diff options
author | John Dennis <jdennis@redhat.com> | 2012-02-06 13:29:56 -0500 |
---|---|---|
committer | Endi S. Dewata <edewata@redhat.com> | 2012-02-09 13:20:45 -0600 |
commit | bba4ccb3a01125ebc9f074f624f106905bbb4fed (patch) | |
tree | f4e2100ac7bba2077597f49e14b45ca49c5b91cb /ipalib/util.py | |
parent | d1e0c1b606fe2a8edce5965cee9ab023a5e27676 (diff) | |
download | freeipa-bba4ccb3a01125ebc9f074f624f106905bbb4fed.tar.gz freeipa-bba4ccb3a01125ebc9f074f624f106905bbb4fed.tar.xz freeipa-bba4ccb3a01125ebc9f074f624f106905bbb4fed.zip |
add session manager and cache krb auth
This patch adds a session manager and support for caching
authentication in the session. Major elements of the patch are:
* Add a session manager to support cookie based sessions which
stores session data in a memcached entry.
* Add ipalib/krb_utils.py which contains functions to parse ccache
names, format principals, format KRB timestamps, and a KRB_CCache
class which reads ccache entry and allows one to extract information
such as the principal, credentials, credential timestamps, etc.
* Move krb constants defined in ipalib/rpc.py to ipa_krb_utils.py so
that all kerberos items are co-located.
* Modify javascript in ipa.js so that the IPA.command() RPC call
checks for authentication needed error response and if it receives
it sends a GET request to /ipa/login URL to refresh credentials.
* Add session_auth_duration config item to constants.py, used to
configure how long a session remains valid.
* Add parse_time_duration utility to ipalib/util.py. Used to parse the
session_auth_duration config item.
* Update the default.conf.5 man page to document session_auth_duration
config item (also added documentation for log_manager config items
which had been inadvertantly omitted from a previous commit).
* Add SessionError object to ipalib/errors.py
* Move Kerberos protection in Apache config from /ipa to /ipa/xml and
/ipa/login
* Add SessionCCache class to session.py to manage temporary Kerberos
ccache file in effect for the duration of an RPC command.
* Adds a krblogin plugin used to implement the /ipa/login
handler. login handler sets the session expiration time, currently
60 minutes or the expiration of the TGT, whichever is shorter. It
also copies the ccache provied by mod_auth_kerb into the session
data. The json handler will later extract and validate the ccache
belonging to the session.
* Refactored the WSGI handlers so that json and xlmrpc could have
independent behavior, this also moves where create and destroy
context occurs, now done in the individual handler rather than the
parent class.
* The json handler now looks up the session data, validates the ccache
bound to the session, if it's expired replies with authenicated
needed error.
* Add documentation to session.py. Fully documents the entire process,
got questions, read the doc.
* Add exclusions to make-lint as needed.
Diffstat (limited to 'ipalib/util.py')
-rw-r--r-- | ipalib/util.py | 100 |
1 files changed, 100 insertions, 0 deletions
diff --git a/ipalib/util.py b/ipalib/util.py index da933a86a..f3d7970db 100644 --- a/ipalib/util.py +++ b/ipalib/util.py @@ -310,3 +310,103 @@ class cachedproperty(object): def __delete__(self, obj): raise AttributeError("can't delete attribute") + +# regexp matching signed floating point number (group 1) followed by +# optional whitespace followed by time unit, e.g. day, hour (group 7) +time_duration_re = re.compile(r'([-+]?((\d+)|(\d+\.\d+)|(\.\d+)|(\d+\.)))\s*([a-z]+)', re.IGNORECASE) + +# number of seconds in a time unit +time_duration_units = { + 'year' : 365*24*60*60, + 'years' : 365*24*60*60, + 'y' : 365*24*60*60, + 'month' : 30*24*60*60, + 'months' : 30*24*60*60, + 'week' : 7*24*60*60, + 'weeks' : 7*24*60*60, + 'w' : 7*24*60*60, + 'day' : 24*60*60, + 'days' : 24*60*60, + 'd' : 24*60*60, + 'hour' : 60*60, + 'hours' : 60*60, + 'h' : 60*60, + 'minute' : 60, + 'minutes' : 60, + 'min' : 60, + 'second' : 1, + 'seconds' : 1, + 'sec' : 1, + 's' : 1, +} + +def parse_time_duration(value): + ''' + + Given a time duration string, parse it and return the total number + of seconds represented as a floating point value. Negative values + are permitted. + + The string should be composed of one or more numbers followed by a + time unit. Whitespace and punctuation is optional. The numbers may + be optionally signed. The time units are case insenstive except + for the single character 'M' or 'm' which means month and minute + respectively. + + Recognized time units are: + + * year, years, y + * month, months, M + * week, weeks, w + * day, days, d + * hour, hours, h + * minute, minutes, min, m + * second, seconds, sec, s + + Examples: + "1h" # 1 hour + "2 HOURS, 30 Minutes" # 2.5 hours + "1week -1 day" # 6 days + ".5day" # 12 hours + "2M" # 2 months + "1h:15m" # 1.25 hours + "1h, -15min" # 45 minutes + "30 seconds" # .5 minute + + Note: Despite the appearance you can perform arithmetic the + parsing is much simpler, the parser searches for signed values and + adds the signed value to a running total. Only + and - are permitted + and must appear prior to a digit. + + :parameters: + value : string + A time duration string in the specified format + :returns: + total number of seconds as float (may be negative) + ''' + + matches = 0 + duration = 0.0 + for match in time_duration_re.finditer(value): + matches += 1 + magnitude = match.group(1) + unit = match.group(7) + + # Get the unit, only M and m are case sensitive + if unit == 'M': # month + seconds_per_unit = 30*24*60*60 + elif unit == 'm': # minute + seconds_per_unit = 60 + else: + unit = unit.lower() + seconds_per_unit = time_duration_units.get(unit) + if seconds_per_unit is None: + raise ValueError('unknown time duration unit "%s"' % unit) + magnitude = float(magnitude) + seconds = magnitude * seconds_per_unit + duration += seconds + + if matches == 0: + raise ValueError('no time duration found in "%s"' % value) + + return duration |