Viewing file: userbase.py (21.04 KB) -rw-r--r-- Select action/file-type: (+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
# Copright 2008 Divmod, Inc. See LICENSE file for details. # -*- test-case-name: axiom.test.test_userbase -*-
""" The L{axiom.userbase} module implements various interfaces from L{twisted.cred} to allow an Axiom database to serve as an integration point for Twisted services that do authentication.
While not strictly required, one part of this implementation is the idiom that Axiom (by default) partitions its user database into a separate data-store for each users.
This has several advantages:
- Each user's account can be quickly and independently added to or removed from the system; inactive accounts can be quickly moved to archival storage.
- User accounts may be migrated between servers relatively easily.
- Database queries that deal with a single user's data are completely partitioned; even naive and inefficient queries can still be run quickly as long as users do not individually have a lot of data in a particular table.
For truly multi-user applications, this partitioning is incomplete without an abstract facility for exchanging data between different users of the same application. This module does not implement such a facility, as it is left to higher-level mechanisms such as Mantissa's messaging system in L{xmantissa.messaging}. However, this module works standalone as well; just be aware that a user's database contains only their own data. """
import warnings
from zope.interface import implements, Interface
from twisted.cred.portal import IRealm from twisted.cred.credentials import IUsernamePassword, IUsernameHashedPassword from twisted.cred.checkers import ICredentialsChecker, ANONYMOUS from twisted.python import log
from axiom.store import Store from axiom.item import Item from axiom.substore import SubStore from axiom.attributes import text, integer, reference, boolean, AND, OR from axiom.errors import ( BadCredentials, NoSuchUser, DuplicateUser, MissingDomainPart) from axiom.scheduler import IScheduler from axiom import upgrade, iaxiom
ANY_PROTOCOL = u'*'
def dflip(x): warnings.warn("Don't use dflip no more", stacklevel=2) return x
class AllNamesConflict(Exception): """ When inserting a SubStore into a site store, no names were found which were not already associated with an account.
This prevents the SubStore from being inserted at all. No files are moved and the site database is not modified. """
class DatabaseDirectoryConflict(Exception): """ When inserting a SubStore into a site store, the selected ultimate location for the SubStore's Axiom database directory already existed.
This prevents the SubStore from being inserted at all. No files are moved and the site database is not modified. """
class IPreauthCredentials(Interface): """ Deprecated. Don't use this. If you wrote a checker which can check this interface, make it check one of the interfaces L{Preauthenticated} implements, instead. """
class Preauthenticated(object): """ A credentials object of multiple types which has already been authenticated somehow.
Credentials interfaces methods are implemented to behave as if the correct credentials had been supplied. """ implements(IUsernamePassword, IUsernameHashedPassword)
def __init__(self, username): self.username = username
def checkPassword(self, password): """ The password checks out. """ return True
def __repr__(self): return '<Preauthenticated: %s>' % (self.username,)
class LoginMethod(Item): typeName = 'login_method' schemaVersion = 2
localpart = text(doc=""" A local-part of my user's identifier. """, indexed=True, allowNone=False)
domain = text(doc=""" The domain part of my user's identifier. [XXX See TODO below] May be None (generally for "system" users). """, indexed=True)
internal = boolean(doc=""" Flag indicating whether this is a method maintained by this server, or if it represents an external contact mechanism (such as a third-party email provider) """, allowNone=False)
protocol = text(indexed=True, allowNone=False) account = reference(doc=""" A reference to the LoginAccount for which this is a login method. """, allowNone=False)
verified = boolean(indexed=True, allowNone=False)
def upgradeLoginMethod1To2(old): return old.upgradeVersion( 'login_method', 1, 2, localpart=old.localpart, domain=old.domain, internal=old.internal, protocol=old.protocol, account=old.account, verified=old.verified)
upgrade.registerUpgrader(upgradeLoginMethod1To2, 'login_method', 1, 2)
class LoginAccount(Item): """ I am an entry in a LoginBase.
@ivar avatars: An Item which is adaptable to various cred client interfaces. Plural because it represents a collection of potentially disparate implementors, such as an IResource for web access and an IContact for SIP access.
@ivar disabled: This account has been disabled. It is still database-resident but the user should not be allowed to log in.
""" typeName = 'login' schemaVersion = 2
password = text() avatars = reference() # reference to a thing which can be adapted to # implementations for application-level # protocols. In general this is a reference to # a SubStore because this is optimized for # applications where per-user data is a # substantial portion of the cost. disabled = integer()
def __conform__(self, interface): """ For convenience, forward adaptation to my 'avatars' attribute. """ ifa = interface(self.avatars, None) return ifa
def migrateDown(self): """ Assuming that self.avatars is a SubStore which should contain *only* the LoginAccount for the user I represent, remove all LoginAccounts and LoginMethods from that store and copy all methods from the site store down into it. """ ss = self.avatars.open() def _(): oldAccounts = ss.query(LoginAccount) oldMethods = ss.query(LoginMethod) for x in list(oldAccounts) + list(oldMethods): x.deleteFromStore() self.cloneInto(ss, ss) IScheduler(ss).migrateDown() ss.transact(_)
def migrateUp(self): """ Copy this LoginAccount and all associated LoginMethods from my store (which is assumed to be a SubStore, most likely a user store) into the site store which contains it. """ siteStore = self.store.parent def _(): # No convenience method for the following because needing to do it is # *rare*. It *should* be ugly; 99% of the time if you need to do this # you're making a mistake. -glyph siteStoreSubRef = siteStore.getItemByID(self.store.idInParent) self.cloneInto(siteStore, siteStoreSubRef) IScheduler(self.store).migrateUp() siteStore.transact(_)
def cloneInto(self, newStore, avatars): """ Create a copy of this LoginAccount and all associated LoginMethods in a different Store.
Return the copied LoginAccount. """ la = LoginAccount(store=newStore, password=self.password, avatars=avatars, disabled=self.disabled) for siteMethod in self.store.query(LoginMethod, LoginMethod.account == self): LoginMethod(store=newStore, localpart=siteMethod.localpart, domain=siteMethod.domain, internal=siteMethod.internal, protocol=siteMethod.protocol, verified=siteMethod.verified, account=la) return la
def deleteLoginMethods(self): self.store.query(LoginMethod, LoginMethod.account == self).deleteFromStore()
def addLoginMethod(self, localpart, domain, protocol=ANY_PROTOCOL, verified=False, internal=False): """ Add a login method to this account, propogating up or down as necessary to site store or user store to maintain consistency. """ # Out takes you west or something if self.store.parent is None: # West takes you in otherStore = self.avatars.open() peer = otherStore.findUnique(LoginAccount) else: # In takes you east otherStore = self.store.parent subStoreItem = self.store.parent.getItemByID(self.store.idInParent) peer = otherStore.findUnique(LoginAccount, LoginAccount.avatars == subStoreItem)
# Up and down take you home for store, account in [(otherStore, peer), (self.store, self)]: store.findOrCreate(LoginMethod, account=account, localpart=localpart, domain=domain, protocol=protocol, verified=verified, internal=internal)
def insertUserStore(siteStore, userStorePath): """ Move the SubStore at the indicated location into the given site store's directory and then hook it up to the site store's authentication database.
@type siteStore: C{Store} @type userStorePath: C{FilePath} """ # The following may, but does not need to be in a transaction, because it # is merely an attempt to guess a reasonable filesystem name to use for # this avatar. The user store being operated on is expected to be used # exclusively by this process. ls = siteStore.findUnique(LoginSystem) unattachedSubStore = Store(userStorePath) for lm in unattachedSubStore.query(LoginMethod, LoginMethod.account == unattachedSubStore.findUnique(LoginAccount), sort=LoginMethod.internal.descending): if ls.accountByAddress(lm.localpart, lm.domain) is None: localpart, domain = lm.localpart, lm.domain break else: raise AllNamesConflict()
unattachedSubStore.close()
insertLocation = siteStore.newFilePath('account', domain, localpart + '.axiom') insertParentLoc = insertLocation.parent() if not insertParentLoc.exists(): insertParentLoc.makedirs() if insertLocation.exists(): raise DatabaseDirectoryConflict() userStorePath.moveTo(insertLocation) ss = SubStore(store=siteStore, storepath=insertLocation) attachedStore = ss.open() # migrateUp() manages its own transactions because it interacts with two # different stores. attachedStore.findUnique(LoginAccount).migrateUp()
def extractUserStore(userAccount, extractionDestination, legacySiteAuthoritative=True): """ Move the SubStore for the given user account out of the given site store completely. Place the user store's database directory into the given destination directory.
@type userAccount: C{LoginAccount} @type extractionDestination: C{FilePath}
@type legacySiteAuthoritative: C{bool}
@param legacySiteAuthoritative: before moving the user store, clear its authentication information, copy that which is associated with it in the site store rather than trusting its own. Currently this flag is necessary (and defaults to true) because things like the ClickChronicle password-changer gizmo still operate on the site store.
""" if legacySiteAuthoritative: # migrateDown() manages its own transactions, since it is copying items # between two different stores. userAccount.migrateDown() av = userAccount.avatars av.open().close() def _(): # We're separately deleting several Items from the site store, then # we're moving some files. If we cannot move the files, we don't want # to delete the items.
# There is one unaccounted failure mode here: if the destination of the # move is on a different mount point, the moveTo operation will fall # back to a non-atomic copy; if all of the copying succeeds, but then # part of the deletion of the source files fails, we will be left # without a complete store in this site store's files directory, but # the account Items will remain. This will cause odd errors on login # and at other unpredictable times. The database is only one file, so # we will either remove it all or none of it. Resolving this requires # manual intervention currently: delete the substore's database # directory and the account items (LoginAccount and LoginMethods) # manually.
# However, this failure is extremely unlikely, as it would almost # certainly indicate a misconfiguration of the permissions on the site # store's files area. As described above, a failure of the call to # os.rename(), if the platform's rename is atomic (which it generally # is assumed to be) will not move any files and will cause a revert of # the transaction which would have deleted the accompanying items.
av.deleteFromStore() userAccount.deleteLoginMethods() userAccount.deleteFromStore() av.storepath.moveTo(extractionDestination) userAccount.store.transact(_)
def upgradeLoginAccount1To2(oldAccount): password = oldAccount.password if password is not None: try: password = password.decode('ascii') except UnicodeDecodeError: password = None
newAccount = oldAccount.upgradeVersion( 'login', 1, 2, password=password, avatars=oldAccount.avatars, disabled=oldAccount.disabled)
def make(s, acc): LoginMethod( store=s, localpart=oldAccount.username, domain=oldAccount.domain, internal=False, protocol=u'email', account=acc, verified=True)
make(newAccount.store, newAccount) ss = newAccount.avatars.open() # create account in substore to represent the user's own record of their # password; moves with them during migrations, etc. subacc = LoginAccount(store=ss, password=newAccount.password, avatars=ss, disabled=newAccount.disabled) make(ss, subacc)
from axiom import upgrade upgrade.registerUpgrader(upgradeLoginAccount1To2, 'login', 1, 2)
class SubStoreLoginMixin: def makeAvatars(self, domain, username): return SubStore.createNew(self.store, ('account', domain, username + '.axiom'))
class LoginBase: """ I am a database powerup which provides an interface to a collection of username/password pairs mapped to user application objects. """ implements(IRealm, ICredentialsChecker)
credentialInterfaces = (IUsernamePassword, IUsernameHashedPassword)
powerupInterfaces = (IRealm, ICredentialsChecker)
def accountByAddress(self, username, domain): """ @type username: C{unicode} without NUL @type domain: C{unicode} without NUL """ for account in self.store.query(LoginAccount, AND(LoginMethod.domain == domain, LoginMethod.localpart == username, LoginAccount.disabled == 0, LoginMethod.account == LoginAccount.storeID)): return account
def addAccount(self, username, domain, password, avatars=None, protocol=u'email', disabled=0, internal=False, verified=True): """ Create a user account, add it to this LoginBase, and return it.
This method must be called within a transaction in my store.
@param username: the user's name.
@param domain: the domain part of the user's name [XXX TODO: this really ought to say something about whether it's a Q2Q domain, a SIP domain, an HTTP realm, or an email address domain - right now the assumption is generally that it's an email address domain, but not always]
@param password: A shared secret.
@param avatars: (Optional). A SubStore which, if passed, will be used by cred as the target of all adaptations for this user. By default, I will create a SubStore, and plugins can be installed on that substore using the powerUp method to provide implementations of cred client interfaces.
@raise DuplicateUniqueItem: if the 'avatars' argument already contains a LoginAccount.
@return: an instance of a LoginAccount, with all attributes filled out as they are passed in, stored in my store. """
# unicode(None) == u'None', kids. if username is not None: username = unicode(username) if domain is not None: domain = unicode(domain) if password is not None: password = unicode(password)
if self.accountByAddress(username, domain) is not None: raise DuplicateUser(username, domain) if avatars is None: avatars = self.makeAvatars(domain, username)
subStore = avatars.open()
# create this unconditionally; as the docstring says, we must be run # within a transaction, so if something goes wrong in the substore # transaction this item's creation will be reverted... la = LoginAccount(store=self.store, password=password, avatars=avatars, disabled=disabled)
def createSubStoreAccountObjects():
LoginAccount(store=subStore, password=password, disabled=disabled, avatars=subStore)
la.addLoginMethod(localpart=username, domain=domain, protocol=protocol, internal=internal, verified=verified)
subStore.transact(createSubStoreAccountObjects) return la
def logoutFactory(self, obj): return getattr(obj, 'logout', lambda: None)
def requestAvatar(self, avatarId, mind, *interfaces): if avatarId is ANONYMOUS: av = self.store else: av = self.store.getItemByID(avatarId) for interface in interfaces: impl = interface(av, None) if impl is not None: self.loginCount += 1 log.msg(interface=iaxiom.IStatEvent, name='cred', cred_interface=interface) return interface, impl, self.logoutFactory(impl) raise NotImplementedError()
def requestAvatarId(self, credentials): try: username, domain = credentials.username.split('@', 1) except ValueError: self.failedLogins += 1 raise MissingDomainPart(credentials.username)
username = unicode(username) domain = unicode(domain)
acct = self.accountByAddress(username, domain) if acct is not None: password = acct.password if credentials.checkPassword(password): return acct.storeID else: self.failedLogins += 1 raise BadCredentials()
self.failedLogins += 1 raise NoSuchUser(credentials.username)
class LoginSystem(Item, LoginBase, SubStoreLoginMixin): schemaVersion = 1 typeName = 'login_system'
loginCount = integer(default=0) failedLogins = integer(default=0)
def getLoginMethods(store, protocol=None): """ Retrieve L{LoginMethod} items from store C{store}, optionally constraining them by protocol """ if protocol is not None: comp = OR(LoginMethod.protocol == u'*', LoginMethod.protocol == protocol) else: comp = None return store.query(LoginMethod, comp)
def getAccountNames(store, protocol=None): """ Retrieve account name information about the given database.
@param store: An Axiom Store representing a user account. It must have been opened through the store which contains its account information.
@return: A generator of two-tuples of (username, domain) which refer to the given store. """ return ((meth.localpart, meth.domain) for meth in getLoginMethods(store, protocol))
def getDomainNames(store): """ Retrieve a list of all local domain names represented in the given store. """ domains = set() domains.update(store.query( LoginMethod, AND(LoginMethod.internal == True, LoginMethod.domain != None)).getColumn("domain").distinct()) return sorted(domains)
|