Authentication to FAS

The Fedora Account System has a JSON interface that we make use of to authenticate users in our web apps. Currently, there are two modes of operation. Some web apps have single sign-on capability with Fedora Account System. These are the TurboGears applications that use the jsonfasprovider. Other apps do not have single sign-on but they do connect to Fedora Account System to verify the username and password so changing the password in Fedora Account System changes it everywhere.

TurboGears Identity Provider 2

An identity provider with CSRF protection.

This will install as a TurboGears identity plugin. To use it, set the following in your APPNAME/config/app.cfg file:

identity.provider='jsonfas2'
visit.manager='jsonfas2'

See also

CSRF Protection

This plugin provides authentication by integrating with the Fedora Account System using JSON calls.

Module author: Toshio Kuratomi <tkuratom@redhat.com>

Module author: Ricky Zhou <ricky@fedoraproject.org>

class fedora.tg.identity.jsonfasprovider2.JsonFasIdentity(visit_key=None, user=None, username=None, password=None, using_ssl=False)

Associate an identity with a person in the auth system.

anonymous

Return True if not logged in.

cache_session = False
cookie_name = 'tg-visit'
csrf_token

Get the csrf token for this identity

display_name

Return the user’s display name.

Warning

This is not a TG standard attribute. Don’t use this if you want to be compatible with other identity providers.

fas_url = 'https://admin.fedoraproject.org/accounts/'
group_ids

Get set of group IDs of this identity.

groups

Return the groups that a user is a member of.

login(using_ssl=False)

Send a request so that we associate the visit_cookie with the user

Parameters:using_ssl – Boolean that tells whether ssl was used to authenticate
login_url

Get the URL for the login page.

logout()

Remove the link between this identity and the visit.

only_token

In one specific instance in the login template we need to know whether an anonymous user is just lacking a token.

permissions

Get set of permission names of this identity.

send_request(method, req_params=None, auth=False)

Make an HTTP Request to a server method.

We need to override the send_request provided by BaseClient to keep the visit_key in sync.

user

Get user instance for this identity.

user_id

Get user id of this identity.

user_name

Get user name of this identity.

useragent = 'JsonFasIdentity/0.10.0'
class fedora.tg.identity.jsonfasprovider2.JsonFasIdentityProvider

IdentityProvider that authenticates users against the fedora account system

anonymous_identity()

Returns an anonymous user object

Returns:an object with the following properties: :user_name: original user name :user: a provider dependant object (TG_User or similar) :groups: a set of group IDs :permissions: a set of permission IDs
authenticated_identity(user)

Constructs Identity object for user that has no associated visit_key.

Parameters:user – The user structure the identity is constructed from
Returns:an object with the following properties: :user_name: original user name :user: a provider dependant object (TG_User or similar) :groups: a set of group IDs :permissions: a set of permission IDs
create_provider_model()

Create the database tables if they don’t already exist.

load_identity(visit_key)

Lookup the principal represented by visit_key.

Parameters:visit_key – The session key for whom we’re looking up an identity.
Returns:an object with the following properties: :user_name: original user name :user: a provider dependant object (TG_User or similar) :groups: a set of group IDs :permissions: a set of permission IDs
validate_identity(user_name, password, visit_key)

Look up the identity represented by user_name and determine whether the password is correct.

Must return either None if the credentials weren’t valid or an object with the following properties:

user_name:original user name
user:a provider dependant object (TG_User or similar)
groups:a set of group IDs
permissions:a set of permission IDs
Parameters:
  • user_name – user_name we’re authenticating. If None, we’ll try to lookup a username from SSL variables
  • password – password to authenticate user_name with
  • visit_key – visit_key from the user’s session
validate_password(user, user_name, password)

Check the supplied user_name and password against existing credentials. Note: user_name is not used here, but is required by external password validation schemes that might override this method. If you use SqlAlchemyIdentityProvider, but want to check the passwords against an external source (i.e. PAM, LDAP, Windows domain, etc), subclass SqlAlchemyIdentityProvider, and override this method.

Parameters:
  • user – User information.
  • user_name – Given username. Not used.
  • password – Given, plaintext password.
Returns:

True if the password matches the username. Otherwise False. Can return False for problems within the Account System as well.

This plugin provides integration with the Fedora Account System using JSON calls to the account system server.

Module author: Toshio Kuratomi <tkuratom@redhat.com>

class fedora.tg.visit.jsonfasvisit2.JsonFasVisitManager(timeout)

This proxies visit requests to the Account System Server running remotely.

create_model()

Create the Visit table if it doesn’t already exist.

Not needed as the visit tables reside remotely in the FAS2 database.

debug = False
error_session_id = 0
error_session_id_lock = <thread.lock object>
fas = None
fas_url = 'https://admin.fedoraproject.org/accounts'
new_visit_with_key(visit_key)

Return a new Visit object with the given key.

update_queued_visits(queue)

Update the visit information on the server

visit_for_key(visit_key)

Return the visit for this key or None if the visit doesn’t exist or has expired.

Turbogears Identity Provider 1

These methods are deprecated because they do not provide the CSRF protection of TurboGears Identity Provider 2. Please use that identity provider instead.

Deprecated Use jsonfasprovider2 instead a it provides CSRF protection.

This plugin provides integration with the Fedora Account System using JSON calls.

Module author: Toshio Kuratomi <tkuratom@redhat.com>

Module author: Ricky Zhou <ricky@fedoraproject.org>

class fedora.tg.identity.jsonfasprovider1.JsonFasIdentity(visit_key, user=None, username=None, password=None)

Associate an identity with a person in the auth system.

anonymous

Return True if there’s no user logged in.

cache_session = False
cookie_name = 'tg-visit'
display_name

Return the user’s display name.

fas_url = 'https://admin.fedoraproject.org/accounts/'
groups

Return the groups that a user is a member of.

logout()

Remove the link between this identity and the visit.

send_request(method, req_params=None, auth=False)

Make an HTTP Request to a server method.

We need to override the send_request provided by BaseClient to keep the visit_key in sync.

user

Retrieve information about the user from cache or network.

user_name

Return the username for the user.

useragent = 'JsonFasIdentity/0.10.0'
class fedora.tg.identity.jsonfasprovider1.JsonFasIdentityProvider

IdentityProvider that authenticates users against the fedora account system

anonymous_identity()

Must return an object with the following properties:

user_name:original user name
user:a provider dependant object (TG_User or similar)
groups:a set of group IDs
permissions:a set of permission IDs
authenticated_identity(user)

Constructs Identity object for user that has no associated visit_key.

create_provider_model()

Create the database tables if they don’t already exist.

load_identity(visit_key)

Lookup the principal represented by visit_key.

Parameters:visit_key – The session key for whom we’re looking up an identity.
Returns:an object with the following properties:
user_name:original user name
user:a provider dependant object (TG_User or similar)
groups:a set of group IDs
permissions:a set of permission IDs
validate_identity(user_name, password, visit_key)

Look up the identity represented by user_name and determine whether the password is correct.

Must return either None if the credentials weren’t valid or an object with the following properties:

user_name:original user name
user:a provider dependant object (TG_User or similar)
groups:a set of group IDs
permissions:a set of permission IDs
validate_password(user, user_name, password)

Check the supplied user_name and password against existing credentials. Note: user_name is not used here, but is required by external password validation schemes that might override this method. If you use SqlAlchemyIdentityProvider, but want to check the passwords against an external source (i.e. PAM, LDAP, Windows domain, etc), subclass SqlAlchemyIdentityProvider, and override this method.

Parameters:
  • user – User information. Not used.
  • user_name – Given username.
  • password – Given, plaintext password.
Returns:

True if the password matches the username. Otherwise False. Can return False for problems within the Account System as well.

This plugin provides integration with the Fedora Account System using JSON calls to the account system server.

Module author: Toshio Kuratomi <tkuratom@redhat.com>

class fedora.tg.visit.jsonfasvisit1.JsonFasVisitManager(timeout)

This proxies visit requests to the Account System Server running remotely.

create_model()

Create the Visit table if it doesn’t already exist.

Not needed as the visit tables reside remotely in the FAS2 database.

fas = None
fas_url = 'https://admin.fedoraproject.org/accounts'
new_visit_with_key(visit_key)

Return a new Visit object with the given key.

update_queued_visits(queue)

Update the visit information on the server

visit_for_key(visit_key)

Return the visit for this key or None if the visit doesn’t exist or has expired.

Flask FAS OpenId Auth Plugin

The flask_openid provider is an alternative to the flask_fas auth plugin. It leverages our FAS-OpenID server to do authn and authz (group memberships). Note that not every feature is available with a generic OpenID provider – the plugin depends on the OpenID provider having certain extensions in order to provide more than basic OpenID auth.

If the provider you use does not support one of these extensions, the plugin should still work but naturally, it will return empty values for the information that the extension would have provided.