Skip to content

Commit 673ae7a

Browse files
jirivranyjakubman1
jirivrany
and
jakubman1
authored
Develop (#37)
* Support for authentication using external proxy (#33) * add options for HTTP header authentication to config * add template for handling error 401: Unauthorized * support external authentication Expects authentication to be done using an external tool (such as Apache), that fills the users UUID to a HTTP header and acts as a proxy. * version 0.7.3, simple auth mode available, docs for auth created * version 0.7.3, simple auth mode available, docs for auth created * typo in link * Bugfix/autoescape (#35) * rename all j2 files back to html * add Markup to dashboard to render tables from macros * bugfix - V4 table cols, DOCS update --------- Co-authored-by: Jakub Man <[email protected]>
1 parent 432110d commit 673ae7a

36 files changed

+124
-95
lines changed

‎config.example.py

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,12 @@ class Config():
88
# Flask testing
99
TESTING = False
1010
# SSO auth enabled
11-
SSO_AUTH = False
11+
12+
SSO_AUTH = True
1213
# Authentication is done outside the app, use HTTP header to get the user uuid.
1314
# If SSO_AUTH is set to True, this option is ignored and SSO auth is used.
14-
HEADER_AUTH = True
15+
HEADER_AUTH = False
16+
1517
# Name of HTTP header containing the UUID of authenticated user.
1618
# Only used when HEADER_AUTH is set to True
1719
AUTH_HEADER_NAME = 'X-Authenticated-User'

‎docs/AUTH.md

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,34 @@ Since version 0.7.3, the application supports three different forms of user auth
1010
### SSO
1111
To use SSO, you need to set up Apache + Shiboleth in the usual way. Then set `SSO_AUTH = True` in the application configuration file **config.py**
1212

13+
In general the whole app should be protected by Shiboleth. However, there certain endpoints should be excluded from Shiboleth for the interaction with BGP. See configuration example bellow. The endpoints which are not protected by Shibboleth are protected by app itself. Either by @localhost_only decorator or by API key.
14+
1315
Shibboleth configuration example:
1416

15-
#### shibboleth config:
17+
#### shibboleth config (shib.conf):
18+
1619
```
1720
<Location />
1821
AuthType shibboleth
1922
ShibRequestSetting requireSession 1
2023
require shib-session
2124
</Location>
2225
26+
27+
<LocationMatch /api/>
28+
Satisfy Any
29+
allow from All
30+
</LocationMatch>
31+
32+
<LocationMatch /rules/announce_all>
33+
Satisfy Any
34+
allow from All
35+
</LocationMatch>
36+
37+
<LocationMatch /rules/withdraw_expired>
38+
Satisfy Any
39+
allow from All
40+
</LocationMatch>
2341
```
2442

2543

‎docs/INSTALL.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -125,18 +125,18 @@ Supervisord is used to run and manage application.
125125

126126
#### Final steps - as deploy user
127127

128-
Copy config.example.py to config.py and fill out the DB credetials.
128+
1. Copy config.example.py to config.py and fill out the DB credetials.
129129

130-
Create and populate database tables.
130+
2. Create and populate database tables.
131131
```
132132
cd ~/www
133133
source venv/bin/activate
134134
python db-init.py
135135
```
136136
DB-init script inserts default roles, actions, rule states and two organizations (TUL and Cesnet). But no users.
137137

138-
So before start, use your favorite mysql admin tool and insert some users into database.
139-
The uuid of user should be set the eppn value provided by Shibboleth.
138+
3. Before start, **use your favorite mysql admin tool and insert some users into database**.
139+
The **uuid** of user should be set the **eppn** value provided by Shibboleth.
140140

141141
You can use following MYSQL commands to insert the user, give him role 'admin' and add him to the the organization 'Cesnet'.
142142

‎flowapp/__init__.py

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,13 +87,14 @@ def logout():
8787
def ext_login():
8888
header_name = app.config.get("AUTH_HEADER_NAME", 'X-Authenticated-User')
8989
if header_name not in request.headers:
90-
return render_template("errors/401.j2")
90+
return render_template("errors/401.html")
91+
9192
uuid = request.headers.get(header_name)
9293
if uuid:
9394
try:
9495
_register_user_to_session(uuid)
9596
except AttributeError:
96-
return render_template("errors/401.j2")
97+
return render_template("errors/401.html")
9798
return redirect("/")
9899

99100
@app.route("/")
@@ -136,12 +137,12 @@ def shutdown_session(exception=None):
136137
# HTTP error handling
137138
@app.errorhandler(404)
138139
def not_found(error):
139-
return render_template("errors/404.j2"), 404
140+
return render_template("errors/404.html"), 404
140141

141142
@app.errorhandler(500)
142143
def internal_error(exception):
143144
app.logger.error(exception)
144-
return render_template("errors/500.j2"), 500
145+
return render_template("errors/500.html"), 500
145146

146147
@app.context_processor
147148
def utility_processor():

‎flowapp/instance_config.py

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,23 +99,23 @@ class InstanceConfig:
9999
DASHBOARD = {
100100
"ipv4": {
101101
"name": "IPv4",
102-
"macro_file": "macros.j2",
102+
"macro_file": "macros.html",
103103
"macro_tbody": "build_ip_tbody",
104104
"macro_thead": "build_rules_thead",
105105
"table_colspan": 10,
106-
"table_columns": RULES_COLUMNS_V6,
106+
"table_columns": RULES_COLUMNS_V4,
107107
},
108108
"ipv6": {
109109
"name": "IPv6",
110-
"macro_file": "macros.j2",
110+
"macro_file": "macros.html",
111111
"macro_tbody": "build_ip_tbody",
112112
"macro_thead": "build_rules_thead",
113113
"table_colspan": 10,
114114
"table_columns": RULES_COLUMNS_V6,
115115
},
116116
"rtbh": {
117117
"name": "RTBH",
118-
"macro_file": "macros.j2",
118+
"macro_file": "macros.html",
119119
"macro_tbody": "build_rtbh_tbody",
120120
"macro_thead": "build_rules_thead",
121121
"table_colspan": 5,

‎flowapp/templates/errors/401.html

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
{% extends 'layouts/default.html' %}
2+
{% block content %}
3+
<h1>Could not log you in.</h1>
4+
<p class="form-text">401: Unauthorized</p>
5+
<p>Please log out and try logging in again.</p>
6+
<p><a href="{{url_for('logout')}}">Log out</a></p>
7+
{% endblock %}

‎flowapp/templates/errors/404.j2 renamed to ‎flowapp/templates/errors/404.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{% extends 'layouts/default.j2' %}
1+
{% extends 'layouts/default.html' %}
22
{% block content %}
33
<h1>Sorry ...</h1>
44
<p>There's nothing here!</p>

‎flowapp/templates/errors/500.j2 renamed to ‎flowapp/templates/errors/500.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{% extends 'layouts/default.j2' %}
1+
{% extends 'layouts/default.html' %}
22
{% block content %}
33
<h1>Error ...</h1>
44
<p>Sorry ;-)</p>

‎flowapp/templates/forms/api_key.j2 renamed to ‎flowapp/templates/forms/api_key.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
{% extends 'layouts/default.j2' %}
2-
{% from 'forms/macros.j2' import render_field %}
1+
{% extends 'layouts/default.html' %}
2+
{% from 'forms/macros.html' import render_field %}
33
{% block title %}Add New Machine with ApiKey{% endblock %}
44
{% block content %}
55
<h2>Add new ApiKey for your machine</h2>

‎flowapp/templates/forms/ipv4_rule.j2 renamed to ‎flowapp/templates/forms/ipv4_rule.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
{% extends 'layouts/default.j2' %}
2-
{% from 'forms/macros.j2' import render_field %}
1+
{% extends 'layouts/default.html' %}
2+
{% from 'forms/macros.html' import render_field %}
33
{% block title %}Add IPv4 rule{% endblock %}
44
{% block content %}
55
<h2>{{ title or 'New'}} IPv4 rule</h2>

0 commit comments

Comments
 (0)