Changeset 1430:146764b24c85

Timestamp:

07/17/08 09:15:38 (6 months ago)

Author:

Nate Coraor <nate@bx.psu.edu>

branch:

default

Message:

Basic $REMOTE_USER support.

A database change is necessary:

ALTER TABLE galaxy_user ADD COLUMN external boolean;

To use:

http://g2.trac.bx.psu.edu/wiki/HowToInstall/ApacheProxy

I've tried to be as friendly as possible with respect to enabling and
disabling $REMOTE_USER support. If you have an existing server and
enable use_remote_user, users whose external login matches their Galaxy
username will have access to their existing history/session. If the
logins don't match, any existing credentials they had are destroyed.
Likewise, when disabled, users who weren't created automatically may
continue to access their histories/sessions. Automatically created
users are logged out, and can't log in unless enabled by an administrator.

Files:

• lib/galaxy/config.py (modified) (1 diff)
• lib/galaxy/model/__init__.py (modified) (1 diff)
• lib/galaxy/model/mapping.py (modified) (1 diff)
• lib/galaxy/web/buildapp.py (modified) (1 diff)
• lib/galaxy/web/controllers/user.py (modified) (1 diff)
• lib/galaxy/web/framework/__init__.py (modified) (2 diffs)
• lib/galaxy/web/framework/middleware/remoteuser.py (added)
• templates/root/masthead.mako (modified) (1 diff)
• universe_wsgi.ini.sample (modified) (1 diff)

lib/galaxy/config.py

@@ -38 +38 @@
-        self.tool_secret = kwargs.get( "tool_secret", "" )
-        self.id_secret = kwargs.get( "id_secret", "USING THE DEFAULT IS NOT SECURE!" )
+        self.use_remote_user = string_as_bool( kwargs.get( "use_remote_user", "False" ) )
+        self.remote_user_maildomain = kwargs.get( "remote_user_maildomain", None )
-        self.template_path = resolve_path( kwargs.get( "template_path", "templates" ), self.root )
-        self.template_cache = resolve_path( kwargs.get( "template_cache_path", "database/compiled_templates" ), self.root )

lib/galaxy/model/__init__.py

@@ -31 +31 @@
-        self.email = email
-        self.password = password
+        self.external = False
-        # Relationships
-        self.histories = []

lib/galaxy/model/mapping.py

@@ -44 +44 @@
-    Column( "update_time", DateTime, default=now, onupdate=now ),
-    Column( "email", TrimmedString( 255 ), nullable=False ),
-
+
+
-
-History.table = Table( "history", metadata,

lib/galaxy/web/buildapp.py

@@ -92 +92 @@
-    app = httpexceptions.make_middleware( app, conf )
-    log.debug( "Enabling 'httpexceptions' middleware" )
+    # If we're using remote_user authentication, add middleware that
+    # protects Galaxy from improperly configured authentication in the
+    # upstream server
+    if asbool(conf.get( 'use_remote_user', False )):
+        from galaxy.web.framework.middleware.remoteuser import RemoteUser
+        app = RemoteUser( app, maildomain=conf.get( 'remote_user_maildomain', None ) )
+        log.debug( "Enabling 'remote user' middleware" )
-    # The recursive middleware allows for including requests in other 
-    # requests or forwarding of requests, all on the server side.

lib/galaxy/web/controllers/user.py

@@ -77 +77 @@
-            if not user:
-                email_error = "No such user"
+            elif user.external:
+                return trans.show_error_message( "This account was created for use with an external authentication "
+                                               + "method.  Please contact your local Galaxy administrator to activate it." )
-            elif not user.check_password( password ):
-                password_error = "Invalid password"

lib/galaxy/web/framework/__init__.py

@@ -237 +237 @@
-        if self.__user is NOT_SET:
-            self.__user = None
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-            else:
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                    if user:
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-    def set_user( self, user ):
-        """Set the current user if logged in."""
@@ -451 +491 @@
-        Fill in a template, putting any keyword arguments on the context.
-        """
+        # call get_user so we can invalidate sessions from external users,
+        # if external auth has been disabled.
+        self.get_user()
-        if filename.endswith( ".mako" ):
-            return self.fill_template_mako( filename, **kwargs )

templates/root/masthead.mako

@@ -24 +24 @@
-    | <a target="mainframe" href="/static/index_frame_history.html">history</a> -->
-    &nbsp;&nbsp;&nbsp;
-
-
-
+
+
-    %else:
-
-
+
+
+
+
+
+
+
-    %endif
-    &nbsp;

universe_wsgi.ini.sample

@@ -64 +64 @@
-# Galaxy session security
-id_secret = changethisinproductiontoo
+
+# Use user provided in an upstream server's $REMOTE_USER variable
+## use_remote_user = False
+# If use_remote_user is enabled and your external authentication
+# method just returns bare usernames, set a default mail domain
+## remote_user_maildomain = example.org
-
-# Configuration for debugging middleware