason=LoginLog.REASON_MFA
             )
-            form.add_error('otp_code', _('MFA code invalid, or ntp sync server time'))
+            form.add_error(
+                'otp_code', _('MFA code invalid, or ntp sync server time')
+            )
             return super().form_invalid(form)
 
     def get_success_url(self):
@@ -202,7 +197,7 @@ class UserLogoutView(TemplateView):
             'title': _('Logout success'),
             'messages': _('Logout success, return login page'),
             'interval': 1,
-            'redirect_url': reverse('users:login'),
+            'redirect_url': reverse('authentication:login'),
             'auto_redirect': True,
         }
         kwargs.update(context)