Fix some bad assumptions for web API auth backends.

 






 

 


  Review Request #6077
  —
  Created July 7, 2014 and submitted 

 


















 

  

   Information

  





 
 

  chipx86
 









 
 

  Djblets
 









 
 

  release-0.8.x
 









 
 

  
 









 
 

  
 









 
 

  faaa074...
 






 




 

  

   Reviewers

  





 
 

  djblets
 









 
 

  
 






 








 





  


 
 

  
The web API auth backend support made a couple bad assumptions that

made it hard to write additional backends.


If the Basic Auth backend was first, and it encountered something that

wasn't a Basic Auth authorization header, it would log failures, even

though it wasn't the target backend. We now perform the realm check

first before trying to parse it.


The base WebAPIAuthBackend class itself was assuming in some places that

backends would want a username and a password. Working around that

assumption meant overriding login_with_credentials(). Now, that function

no longer cares about the specific contents of credentials, and farms

out to the Django auth backends and to a new validate_credentials() for

any specifics, making it easier to override.


Along with this, we now log all credential information passed to the

API, being careful to mask any sensitive information.

 








  


 
 

  
Tested this with a new auth backend that didn't deal in usernames and

passwords, and also didn't replace the Basic Auth backend. No longer saw

extra log messages, and didn't have to replace login_with_credentials().

 







 









 





  








 






 
 
 

  

   

    

     
    

    
    
     
  • 
      
     
    • 
     
  • 
      
     
    • 
     
  • 
      
     
    • 
     
  • 
      
     
    • 
     
  • 
      
     
    • 
    

   

   

    
     

      Description
      From
      Last Updated
     

    
    



     

      
       
       
Care to add _RE to the end of this name?

      		
      
       daviddavid
      
      
       
      
     




     

      
       
       
Can we just pass this inline in the logging call? logging.debug( 'Attempting authentication on API: %s', ', '.join([ '%s=%s' % …

      		
      
       daviddavid
      
      
       
      
     




     

      
       
       
This could probably be simplified, because the username won't be None: if (request.user.is_authenticated() and request.user.username == credentials.get('username')):

      		
      
       daviddavid
      
      
       
      
     




     

      
       
       
Can we move all of this into the try?

      		
      
       daviddavid
      
      
       
      
     


    
   

  

 







 






  

 








 














 





 

  

   




david




   

   







  

 



 

  


   

   

    
 
david


    
   


  

  

  



    




  1. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    2. 

















  2. 
 
    
  
  
    
  
 
    
  
    
   
    
    
     
    
      
       djblets/webapi/auth.py
       


        (Diff revision 1)


       
      
     
    
        
    
     
     
    

     
     
    

        
   
    
  
    
 
    

   
    
    
    




    
 
    
  
  
  

  
  
   Show all issues
  
 
    

    



    
    Care to add _RE to the end of this name?
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    3. 






  3. 
 
    
  
  
    
  
 
    
  
    
   
    
    
     
    
      
       djblets/webapi/auth.py
       


        (Diff revision 1)


       
      
     
    
        
    
     
     
    

     
     
    

     
     
    

     
     
    

        
   
    
  
    
 
    

   
    
    
    




    
 
    
  
  
  

  
  
   Show all issues
  
 
    

    



    
    Can we just pass this inline in the logging call?
    

    

    logging.debug(
    'Attempting authentication on API: %s',
    ', '.join([
        '%s=%s' % pair
        for pair in six.iteritems(cleaned_credentials)
    ]),
    extra={'request': request})

    
  
    
 
    

 
    
  


    
 
    
 
      

  


    1. 
 
 
      
 
      
  
 
      
 
      
  
      There are two log statements using it, so I'd rather not define it twice.
      
 
      

      2. 



    2. 
 
 
      
 
      
  
 
      
 
      
  
      Ah, didn't notice the second one.
      
 
      

      3. 


 
    


    

 
    

    4. 






  4. 
 
    
  
  
    
  
 
    
  
    
   
    
    
     
    
      
       djblets/webapi/auth.py
       


        (Diff revision 1)


       
      
     
    
        
    
     
     
    

     
     
    

     
     
    

     
     
    

        
   
    
  
    
 
    

   
    
    
    




    
 
    
  
  
  

  
  
   Show all issues
  
 
    

    



    
    This could probably be simplified, because the username won't be None:
    

    

    if (request.user.is_authenticated() and
    request.user.username == credentials.get('username')):

    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    5. 






  5. 
 
    
  
  
    
  
 
    
  
    
   
    
    
     
    
      
       djblets/webapi/auth.py
       


        (Diff revision 1)


       
      
     
    
        
    
     
     
    

     
     
    

     
     
    

     
     
    

     
     
    

     
     
    

        
   
    
  
    
 
    

   
    
    
    




    
 
    
  
  
  

  
  
   Show all issues
  
 
    

    



    
    Can we move all of this into the try?
    
  
    
 
    

 
    
  


    
 
    
 
      

  


    1. 
 
 
      
 
      
  
 
      
 
      
  
      I don't see a reason to. We already have checked in the calling function at this point that HTTP_AUTHORIZATION exists. If you split and there's nothing in the split string there, you'll still get one item (the full string). Even with an empty string, you're guaranteed a result with that split:
      

      >>> ''.split(' ')
['']

      
 
      

      2. 


 
    


    

 
    

    6. 




  6. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    7. 




  

 
















 



 

  

   




chipx86




   

   

  

 



 















 



 

  

   




chipx86




   

   

  

 



 















 





 

  

   




david




   

   







  

 



 

  


   

   

    
 
david


    
   


  

  

  



    




  1. 
 
    
  
    
   
    Ship It!
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    2. 















  2. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    3. 




  

 
















 



 

  

   




chipx86




   

   

  

 



 

  


   

   

    
 Review request changed

    
   


  

  

  







  

   

    Status:
   

   


    Completed

   

  




  

   

    Change Summary:
   

   

    
Pushed to release-0.8.x (a08a381)

   

  















  

 
















 





 

  

   




reviewbot




   

   





  

 



 

  


   

   

    
 
reviewbot


    
   


  

  

  



    




  1. 
 
    
  
    
   
    Tool: Pyflakes
Processed Files:
    djblets/webapi/auth.py



Tool: PEP8 Style Checker
Processed Files:
    djblets/webapi/auth.py



Tool: Pyflakes
Processed Files:
    djblets/webapi/auth.py



Tool: PEP8 Style Checker
Processed Files:
    djblets/webapi/auth.py


    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    2. 















  2. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    3. 




  

 
















 





 

  

   




reviewbot




   

   





  

 



 

  


   

   

    
 
reviewbot


    
   


  

  

  



    




  1. 
 
    
  
    
   
    Tool: Pyflakes
Processed Files:
    djblets/webapi/auth.py
    djblets/configforms/views.py



Tool: PEP8 Style Checker
Processed Files:
    djblets/webapi/auth.py
    djblets/configforms/views.py


    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    2. 















  2. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    3.