root/oss/httpauthfilter/test.py

# -*- coding: utf-8 -*-

import cherrypy
import httpauth
from httpauthfilter import HttpAuthFilter

def retrieveAuthUsers():
    return {'test':'test'}
def retrieveAuthUsersWithRealms():
    return {'test':{'profiles@localhost':
                    '2fc6fc613a119b1f67d3598e998b347d'}}

class Son:
    def index(self):
        '''Protected by the filter above'''
        return "Hello son!"
    index.exposed = True

    def hello(self, name):
        return "Hello %s" % (name, )
    hello.exposed = True

class Admin:

    _cp_filters = [ HttpAuthFilter(realm='admin@localhost',
                                   privateKey='duh!',
                                   unauthorizedPath='/admin/unauthorized',
                                   retrieveUsersFunc=retrieveAuthUsers) ]
    def __init__(self):
        self.son = Son()

    def index(self):
        '''Only available once the user is authenticated'''
        return "Hello there!"
    index.exposed = True

    def unauthorized(self, *args, **kwargs):
        '''Must be declared at the same level where you defined the filter'''
        return "You are not authorized to access that page"
    unauthorized.exposed = True

class Profiles:

    _cp_filters = [ HttpAuthFilter(realm='profiles@localhost',
                                   privateKey='duh!',
                                   unauthorizedPath='/profiles/unauthorized',
                                   retrieveUsersFunc=retrieveAuthUsersWithRealms,
                                   storeHashedCredentials=True) ]

    def __init__(self):
        pass

    def index(self):
        '''Only available once the user is authenticated'''
        return "Hello there!"
    index.exposed = True

    def unauthorized(self, *args, **kwargs):
        '''Must be declared at the same level where you defined the filter'''
        return "You are not authorized to access that page"
    unauthorized.exposed = True


class Root:
    def __init__(self):
        self.admin = Admin()
        self.profiles = Profiles()

    def index(self):
        return "hey how you doing?"
    index.exposed = True

conf = {'global': { 'log_debug_info_filter.on': False,
                    'autoreload.on': False,
                    'server.log_to_screen': False,}}
cherrypy.tree.mount(Root(), '/', conf=conf)

from cherrypy.test import helper

class HttpAuthFilter(helper.CPWebCase):

   def testBasicAuth(self):
       self.getPage('/admin/')
       self.assertStatus('401 Unauthorized')
       self.assertHeader("WWW-Authenticate", 'Basic realm="admin@localhost"')
       self.assertBody("You are not authorized to access that page")

       # make sure we keep getting that response as long as we haven't
       # given the authentification token
       self.getPage('/admin/')
       self.assertStatus('401 Unauthorized')
       self.assertHeader("WWW-Authenticate", 'Basic realm="admin@localhost"')

       # right show our ID
       self.getPage('/admin/', [('Authorization', 'Basic dGVzdDp0ZXN0')])
       self.assertStatus('200 OK')
       self.assertBody("Hello there!")

       # should work also through the tree below the admin instance
       self.getPage('/admin/son/', [('Authorization', 'Basic dGVzdDp0ZXN0')])
       self.assertStatus('200 OK')

       # should forbid us again
       self.getPage('/admin/')
       self.assertStatus('401 Unauthorized')
       self.assertHeader("WWW-Authenticate", 'Basic realm="admin@localhost"')
       self.assertBody("You are not authorized to access that page")

   def testDigestAuth(self):
       self.getPage('/admin/')
       self.assertStatus('401 Unauthorized')
       self.assertHeader("WWW-Authenticate") 
       self.assertBody("You are not authorized to access that page")

       # the filter returns two WWW-Authenticate
       # the digest auth should be the first one though
       lowkey = "www-authenticate"
       value = None
       for k, v in self.headers:
           if k.lower() == lowkey:
               if v.startswith("Digest"):
                   value = v
                   break

       if value is None:
           self._handlewebError("Digest authentification scheme was not found")

       # the digest algorithm uses a timestamp
       # so we need to parse the response ourself because we can't hardcode
       # the expected value
       if value:
           value = value[7:]
           items = value.split(', ')
           tokens = {}
           for item in items:
               key, value = item.split('=')
               tokens[key.lower()] = value

           missing_msg = "%s is missing"
           bad_value_msg = "'%s' was expecting '%s' but found '%s'"
           nonce = None
           if 'realm' not in tokens:
               self._handlewebError(missing_msg % 'realm')
           elif tokens['realm'] != '"admin@localhost"':
               self._handlewebError(bad_value_msg % ('realm', '"admin@localhost"', tokens['realm']))
           if 'nonce' not in tokens:
               self._handlewebError(missing_msg % 'nonce')
           else:
               nonce = tokens['nonce'].strip('"')
           if 'algorithm' not in tokens:
               self._handlewebError(missing_msg % 'algorithm')
           elif tokens['algorithm'] != '"MD5"':
               self._handlewebError(bad_value_msg % ('algorithm', '"MD5"', tokens['algorithm']))
           if 'qop' not in tokens:
               self._handlewebError(missing_msg % 'qop')
           elif tokens['qop'] != '"auth"':
               self._handlewebError(bad_value_msg % ('qop', '"auth"', tokens['qop']))

           # now let's see if what 
           base_auth = 'Digest username="test", realm="admin@localhost", nonce="%s", uri="/admin/", algorithm=MD5, response="%s", qop=auth, nc=%s, cnonce="1522e61005789929"'

           auth = base_auth % (nonce, '', '00000001')

           params = httpauth.parseAuthorization(auth)
           response = httpauth._computeDigestResponse(params, 'test')

           auth = base_auth % (nonce, response, '00000001')
           self.getPage('/admin/', [('Authorization', auth)])
           self.assertStatus('200 OK')

   def testBasicAuthWithHashedPasswords(self):
       self.getPage('/profiles/')
       self.assertStatus('401 Unauthorized')
       self.assertHeader("WWW-Authenticate",
                         'Basic realm="profiles@localhost"')
       self.assertBody("You are not authorized to access that page")

       # make sure we keep getting that response as long as we haven't
       # given the authentification token
       self.getPage('/profiles/')
       self.assertStatus('401 Unauthorized')
       self.assertHeader("WWW-Authenticate",
                         'Basic realm="profiles@localhost"')

       # right show our ID
       self.getPage('/profiles/', [('Authorization', 'Basic dGVzdDp0ZXN0')])
       self.assertStatus('200 OK')
       self.assertBody("Hello there!")

       # should forbid us again
       self.getPage('/profiles/')
       self.assertStatus('401 Unauthorized')
       self.assertHeader("WWW-Authenticate", 'Basic realm="profiles@localhost"')
       self.assertBody("You are not authorized to access that page")

   def testDigestAuthWithHashedPasswords(self):
       self.getPage('/profiles/')
       self.assertStatus('401 Unauthorized')
       self.assertHeader("WWW-Authenticate") 
       self.assertBody("You are not authorized to access that page")

       # the filter returns two WWW-Authenticate
       # the digest auth should be the first one though
       lowkey = "www-authenticate"
       value = None
       for k, v in self.headers:
           if k.lower() == lowkey:
               if v.startswith("Digest"):
                   value = v
                   break

       if value is None:
           self._handlewebError("Digest authentification scheme was not found")

       # the digest algorithm uses a timestamp
       # so we need to parse the response ourself because we can't hardcode
       # the expected value
       if value:
           value = value[7:]
           items = value.split(', ')
           tokens = {}
           for item in items:
               key, value = item.split('=')
               tokens[key.lower()] = value

           missing_msg = "%s is missing"
           bad_value_msg = "'%s' was expecting '%s' but found '%s'"
           nonce = None
           if 'realm' not in tokens:
               self._handlewebError(missing_msg % 'realm')
           elif tokens['realm'] != '"profiles@localhost"':
               self._handlewebError(bad_value_msg % ('realm', '"profiles@localhost"', tokens['realm']))
           if 'nonce' not in tokens:
               self._handlewebError(missing_msg % 'nonce')
           else:
               nonce = tokens['nonce'].strip('"')
           if 'algorithm' not in tokens:
               self._handlewebError(missing_msg % 'algorithm')
           elif tokens['algorithm'] != '"MD5"':
               self._handlewebError(bad_value_msg % ('algorithm', '"MD5"', tokens['algorithm']))
           if 'qop' not in tokens:
               self._handlewebError(missing_msg % 'qop')
           elif tokens['qop'] != '"auth"':
               self._handlewebError(bad_value_msg % ('qop', '"auth"', tokens['qop']))

           # now let's see if what 
           base_auth = 'Digest username="test", realm="profiles@localhost", nonce="%s", uri="/profiles/", algorithm=MD5, response="%s", qop=auth, nc=%s, cnonce="1522e61005789929"'

           auth = base_auth % (nonce, '', '00000001')

           params = httpauth.parseAuthorization(auth)
           response = httpauth._computeDigestResponse(params, 'test')

           auth = base_auth % (nonce, response, '00000001')
           self.getPage('/profiles/', [('Authorization', auth)])
           self.assertStatus('200 OK')

if __name__ == '__main__':
    helper.testmain()