Authentication to FAS

The Fedora Account System has a JSON interface that we make use of to authenticate users in our web apps. Currently, there are two modes of operation. Some web apps have single sign-on capability with Fedora Account System. These are the TurboGears applications that use the jsonfasprovider. Other apps do not have single sign-on but they do connect to Fedora Account System to verify the username and password so changing the password in Fedora Account System changes it everywhere.

TurboGears Identity Provider 2

An identity provider with CSRF protection.

This will install as a TurboGears identity plugin. To use it, set the following in your APPNAME/config/app.cfg file:

identity.provider='jsonfas2'
visit.manager='jsonfas2'

See also

CSRF Protection

Module author: Toshio Kuratomi <tkuratom@redhat.com>

Module author: Ricky Zhou <ricky@fedoraproject.org>

class fedora.tg.identity.jsonfasprovider2.JsonFasIdentity(visit_key=None, user=None, username=None, password=None, using_ssl=False)

Associate an identity with a person in the auth system.

anonymous
csrf_token
display_name
group_ids
groups
login(using_ssl=False)

Send a request so that we associate the visit_cookie with the user

Parameters:
  • using_ssl – Boolean that tells whether ssl was used to authenticate
login_url
logout()
Remove the link between this identity and the visit.
only_token
permissions
send_request(method, req_params=None, auth=False)

Make an HTTP Request to a server method.

We need to override the send_request provided by BaseClient to keep the visit_key in sync.

user
user_id
user_name
class fedora.tg.identity.jsonfasprovider2.JsonFasIdentityProvider

IdentityProvider that authenticates users against the fedora account system

anonymous_identity()

Returns an anonymous user object

Returns:an object with the following properties: :user_name: original user name :user: a provider dependant object (TG_User or similar) :groups: a set of group IDs :permissions: a set of permission IDs
authenticated_identity(user)

Constructs Identity object for user that has no associated visit_key.

Parameters:
  • user – The user structure the identity is constructed from
Returns:

an object with the following properties: :user_name: original user name :user: a provider dependant object (TG_User or similar) :groups: a set of group IDs :permissions: a set of permission IDs

create_provider_model()
Create the database tables if they don’t already exist.
load_identity(visit_key)

Lookup the principal represented by visit_key.

Parameters:
  • visit_key – The session key for whom we’re looking up an identity.
Returns:

an object with the following properties: :user_name: original user name :user: a provider dependant object (TG_User or similar) :groups: a set of group IDs :permissions: a set of permission IDs

validate_identity(user_name, password, visit_key)

Look up the identity represented by user_name and determine whether the password is correct.

Must return either None if the credentials weren’t valid or an object with the following properties:

user_name:original user name
user:a provider dependant object (TG_User or similar)
groups:a set of group IDs
permissions:a set of permission IDs
Parameters:
  • user_name – user_name we’re authenticating. If None, we’ll try to lookup a username from SSL variables
  • password – password to authenticate user_name with
  • visit_key – visit_key from the user’s session
validate_password(user, user_name, password)

Check the supplied user_name and password against existing credentials. Note: user_name is not used here, but is required by external password validation schemes that might override this method. If you use SqlAlchemyIdentityProvider, but want to check the passwords against an external source (i.e. PAM, LDAP, Windows domain, etc), subclass SqlAlchemyIdentityProvider, and override this method.

Parameters:
  • user – User information.
  • user_name – Given username. Not used.
  • password – Given, plaintext password.
Returns:

True if the password matches the username. Otherwise False. Can return False for problems within the Account System as well.

Module author: Toshio Kuratomi <tkuratom@redhat.com>

class fedora.tg.visit.jsonfasvisit2.JsonFasVisitManager(timeout)

This proxies visit requests to the Account System Server running remotely.

create_model()

Create the Visit table if it doesn’t already exist.

Not needed as the visit tables reside remotely in the FAS2 database.

new_visit_with_key(visit_key)
Return a new Visit object with the given key.
update_queued_visits(queue)
Update the visit information on the server
visit_for_key(visit_key)
Return the visit for this key or None if the visit doesn’t exist or has expired.

Turbogears Identity Provider 1

These methods are deprecated because they do not provide the CSRF protection of TurboGears Identity Provider 2. Please use that identity provider instead.

System Message: ERROR/3 (/builddir/build/BUILD/python-fedora-0.3.25.90/doc/auth.rst, line 46)

Error in “automodule” directive: unknown option: “deprecated”.

.. automodule:: fedora.tg.identity.jsonfasprovider1
    :members: JsonFasIdentity, JsonFasIdentityProvider
    :undoc-members:
    :deprecated:

System Message: ERROR/3 (/builddir/build/BUILD/python-fedora-0.3.25.90/doc/auth.rst, line 51)

Error in “automodule” directive: unknown option: “deprecated”.

.. automodule:: fedora.tg.visit.jsonfasvisit1
    :members: JsonFasVisitManager
    :undoc-members:
    :deprecated: