Commit 74c775b7 authored by edbo's avatar edbo
Browse files

Fix comments

parent c2e1c3600121
Pipeline #61790 passed with stages
in 16 minutes and 58 seconds
......@@ -2,6 +2,6 @@
Configuration
*************
The *Authentication Kerberos Module* introduces new authentication services
from settings in the ``[authentication_kerberos]`` section of the
The *Authentication Kerberos Module* allows new Kerberos authentication
servers to be defined in the ``[authentication_kerberos]`` section of the
:doc:`configuration file <trytond:topics/configuration>`.
......@@ -7,6 +7,4 @@
:doc:`configuration file <trytond:topics/configuration>`.
The section lists the Kerberos service to setup with the string to display to
the user.
Each service can be configuration with a section named
``[authentication_kerberos <service>]`` with the following options.
The line must contain a name for the server along with the string that is
displayed to the user.
......@@ -12,5 +10,10 @@
Example::
Each Kerberos server is then configured separately in a section
named ``[authentication_kerberos <name>]`` using the options listed below.
Example:
.. code-block:: ini
[authentication_kerberos]
domain = SSO login
......@@ -20,6 +23,7 @@
service = HTTP
.. note::
Depending on the service provider, you may need to add its origins to the
``cors`` value in the ``[web]`` section of the :doc:`configuration file
<trytond:topics/configuration>`.
......@@ -31,5 +35,5 @@
The absolute path to the Kerberos keytab file.
Default: /etc/krb5.keytab
The default value is: ``/etc/krb5.keytab``
......@@ -35,8 +39,8 @@
.. _config-authentication_kerberos.realm:
.. _config-authentication_kerberos.service:
``service``
===========
The name of the service in the keytab file.
......@@ -37,7 +41,7 @@
``service``
===========
The name of the service in the keytab file.
Default: ``HTTP``
The default value is: ``HTTP``
......@@ -2,7 +2,7 @@
Design
******
The *Authentication Kerberos Module* introduce a new route:
The *Authentication Kerberos Module* introduces a new route:
- ``GET`` ``/<database>/authentication/kerberos/<identity>/login``:
verify the authentication request and redirect to the the ``next``
......
......@@ -2,8 +2,11 @@
Authentication Kerberos Module
##############################
The `Kerberos <https://en.wikipedia.org/wiki/Kerberos_(protocol)>`_
authentication module allows to authenticate an user with it's Kerberos ticket.
The *Kerberos Authentication Module* allows a user to be authenticated from
a Kerberos_ ticket.
.. _Kerberos: https://en.wikipedia.org/wiki/Kerberos%5F%28protocol%29
.. toctree::
:maxdepth: 2
......
......@@ -16,7 +16,7 @@
from trytond.wsgi import app
logger = logging.getLogger(__name__)
IDENTITIES = set()
AUTH_SERVERS = set()
CONFIG_KERBEROS = {}
if config.has_section('authentication_kerberos'):
......@@ -20,7 +20,7 @@
CONFIG_KERBEROS = {}
if config.has_section('authentication_kerberos'):
for identity in config.options('authentication_kerberos'):
IDENTITIES.add(identity)
name = config.get('authentication_kerberos', identity)
for auth_server in config.options('authentication_kerberos'):
AUTH_SERVERS.add(auth_server)
name = config.get('authentication_kerberos', auth_server)
register_authentication_service(
......@@ -26,3 +26,3 @@
register_authentication_service(
name, f'/authentication/kerberos/{identity}/login')
name, f'/authentication/kerberos/{auth_server}/login')
......@@ -28,3 +28,3 @@
CONFIG_KERBEROS[identity] = {
CONFIG_KERBEROS[auth_server] = {
'keytab': config.get(
......@@ -30,4 +30,4 @@
'keytab': config.get(
f'authentication_kerberos {identity}', 'keytab',
f'authentication_kerberos {auth_server}', 'keytab',
default='/etc/krb5.keytab'),
'service': config.get(
......@@ -32,6 +32,6 @@
default='/etc/krb5.keytab'),
'service': config.get(
f'authentication_kerberos {identity}', 'service',
f'authentication_kerberos {auth_server}', 'service',
default='HTTP'),
'host': host()
}
......@@ -48,10 +48,12 @@
redirect_url = http_host()
parts = urllib.parse.urlsplit(redirect_url)
query = urllib.parse.parse_qsl(parts.query)
query.append(('database', database))
query.append(('login', login))
query.append(('user_id', user_id))
query.append(('session', session))
query.extend([
('database', database),
('login', login),
('user_id', user_id),
('session', session)
])
parts = list(parts)
parts[3] = urllib.parse.urlencode(query)
......@@ -73,5 +75,5 @@
return redirect(urllib.parse.urlunsplit(parts))
def check_identity(func):
def check_auth_server(func):
@wraps(func)
......@@ -77,4 +79,4 @@
@wraps(func)
def wrapper(request, database, identity, *args, **kwargs):
if identity not in IDENTITIES:
def wrapper(request, database, auth_server, *args, **kwargs):
if auth_server not in AUTH_SERVERS:
return _forbidden(request, database)
......@@ -80,6 +82,6 @@
return _forbidden(request, database)
return func(request, database, identity, *args, **kwargs)
return func(request, database, auth_server, *args, **kwargs)
return wrapper
@app.route(
......@@ -82,9 +84,9 @@
return wrapper
@app.route(
'/<database_name>/authentication/kerberos/<identity>/login',
'/<database_name>/authentication/kerberos/<auth_server>/login',
methods={'GET'})
@allow_null_origin
@with_pool
@with_transaction()
......@@ -87,9 +89,9 @@
methods={'GET'})
@allow_null_origin
@with_pool
@with_transaction()
@check_identity
def login(request, pool, identity):
@check_auth_server
def login(request, pool, auth_server):
Session = pool.get('ir.session')
User = pool.get('res.user')
database = pool.database_name
......@@ -97,9 +99,9 @@
in_token = base64.b64decode(request.headers['Authorization'][10:])
try:
service = CONFIG_KERBEROS[identity]['service']
keytab = CONFIG_KERBEROS[identity]['keytab']
host = CONFIG_KERBEROS[identity]['host']
service = CONFIG_KERBEROS[auth_server]['service']
keytab = CONFIG_KERBEROS[auth_server]['keytab']
host = CONFIG_KERBEROS[auth_server]['host']
service_name = f'{service}@{host}'
name = gssapi.Name(service_name, gssapi.NameType.hostbased_service)
creds = gssapi.Credentials(name=name, usage='accept', store={
......@@ -107,6 +109,6 @@
})
except KeyError:
raise RuntimeError('flask-gssapi not configured right')
raise RuntimeError('flask-gssapi not configured correctly')
ctx = gssapi.SecurityContext(creds=creds, usage='accept')
......@@ -111,6 +113,6 @@
ctx = gssapi.SecurityContext(creds=creds, usage='accept')
out_token = ctx.step(in_token) # noqa: F841
ctx.step(in_token)
if ctx.complete:
username = ctx.initiator_name
......
......@@ -54,7 +54,8 @@
setup(name=name,
version=version,
description='Tryton module to authenticate users using Kerberos ticket',
description="Tryton module that allows a user to be authenticated from "
"a Kerberos ticket",
long_description=read('README.rst'),
author='Tryton',
author_email='foundation@tryton.org',
......
......@@ -2,4 +2,4 @@
version=6.7.0
depends:
ir
xml:
res
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment