1:47 p.m.
1 new commit in galaxy-central:
https://bitbucket.org/galaxy/galaxy-central/changeset/21ec1290ad02/
changeset: 21ec1290ad02
user: inithello
date: 2012-06-27 15:47:32
summary: Added remote authentication to the toolshed.
affected #: 3 files
diff -r 9576fb8cd71e8ad16e9a6426c0c42dc6aba63716 -r
21ec1290ad02beb9c33516dcc4d5d4a732559414 lib/galaxy/web/framework/__init__.py
--- a/lib/galaxy/web/framework/__init__.py
+++ b/lib/galaxy/web/framework/__init__.py
@@ -498,8 +498,10 @@
# remote user authenticates, we'll look for this information, and if
missing, create it.
if not self.app.security_agent.get_private_user_role( user ):
self.app.security_agent.create_private_user_role( user )
- if not user.default_permissions:
- self.app.security_agent.user_set_default_permissions( user, history=True,
dataset=True )
+ if 'webapp' not in self.environ or self.environ['webapp'] !=
'community':
+ if not user.default_permissions:
+ self.app.security_agent.user_set_default_permissions( user )
+ self.app.security_agent.user_set_default_permissions( user,
history=True, dataset=True )
elif user is None:
username = remote_user_email.split( '@', 1 )[0].lower()
random.seed()
@@ -520,7 +522,8 @@
self.sa_session.flush()
self.app.security_agent.create_private_user_role( user )
# We set default user permissions, before we log in and set the default
history permissions
- self.app.security_agent.user_set_default_permissions( user )
+ if 'webapp' not in self.environ or self.environ['webapp'] !=
'community':
+ self.app.security_agent.user_set_default_permissions( user )
#self.log_event( "Automatically created account '%s'",
user.email )
return user
def __update_session_cookie( self, name='galaxysession' ):
diff -r 9576fb8cd71e8ad16e9a6426c0c42dc6aba63716 -r
21ec1290ad02beb9c33516dcc4d5d4a732559414 lib/galaxy/webapps/community/buildapp.py
--- a/lib/galaxy/webapps/community/buildapp.py
+++ b/lib/galaxy/webapps/community/buildapp.py
@@ -17,6 +17,7 @@
import galaxy.webapps.community.model.mapping
import galaxy.web.framework
from galaxy.webapps.community.framework.middleware import hg
+from galaxy import util
log = logging.getLogger( __name__ )
@@ -102,6 +103,15 @@
# other middleware):
app = httpexceptions.make_middleware( app, conf )
log.debug( "Enabling 'httpexceptions' middleware" )
+ # If we're using remote_user authentication, add middleware that
+ # protects Galaxy from improperly configured authentication in the
+ # upstream server
+ if asbool(conf.get( 'use_remote_user', False )):
+ from galaxy.webapps.community.framework.middleware.remoteuser import RemoteUser
+ app = RemoteUser( app, maildomain = conf.get( 'remote_user_maildomain',
None ),
+ display_servers = util.listify( conf.get(
'display_servers', '' ) ),
+ admin_users = conf.get( 'admin_users', ''
).split( ',' ) )
+ log.debug( "Enabling 'remote user' middleware" )
# The recursive middleware allows for including requests in other
# requests or forwarding of requests, all on the server side.
if asbool(conf.get('use_recursive', True)):
diff -r 9576fb8cd71e8ad16e9a6426c0c42dc6aba63716 -r
21ec1290ad02beb9c33516dcc4d5d4a732559414
lib/galaxy/webapps/community/framework/middleware/remoteuser.py
--- /dev/null
+++ b/lib/galaxy/webapps/community/framework/middleware/remoteuser.py
@@ -0,0 +1,93 @@
+"""
+Middleware for handling $REMOTE_USER if use_remote_user is enabled.
+"""
+
+import socket
+
+errorpage = """
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
+<html lang="en">
+ <head>
+ <title>Galaxy</title>
+ <style type="text/css">
+ body {
+ min-width: 500px;
+ text-align: center;
+ }
+ .errormessage {
+ font: 75%% verdana, "Bitstream Vera Sans", geneva, arial,
helvetica, helve, sans-serif;
+ padding: 10px;
+ margin: 100px auto;
+ min-height: 32px;
+ max-width: 500px;
+ border: 1px solid #AA6666;
+ background-color: #FFCCCC;
+ text-align: left;
+ }
+ </style>
+ </head>
+ <body>
+ <div class="errormessage">
+ <h4>%s</h4>
+ <p>%s</p>
+ </div>
+ </body>
+</html>
+"""
+
+class RemoteUser( object ):
+ def __init__( self, app, maildomain=None, display_servers=None, admin_users=None ):
+ self.app = app
+ self.maildomain = maildomain
+ self.display_servers = display_servers or []
+ self.admin_users = admin_users or []
+ def __call__( self, environ, start_response ):
+ environ[ 'webapp' ] = 'community'
+ # Allow display servers
+ if self.display_servers and environ.has_key( 'REMOTE_ADDR' ):
+ try:
+ host = socket.gethostbyaddr( environ[ 'REMOTE_ADDR' ] )[0]
+ except( socket.error, socket.herror, socket.gaierror, socket.timeout ):
+ # in the event of a lookup failure, deny access
+ host = None
+ if host in self.display_servers:
+ environ[ 'HTTP_REMOTE_USER' ] =
'remote_display_server@%s' % ( self.maildomain or 'example.org' )
+ return self.app( environ, start_response )
+ # Apache sets REMOTE_USER to the string '(null)' when using the
+ # Rewrite* method for passing REMOTE_USER and a user is
+ # un-authenticated. Any other possible values need to go here as well.
+ path_info = environ.get('PATH_INFO', '')
+ if environ.has_key( 'HTTP_REMOTE_USER' ) and environ[
'HTTP_REMOTE_USER' ] != '(null)':
+ if not environ[ 'HTTP_REMOTE_USER' ].count( '@' ):
+ if self.maildomain is not None:
+ environ[ 'HTTP_REMOTE_USER' ] += '@' +
self.maildomain
+ else:
+ title = "Access to Galaxy is denied"
+ message = """
+ Galaxy is configured to authenticate users via an external
+ method (such as HTTP authentication in Apache), but only a
+ username (not an email address) was provided by the
+ upstream (proxy) server. Since Galaxy usernames are email
+ addresses, a default mail domain must be set.</p>
+ <p>Please contact your local Galaxy administrator. The
+ variable <code>remote_user_maildomain</code> must be
set
+ before you may access Galaxy.
+ """
+ return self.error( start_response, title, message )
+ return self.app( environ, start_response )
+ elif path_info.startswith( '/api/' ):
+ # The API handles its own authentication via keys
+ return self.app( environ, start_response )
+ else:
+ title = "Access to Galaxy is denied"
+ message = """
+ Galaxy is configured to authenticate users via an external
+ method (such as HTTP authentication in Apache), but a username
+ was not provided by the upstream (proxy) server. This is
+ generally due to a misconfiguration in the upstream server.</p>
+ <p>Please contact your local Galaxy administrator.
+ """
+ return self.error( start_response, title, message )
+ def error( self, start_response, title="Access denied",
message="Please contact your local Galaxy administrator." ):
+ start_response( '403 Forbidden', [('Content-type',
'text/html')] )
+ return [errorpage % (title, message)]
Repository URL: https://bitbucket.org/galaxy/galaxy-central/
--
This is a commit notification from bitbucket.org. You are receiving
this because you have the service enabled, addressing the recipient of
this email.
3497
days inactive
3497
days old
galaxy-commits@lists.galaxyproject.org
0 comments
1 participants
participants (1)
-
Bitbucket