1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111"""The :mod:`authenticators` modules provides for pluggable authentication behaviour. Authentication behaviour is provided by adding the mixin class :class:`AuthenticatorMixin` to a :class:`.Resource` or Django :class:`View` class. The set of authenticators which are use is then specified by setting the :attr:`authenticators` attribute on the class, and listing a set of authenticator classes. """ from django.contrib.auth import authenticate from django.middleware.csrf import CsrfViewMiddleware from djangorestframework.utils import as_tuple import base64 class AuthenticatorMixin(object): """Adds pluggable authentication behaviour.""" """The set of authenticators to use.""" authenticators = None def authenticate(self, request): """Attempt to authenticate the request, returning an authentication context or None. An authentication context may be any object, although in many cases it will simply be a :class:`User` instance.""" # Attempt authentication against each authenticator in turn, # and return None if no authenticators succeed in authenticating the request. for authenticator in as_tuple(self.authenticators): auth_context = authenticator(self).authenticate(request) if auth_context: return auth_context return None class BaseAuthenticator(object): """All authenticators should extend BaseAuthenticator.""" def __init__(self, mixin): """Initialise the authenticator with the mixin instance as state, in case the authenticator needs to access any metadata on the mixin object.""" self.mixin = mixin def authenticate(self, request): """Authenticate the request and return the authentication context or None. An authentication context might be something as simple as a User object, or it might be some more complicated token, for example authentication tokens which are signed against a particular set of permissions for a given user, over a given timeframe. The default permission checking on Resource will use the allowed_methods attribute for permissions if the authentication context is not None, and use anon_allowed_methods otherwise. The authentication context is passed to the method calls eg Resource.get(request, auth) in order to allow them to apply any more fine grained permission checking at the point the response is being generated. This function must be overridden to be implemented.""" return None class BasicAuthenticator(BaseAuthenticator): """Use HTTP Basic authentication""" def authenticate(self, request): from django.utils.encoding import smart_unicode, DjangoUnicodeDecodeError if 'HTTP_AUTHORIZATION' in request.META: auth = request.META['HTTP_AUTHORIZATION'].split() if len(auth) == 2 and auth[0].lower() == "basic": try: auth_parts = base64.b64decode(auth[1]).partition(':') except TypeError: return None try: uname, passwd = smart_unicode(auth_parts[0]), smart_unicode(auth_parts[2]) except DjangoUnicodeDecodeError: return None user = authenticate(username=uname, password=passwd) if user is not None and user.is_active: return user return None class UserLoggedInAuthenticator(BaseAuthenticator): """Use Djagno's built-in request session for authentication.""" def authenticate(self, request): if getattr(request, 'user', None) and request.user.is_active: # Temporarily request.POST with .RAW_CONTENT, so that we use our more generic request parsing request._post = self.mixin.RAW_CONTENT resp = CsrfViewMiddleware().process_view(request, None, (), {}) del(request._post) if resp is None: # csrf passed return request.user return None |
 |
index : angular.js | |
| aboutsummaryrefslogtreecommitdiffstats |
blob: 7c4d9d1d5ede3ebc51cca88ddf8c0b46b962adde (plain)