diff options
| author | John Dennis <jdennis@redhat.com> | 2012-02-15 10:26:42 -0500 |
|---|---|---|
| committer | Rob Crittenden <rcritten@redhat.com> | 2012-02-27 05:54:29 -0500 |
| commit | 9753fd423059e8d5725ead9a90a7cf1b9e0b9b85 (patch) | |
| tree | c5a0a933b1357164f2dc4c0d4d22c9cac05dd1eb /install/share | |
| parent | 7d7322de2eb0de61ea917d03662452d3efa4c834 (diff) | |
| download | freeipa-9753fd423059e8d5725ead9a90a7cf1b9e0b9b85.tar.gz freeipa-9753fd423059e8d5725ead9a90a7cf1b9e0b9b85.tar.xz freeipa-9753fd423059e8d5725ead9a90a7cf1b9e0b9b85.zip | |
Tweak the session auth to reflect developer consensus.
* Increase the session ID from 48 random bits to 128.
* Implement the sesison_logout RPC command. It permits the UI to send
a command that destroys the users credentials in the current
session.
* Restores the original web URL's and their authentication
protections. Adds a new URL for sessions /ipa/session/json. Restores
the original Kerberos auth which was for /ipa and everything
below. New /ipa/session/json URL is treated as an exception and
turns all authenticaion off. Similar to how /ipa/ui is handled.
* Refactor the RPC handlers in rpcserver.py such that there is one
handler per URL, specifically one handler per RPC and AuthMechanism
combination.
* Reworked how the URL names are used to map a URL to a
handler. Previously it only permitted one level in the URL path
hierarchy. We now dispatch on more that one URL path component.
* Renames the api.Backend.session object to wsgi_dispatch. The use of
the name session was historical and is now confusing since we've
implemented sessions in a different location than the
api.Backend.session object, which is really a WSGI dispatcher, hence
the new name wsgi_dispatch.
* Bullet-proof the setting of the KRB5CCNAME environment
variable. ldap2.connect already sets it via the create_context()
call but just in case that's not called or not called early enough
(we now have other things besides ldap which need the ccache) we
explicitly set it early as soon as we know it.
* Rework how we test for credential validity and expiration. The
previous code did not work with s4u2proxy because it assumed the
existance of a TGT. Now we first try ldap credentials and if we
can't find those fallback to the TGT. This logic was moved to the
KRB5_CCache object, it's an imperfect location for it but it's the
only location that makes sense at the moment given some of the
current code limitations. The new methods are KRB5_CCache.valid()
and KRB5_CCache.endtime().
* Add two new classes to session.py AuthManager and
SessionAuthManager. Their purpose is to emit authication events to
interested listeners. At the moment the logout event is the only
event, but the framework should support other events as they arise.
* Add BuildRequires python-memcached to freeipa.spec.in
* Removed the marshaled_dispatch method, it was cruft, no longer
referenced.
https://fedorahosted.org/freeipa/ticket/2362
Diffstat (limited to 'install/share')
| -rw-r--r-- | install/share/wsgi.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/install/share/wsgi.py b/install/share/wsgi.py index b61b919da..9f7d3f487 100644 --- a/install/share/wsgi.py +++ b/install/share/wsgi.py @@ -1,6 +1,7 @@ # Authors: # Rob Crittenden <rcritten@redhat.com> # Jason Gerard DeRose <jderose@redhat.com> +# John Dennis <jdennis@redhat.com> # # Copyright (C) 2010 Red Hat # see file 'COPYING' for use and warranty information @@ -45,6 +46,6 @@ else: # This is the WSGI callable: def application(environ, start_response): if not environ['wsgi.multithread']: - return api.Backend.session(environ, start_response) + return api.Backend.wsgi_dispatch(environ, start_response) else: api.log.error("IPA does not work with the threaded MPM, use the pre-fork MPM") |