Authentication to FAS¶
The Fedora Account System has a JSON interface that we make use
of to authenticate users in our web apps. Currently, there are two modes of
operation. Some web apps have single sign-on capability with
Fedora Account System. These are the TurboGears applications that use the
jsonfasprovider
. Other apps do not have
single sign-on but they do connect to Fedora Account System to verify the
username and password so changing the password in Fedora Account System changes it
everywhere.
TurboGears Identity Provider 2¶
An identity provider with CSRF protection.
This will install as a TurboGears identity plugin. To use it, set the
following in your APPNAME/config/app.cfg
file:
identity.provider='jsonfas2'
visit.manager='jsonfas2'
See also
This plugin provides authentication by integrating with the Fedora Account System using JSON calls.
Module author: Toshio Kuratomi <tkuratom@redhat.com>
Module author: Ricky Zhou <ricky@fedoraproject.org>
-
class
fedora.tg.identity.jsonfasprovider2.
JsonFasIdentity
(visit_key=None, user=None, username=None, password=None, using_ssl=False)¶ Associate an identity with a person in the auth system.
-
anonymous
¶ Return True if not logged in.
-
cache_session
= False¶
-
csrf_token
¶ Get the csrf token for this identity
-
display_name
¶ Return the user’s display name.
Warning
This is not a TG standard attribute. Don’t use this if you want to be compatible with other identity providers.
-
fas_url
= 'https://admin.fedoraproject.org/accounts/'¶
-
group_ids
¶ Get set of group IDs of this identity.
-
groups
¶ Return the groups that a user is a member of.
-
login
(using_ssl=False)¶ Send a request so that we associate the visit_cookie with the user
Parameters: using_ssl – Boolean that tells whether ssl was used to authenticate
-
login_url
¶ Get the URL for the login page.
-
logout
()¶ Remove the link between this identity and the visit.
-
only_token
¶ In one specific instance in the login template we need to know whether an anonymous user is just lacking a token.
-
permissions
¶ Get set of permission names of this identity.
-
send_request
(method, req_params=None, auth=False)¶ Make an HTTP Request to a server method.
We need to override the send_request provided by
BaseClient
to keep the visit_key in sync.
-
user
¶ Get user instance for this identity.
-
user_id
¶ Get user id of this identity.
-
user_name
¶ Get user name of this identity.
-
useragent
= 'JsonFasIdentity/0.10.0'¶
-
-
class
fedora.tg.identity.jsonfasprovider2.
JsonFasIdentityProvider
¶ IdentityProvider that authenticates users against the fedora account system
-
anonymous_identity
()¶ Returns an anonymous user object
Returns: an object with the following properties: :user_name: original user name :user: a provider dependant object (TG_User or similar) :groups: a set of group IDs :permissions: a set of permission IDs
-
authenticated_identity
(user)¶ Constructs Identity object for user that has no associated visit_key.
Parameters: user – The user structure the identity is constructed from Returns: an object with the following properties: :user_name: original user name :user: a provider dependant object (TG_User or similar) :groups: a set of group IDs :permissions: a set of permission IDs
-
create_provider_model
()¶ Create the database tables if they don’t already exist.
-
load_identity
(visit_key)¶ Lookup the principal represented by visit_key.
Parameters: visit_key – The session key for whom we’re looking up an identity. Returns: an object with the following properties: :user_name: original user name :user: a provider dependant object (TG_User or similar) :groups: a set of group IDs :permissions: a set of permission IDs
-
validate_identity
(user_name, password, visit_key)¶ Look up the identity represented by user_name and determine whether the password is correct.
Must return either None if the credentials weren’t valid or an object with the following properties:
user_name: original user name user: a provider dependant object (TG_User or similar) groups: a set of group IDs permissions: a set of permission IDs Parameters: - user_name – user_name we’re authenticating. If None, we’ll try to lookup a username from SSL variables
- password – password to authenticate user_name with
- visit_key – visit_key from the user’s session
-
validate_password
(user, user_name, password)¶ Check the supplied user_name and password against existing credentials. Note: user_name is not used here, but is required by external password validation schemes that might override this method. If you use SqlAlchemyIdentityProvider, but want to check the passwords against an external source (i.e. PAM, LDAP, Windows domain, etc), subclass SqlAlchemyIdentityProvider, and override this method.
Parameters: - user – User information.
- user_name – Given username. Not used.
- password – Given, plaintext password.
Returns: True if the password matches the username. Otherwise False. Can return False for problems within the Account System as well.
-
This plugin provides integration with the Fedora Account System using JSON calls to the account system server.
Module author: Toshio Kuratomi <tkuratom@redhat.com>
-
class
fedora.tg.visit.jsonfasvisit2.
JsonFasVisitManager
(timeout)¶ This proxies visit requests to the Account System Server running remotely.
-
create_model
()¶ Create the Visit table if it doesn’t already exist.
Not needed as the visit tables reside remotely in the FAS2 database.
-
debug
= False¶
-
error_session_id
= 0¶
-
error_session_id_lock
= <thread.lock object>¶
-
fas
= None¶
-
fas_url
= 'https://admin.fedoraproject.org/accounts'¶
-
new_visit_with_key
(visit_key)¶ Return a new Visit object with the given key.
-
update_queued_visits
(queue)¶ Update the visit information on the server
-
visit_for_key
(visit_key)¶ Return the visit for this key or None if the visit doesn’t exist or has expired.
-
Turbogears Identity Provider 1¶
These methods are deprecated because they do not provide the CSRF protection of TurboGears Identity Provider 2. Please use that identity provider instead.
Deprecated Use jsonfasprovider2 instead a it provides CSRF protection.
This plugin provides integration with the Fedora Account System using JSON calls.
Module author: Toshio Kuratomi <tkuratom@redhat.com>
Module author: Ricky Zhou <ricky@fedoraproject.org>
-
class
fedora.tg.identity.jsonfasprovider1.
JsonFasIdentity
(visit_key, user=None, username=None, password=None)¶ Associate an identity with a person in the auth system.
-
anonymous
¶ Return True if there’s no user logged in.
-
cache_session
= False¶
-
display_name
¶ Return the user’s display name.
-
fas_url
= 'https://admin.fedoraproject.org/accounts/'¶
-
groups
¶ Return the groups that a user is a member of.
-
logout
()¶ Remove the link between this identity and the visit.
-
send_request
(method, req_params=None, auth=False)¶ Make an HTTP Request to a server method.
We need to override the send_request provided by
BaseClient
to keep the visit_key in sync.
-
user
¶ Retrieve information about the user from cache or network.
-
user_name
¶ Return the username for the user.
-
useragent
= 'JsonFasIdentity/0.10.0'¶
-
-
class
fedora.tg.identity.jsonfasprovider1.
JsonFasIdentityProvider
¶ IdentityProvider that authenticates users against the fedora account system
-
anonymous_identity
()¶ Must return an object with the following properties:
user_name: original user name user: a provider dependant object (TG_User or similar) groups: a set of group IDs permissions: a set of permission IDs
-
authenticated_identity
(user)¶ Constructs Identity object for user that has no associated visit_key.
-
create_provider_model
()¶ Create the database tables if they don’t already exist.
-
load_identity
(visit_key)¶ Lookup the principal represented by visit_key.
Parameters: visit_key – The session key for whom we’re looking up an identity. Returns: an object with the following properties: user_name: original user name user: a provider dependant object (TG_User or similar) groups: a set of group IDs permissions: a set of permission IDs
-
validate_identity
(user_name, password, visit_key)¶ Look up the identity represented by user_name and determine whether the password is correct.
Must return either None if the credentials weren’t valid or an object with the following properties:
user_name: original user name user: a provider dependant object (TG_User or similar) groups: a set of group IDs permissions: a set of permission IDs
-
validate_password
(user, user_name, password)¶ Check the supplied user_name and password against existing credentials. Note: user_name is not used here, but is required by external password validation schemes that might override this method. If you use SqlAlchemyIdentityProvider, but want to check the passwords against an external source (i.e. PAM, LDAP, Windows domain, etc), subclass SqlAlchemyIdentityProvider, and override this method.
Parameters: - user – User information. Not used.
- user_name – Given username.
- password – Given, plaintext password.
Returns: True if the password matches the username. Otherwise False. Can return False for problems within the Account System as well.
-
This plugin provides integration with the Fedora Account System using JSON calls to the account system server.
Module author: Toshio Kuratomi <tkuratom@redhat.com>
-
class
fedora.tg.visit.jsonfasvisit1.
JsonFasVisitManager
(timeout)¶ This proxies visit requests to the Account System Server running remotely.
-
create_model
()¶ Create the Visit table if it doesn’t already exist.
Not needed as the visit tables reside remotely in the FAS2 database.
-
fas
= None¶
-
fas_url
= 'https://admin.fedoraproject.org/accounts'¶
-
new_visit_with_key
(visit_key)¶ Return a new Visit object with the given key.
-
update_queued_visits
(queue)¶ Update the visit information on the server
-
visit_for_key
(visit_key)¶ Return the visit for this key or None if the visit doesn’t exist or has expired.
-
Django Authentication Backend¶
Flask Auth Plugin¶
Flask FAS OpenId Auth Plugin¶
The flask_openid provider is an alternative to the flask_fas auth plugin. It leverages our FAS-OpenID server to do authn and authz (group memberships). Note that not every feature is available with a generic OpenID provider – the plugin depends on the OpenID provider having certain extensions in order to provide more than basic OpenID auth.
- Any compliant OpenID server should allow you to use the basic authn features of OpenID OpenID authentication core: http://openid.net/specs/openid-authentication-2_0.html
- Retrieving simple information about the user such as username, human name, email is done with sreg: http://openid.net/specs/openid-simple-registration-extension-1_0.html which is an extension supported by many providers.
- Advanced security features such as requiring a user to re-login to the OpenID provider or specifying that the user login with a hardware token requires the PAPE extension: http://openid.net/specs/openid-provider-authentication-policy-extension-1_0.html
- To get groups information, the provider must implement the
https://dev.launchpad.net/OpenIDTeams extension.
- We have extended the teams extension so you can request a team name of
_FAS_ALL_GROUPS_
to retrieve all the groups that a user belongs to. Without this addition to the teams extension you will need to manually configure which groups you are interested in knowing about. See the documentation for how to do so.
- We have extended the teams extension so you can request a team name of
- Retrieving information about whether a user has signed a CLA (For Fedora, this is the Fedora Project Contributor Agreement). http://fedoraproject.org/specs/open_id/cla
If the provider you use does not support one of these extensions, the plugin should still work but naturally, it will return empty values for the information that the extension would have provided.