"j#kdZddlZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z m Z ddlmZddlmZmZddlmZdd lmZdd lmZmZmZd Zej8eZd ZGd deZ y)a: WSGI middleware for HTTP basic and digest authentication. Usage:: from http_authenticator import HTTPAuthenticator WSGIApp = HTTPAuthenticator(ProtectedWSGIApp, domain_controller, accept_basic, accept_digest, default_to_digest) where: ProtectedWSGIApp is the application requiring authenticated access domain_controller is a domain controller object meeting specific requirements (below) accept_basic is a boolean indicating whether to accept requests using the basic authentication scheme (default = True) accept_digest is a boolean indicating whether to accept requests using the digest authentication scheme (default = True) default_to_digest is a boolean. if True, an unauthenticated request will be sent a digest authentication required response, else the unauthenticated request will be sent a basic authentication required response (default = True) The HTTPAuthenticator will put the following authenticated information in the environ dictionary:: environ["wsgidav.auth.realm"] = realm name environ["wsgidav.auth.user_name"] = user_name environ["wsgidav.auth.roles"] = (optional) environ["wsgidav.auth.permissions"] = (optional) **Domain Controllers** The HTTP basic and digest authentication schemes are based on the following concept: Each requested relative URI can be resolved to a realm for authentication, for example: /fac_eng/courses/ee5903/timetable.pdf -> might resolve to realm 'Engineering General' /fac_eng/examsolns/ee5903/thisyearssolns.pdf -> might resolve to realm 'Engineering Lecturers' /med_sci/courses/m500/surgery.htm -> might resolve to realm 'Medical Sciences General' and each realm would have a set of user_name and password pairs that would allow access to the resource. A domain controller provides this information to the HTTPAuthenticator. This allows developers to write their own domain controllers, that might, for example, interface with their own user database. for simple applications, a SimpleDomainController is provided that will take in a single realm name (for display) and a single dictionary of user_name (key) and password (value) string pairs Usage:: from wsgidav.dc.simple_dc import SimpleDomainController users = dict(({'John Smith': 'YouNeverGuessMe', 'Dan Brown': 'DontGuessMeEither'}) realm = 'Sample Realm' domain_controller = SimpleDomainController(users, realm) Domain Controllers must provide the methods as described in ``wsgidav.interfaces.domaincontrollerinterface`` (interface_) .. _interface : interfaces/domaincontrollerinterface.py The environ variable here is the WSGI 'environ' dictionary. It is passed to all methods of the domain controller as a means for developers to pass information from previous middleware or server config (if required). N)md5)dedent)unquoteurlsplit)util)HTTP_NOT_FOUNDDAVError)SimpleDomainController)BaseMiddleware) calc_base64calc_hexdigestdynamic_import_classreStructuredTextctj|dd}|jd}|}|dus|st}n tj|r t |}t j|r |||}|Std|d)Nhttp_authenticatorTas_dictdomain_controllerz/Could not resolve domain controller class (got )) rget_dict_valuegetr is_basestringrinspectisclass RuntimeError) wsgidav_appconfig auth_confdcorg_dcs I/srv/dav/.venv/lib/python3.12/site-packages/wsgidav/http_authenticator.pymake_domain_controllerr"es##F,@$OI * +B F Tz #  B  !" %r  V $ ILVHTUVWWcxeZdZdZedZfdZdZdZdZ dZ dZ d Z d Z ed Zd Zd ZxZS)HTTPAuthenticatorz4WSGI Middleware for basic and digest authentication.z 401 Access not authorized

401 Access not authorized

ct|||||jdd|_||_t ||}||_tj|dd}|jdd|_ |jdd|_ |jd d|_ tj|d d}|jd d|_ |jd d|_ |jd d|_|jdd|_|j!sF|js|js |js"t#|j$j&dt)g|_t-j.d|_t-j.d|_t-j.d|_y)NverbosehotfixesTrwinxp_accept_root_share_loginFwin_accept_anonymous_optionsdigest_skip_uri_checkr accept_basic accept_digestdefault_to_digesttrusted_auth_headerzl does not support digest authentication. Set accept_basic=True, accept_digest=False, default_to_digest=Falsez\b([\w]+)=([^,]*),z\b([\w]+)=("[^"]*,[^"]*"),z^([\w]+))super__init__r_verboserr"rrrr*r+r,r-r.r/r0supports_http_digest_authr __class____name__dict _nonce_dictrecompile_header_parser_header_fix_parser_header_method)selfrnext_apprrr)rr5s r!r2zHTTPAuthenticator.__init__s h7 9a0  #K 8!#&&vz4H .6\\ +U. *-5LL *E- )&.\\2I5%Q"''0DdS %MM.$?&]]?DA!*/BD!I#,==1F#M ++-   $"8"8@Q@Q<<(()*VV   8!jj)>?#%**-J"K jj5r#c|jSN)r)r>s r!get_domain_controllerz'HTTPAuthenticator.get_domain_controllers%%%r#c<|jj|d SrA)rrequire_authentication)r>shares r!allow_anonymous_accessz(HTTPAuthenticator.allow_anonymous_accesss))@@MMMr#cx|jj|d|}||d<d|d<d|d<d|d<d}d|jd dvrd }tj d d}|j r|d d k(rtj dd }|s|jj ||s|j||S|jr|j|jrqtjd|jd|j|jd||j|j|d<|j||Sd|vr1|s.|d}|jj|}d}|r|jdj}|dk(r|jr|j||S|dk(r|j r|j#||S|dk(r|j r|j%||S|j&r|jr|j)||S|j r|j#||Stj d||dddt+j,fgdgS|j&r|j)||S|j#||S)N PATH_INFOwsgidav.auth.realmwsgidav.auth.user_namezwsgidav.auth.roleszwsgidav.auth.permissionsFlogout QUERY_STRINGTz Force logoutREQUEST_METHODOPTIONSz,No authorization required for OPTIONS methodzAccept trusted user_name =z for realm HTTP_AUTHORIZATIONNonedigestbasicz>HTTPAuthenticator: respond with 400 Bad request; Auth-Method: z400 Bad Request)Content-Length0Date)rget_domain_realmr_loggerwarningr+rDr?r0debugr=searchgrouplowerr.handle_digest_auth_requestr-send_basic_auth_responsehandle_basic_auth_requestr/send_digest_auth_responserget_rfc1123_time) r>environstart_responserealm force_logout force_allow auth_header auth_match auth_methods r!__call__zHTTPAuthenticator.__call__s&&77 8LgV(-$%,.())-$%.2*+ w{{>26 6L OON +  , ,9I1Ji1W OOJ KK d44KK 7 ==.9 9  # # D4L4L(M MM+D,D,D+EQw{{SWSkSkGlFooyzzCD 18 D->44WnMM'D,=,=55g~NN''D,>,>55g~NN""44WnMM OOPQ\P]^  !(643H3H3J*KL 4K  ! !11'>J J,,WnEEr#c 0|jj|d|}tjd|dd|d}t j |j }|dd|fdd tt|fd t jfg|gS) NrH401 Not Authorized for realm z (basic)z Basic realm=""401 Not AuthorizedWWW-Authenticatez Content-Typeztext/html; charset=utf-8rVrX) rrYrZr\rto_byteserror_message_401strlenrd)r>rerfrgwwwauthheadersbodys r!raz*HTTPAuthenticator.send_basic_auth_responses&&77 8LgV 5eYhGH(q1}}T334 #^4<!3s4y>2..01   v r#c|jj|d|}|d}d} |tddj}t j tj|}tj|}|jdd\}}|jj||||r||d<||d<|j||Stjd |d |d |j||S#t$rd}YwxYw) NrHrQrJzBasic :rSrIrKz'Authentication (basic) failed for user , realm .)rrYrwstrip Exceptionbase64 decodebytesrrtto_strsplitbasic_auth_userr?rZr[ra)r>rerfrgrj auth_value user_namepasswords r!rbz+HTTPAuthenticator.handle_basic_auth_request)s&&77 8LgV23   $S]_5;;=J'' j(AB [[, (..sA6 8  ! ! 1 1%Hg V,1G( )09G, -==.9 95i](5)ST U ,,WnEE J sC>> D  D c |jj|d|}tjd}t |d}t t j }|t |dz|zdz|zz}t|}d|d|d} tjd|d| tj|j} |d d | fd d t t| fd tjfg| gS)NrHr{zDigest realm="z ", nonce="z", algorithm=MD5, qop="auth"roz (digest): rqrrrsrVrX)rrYsecrets token_hexr rvtimer rZr\rrtrurwrd) r>rerfrg serverkeyetagkeytimekey nonce_sourcenoncerxrys r!rcz+HTTPAuthenticator.send_digest_auth_response@s&&77 8LgV%%b)  !56diik" cMG #c )I 5"  L)UG:eW4P Q   +E9K?O P }}T334 #^4<!3s4y>2..01   v r#c  |jj|d|}|sttd|dd}g}i}|ddz}|j j j dsd}|jd ||jj|}|jj|} | r tjd |d | || z }|D].} | d } | d j j d} | || <0d} d|vrR|d} | sd}|jd| nGd| vrC| }| jdd} tjd|d| nd}|jdd|vrd|dj|jk7r@|jr|ddk(rtjdnd}|jd|d|vr)|djdk7rd}|jd|j!d}|j#||sd}|jd|dd |vr|d }nd}|jd!d}d"|vr.d}|d"}|j d#k7rd}|jd$nd}d%|vr|d%}nd}|rd}|jd&d'|vr|d'}nd}|rd}|jd(d)|vr|d)}nd}|jd*|s|d+}|j%|| |||||| }|sd}|jd,|d-| d.nt'j(|sd/|d-| d0}|jrg|dk7rb|j%d| ||||||| }|r0t'j(||rtj+d1|d2n,d}|j|d3znd}|j|n |r|jd4||j,d5k\r6tj+d6j/| |d7j1|ntj+d8| d9|d2|j3||S||d:<| |d;<|j5||S) zMissing 'username' in headersrg/r*zRealm mismatch: algorithmMD5z"Unsupported 'algorithm' in headersuriz Digest 'uri' z" does not match the request targetrzExpected 'nonce' in headersqopauthzExpected 'qop' == 'auth'cnoncez-Expected 'cnonce' in headers if qop is passedncz)Expected 'nc' in headers if qop is passedresponsezExpected 'response' in headersrNz Rejected by DC.digest_auth_user(z, rz_compute_digest_response(z, ...): digest mismatchzAuthentication (digest) failed for user {!r}, realm {!r}: {}z z(Authentication (digest) failed for user r|rIrK)rrYr rr_r~ startswithappendr;findallr<rZinforeplaceupperr*r_is_digest_uri_valid_compute_digest_responsehmaccompare_digestr[r3formatjoinrcr?)r>rerfrgis_invalid_reqinvalid_req_reasonsauth_header_dict auth_headersauth_header_listauth_header_fixlistrjauth_header_keyauth_header_value req_usernamereq_username_orgreq_uri req_nonce req_has_qopreq_qop req_cnoncereq_nc req_response req_methodrequired_digest warning_msg root_digests r!r`z,HTTPAuthenticator.handle_digest_auth_request_s&&77 8LgV;GK|>NhW\V__`a11'>J J(-$%,8()}}Wn55r#cL tj|S#t$rYywxYw)z?Return a comparable form of `path`, or None if it is not valid.N)rnormalize_pathr )paths r!_canonical_pathz!HTTPAuthenticator._canonical_path5s* &&t, ,  s  ##c|jry|syt|}|jddk(rH|jdxs|jddk(s|jdd vr|jd vS|j|jd d k7ry|j t |j}|y|jd d |jdd z}||j |k(S)aReturn True if the Authorization header's `uri` matches the request. RFC 7616, section 3.4.6: The authenticating server MUST verify that the resource designated by the "uri" parameter is the same as the resource specified in the Request-Line. The digest is computed over the `uri` taken from the header, while the request is served for ``PATH_INFO``. Without this check, an ``Authorization: Digest ...`` header that was captured for one resource authenticates requests for *any other* resource in the same realm, using the captured method (CWE-294). TFrNrO REQUEST_URIRAW_URI*rH)r/*)rrrrMrJ SCRIPT_NAME)r,rrrqueryrr)r>rrepartsreq_path target_paths r!rz&HTTPAuthenticator._is_digest_uri_valid>s  % %! ;;' (I 5 [[ ' A7;;y+Ac I{{;';6::!11 1 ;;'++nb9 9'' (;<  kk-4w{{;PR7SS 4// <<.md5hst}}T*+557 7r#c |dz|zS)Nr{)secretrrs r!md5kdz9HTTPAuthenticator._compute_digest_response..md5kds t+, ,r#Fr{)rdigest_auth_user)r>rgrmethodrrrrrrerA1A2resrs @r!rz*HTTPAuthenticator._compute_digest_responseis, 8 - # # 4 4UIw O c\C  ECK"$s*V3c9C?#ERPC  ECK$r(23C r#)r6 __module__ __qualname____doc__rrur2rBrFrmrarbrcr` staticmethodrrr __classcell__)r5s@r!r%r%|se>  96v&NKFZ"F.>T6l)=V)r#r%)!rrrrr9rrhashlibrtextwrapr urllib.parserrwsgidavrwsgidav.dav_errorrr wsgidav.dc.simple_dcr wsgidav.mw.base_mwr wsgidav.utilr r r __docformat__get_module_loggerr6rZr"r%rr#r!rse IV   *67-JJ" $  *.VVr#