add session manager and cache krb auth

This patch adds a session manager and support for caching
authentication in the session. Major elements of the patch are:

* Add a session manager to support cookie based sessions which
  stores session data in a memcached entry.

* Add ipalib/krb_utils.py which contains functions to parse ccache
  names, format principals, format KRB timestamps, and a KRB_CCache
  class which reads ccache entry and allows one to extract information
  such as the principal, credentials, credential timestamps, etc.

* Move krb constants defined in ipalib/rpc.py to ipa_krb_utils.py so
  that all kerberos items are co-located.

* Modify javascript in ipa.js so that the IPA.command() RPC call
  checks for authentication needed error response and if it receives
  it sends a GET request to /ipa/login URL to refresh credentials.

* Add session_auth_duration config item to constants.py, used to
  configure how long a session remains valid.

* Add parse_time_duration utility to ipalib/util.py. Used to parse the
  session_auth_duration config item.

* Update the default.conf.5 man page to document session_auth_duration
  config item (also added documentation for log_manager config items
  which had been inadvertantly omitted from a previous commit).

* Add SessionError object to ipalib/errors.py

* Move Kerberos protection in Apache config from /ipa to /ipa/xml and
  /ipa/login

* Add SessionCCache class to session.py to manage temporary Kerberos
  ccache file in effect for the duration of an RPC command.

* Adds a krblogin plugin used to implement the /ipa/login
  handler. login handler sets the session expiration time, currently
  60 minutes or the expiration of the TGT, whichever is shorter. It
  also copies the ccache provied by mod_auth_kerb into the session
  data.  The json handler will later extract and validate the ccache
  belonging to the session.

* Refactored the WSGI handlers so that json and xlmrpc could have
  independent behavior, this also moves where create and destroy
  context occurs, now done in the individual handler rather than the
  parent class.

* The json handler now looks up the session data, validates the ccache
  bound to the session, if it's expired replies with authenicated
  needed error.

* Add documentation to session.py. Fully documents the entire process,
  got questions, read the doc.

* Add exclusions to make-lint as needed.

2 files changed, 82 insertions, 8 deletions

diff --git a/install/conf/ipa.conf b/install/conf/ipa.conf
index f256dab4d..676086a90 100644
--- a/install/conf/ipa.conf
+++ b/install/conf/ipa.conf
@@ -44,8 +44,23 @@ WSGIScriptReloading Off
 
 KrbConstrainedDelegationLock ipa
 
-# Protect /ipa with Kerberos
-<Location "/ipa">
+# Protect UI login url with Kerberos
+<Location "/ipa/login">
+  AuthType Kerberos
+  AuthName "Kerberos Login"
+  KrbMethodNegotiate on
+  KrbMethodK5Passwd off
+  KrbServiceName HTTP
+  KrbAuthRealms $REALM
+  Krb5KeyTab /etc/httpd/conf/ipa.keytab
+  KrbSaveCredentials on
+  KrbConstrainedDelegation on
+  Require valid-user
+  ErrorDocument 401 /ipa/errors/unauthorized.html
+</Location>
+
+# Protect xmlrpc url with Kerberos
+<Location "/ipa/xml">
   AuthType Kerberos
   AuthName "Kerberos Login"
   KrbMethodNegotiate on
diff --git a/install/ui/ipa.js b/install/ui/ipa.js
index f905b4178..a424fe95a 100644
--- a/install/ui/ipa.js
+++ b/install/ui/ipa.js
@@ -59,6 +59,7 @@ var IPA = function() {
         // if current path matches live server path, use live data
         if (that.url && window.location.pathname.substring(0, that.url.length) === that.url) {
             that.json_url = params.url || '/ipa/json';
+            that.login_url = params.url || '/ipa/login'; // FIXME, what about the other case below?
 
         } else { // otherwise use fixtures
             that.json_path = params.url || "test/data";
@@ -285,6 +286,31 @@ var IPA = function() {
     return that;
 }();
 
+IPA.get_credentials = function() {
+    var status;
+
+    function error_handler(xhr, text_status, error_thrown) {
+        status = xhr.status;
+    }
+
+
+    function success_handler(data, text_status, xhr) {
+        status = xhr.status;
+    }
+
+    var request = {
+        url: IPA.login_url,
+	async: false,
+	type: "GET",
+        success: success_handler,
+        error: error_handler
+    };
+
+    $.ajax(request);
+
+    return status;
+}
+
 /**
  * Call an IPA command over JSON-RPC.
  *
@@ -378,6 +404,39 @@ IPA.command = function(spec) {
             dialog.open();
         }
 
+        /*
+         * Special error handler used the first time this command is
+         * submitted. It checks to see if the session credentials need
+         * to be acquired and if so sends a request to a special url
+         * to establish the sesion credentials. If acquiring the
+         * session credentials is successful it simply resubmits the
+         * exact same command after setting the error handler back to
+         * the normal error handler. If aquiring the session
+         * credentials fails the normal error handler is invoked to
+         * process the error returned from the attempt to aquire the
+         * session credentials.
+         */
+        function error_handler_login(xhr, text_status, error_thrown) {
+            if (xhr.status === 401) {
+                var login_status = IPA.get_credentials();
+
+                if (login_status === 200) {
+                    that.request.error = error_handler
+                    $.ajax(that.request);
+                } else {
+                    // error_handler() calls IPA.hide_activity_icon()
+                    error_handler.call(this, xhr, text_status, error_thrown);
+                }
+            }
+        }
+
+        /*
+         * Normal error handler, handles all errors.
+         * error_handler_login() is initially used to trap the
+         * special case need to aquire session credentials, this is
+         * not a true error, rather it's an indication an extra step
+         * needs to be taken before normal processing can continue.
+         */
         function error_handler(xhr, text_status, error_thrown) {
 
             IPA.hide_activity_icon();
@@ -472,20 +531,20 @@ IPA.command = function(spec) {
             }
         }
 
-        var data = {
+        that.data = {
             method: that.get_command(),
             params: [that.args, that.options]
         };
 
-        var request = {
-            url: IPA.json_url || IPA.json_path + '/' + (that.name || data.method) + '.json',
-            data: JSON.stringify(data),
+        that.request = {
+            url: IPA.json_url || IPA.json_path + '/' + (that.name || that.data.method) + '.json',
+            data: JSON.stringify(that.data),
             success: success_handler,
-            error: error_handler
+            error: error_handler_login
         };
 
         IPA.display_activity_icon();
-        $.ajax(request);
+        $.ajax(that.request);
     };
 
     that.get_failed = function(command, result, text_status, xhr) {