Merge lp:~canonical-isd-hackers/canonical-identity-provider/yubikey-acct-requires-key into lp:~canonical-isd-hackers/canonical-identity-provider/add-yubikey-support

[Danny Tamez]

Initial step for redirect to two form auth page when the account requires it.

This branch is the initial step towards two step authentication if the account requires it. If the acct requires it then after filling out email and password they will be redirected to a second page. This second page is only stubbed out right now. Newz2000 will finish that page.

[David Owen (dsowen)]

review: Approve

=== modified file 'identityprovider/forms.py'
--- identityprovider/forms.py	2011-05-11 18:35:14 +0000
+++ identityprovider/forms.py	2011-05-12 13:21:07 +0000
@@ -74,14 +74,6 @@
                 raise forms.ValidationError(_("Your account has been "
                     "deactivated"))
 
-            # check that the yubikey belongs to this acct
-            #TODO: DT Dynamic based on openid request
-            if hasattr(self, 'yubikey'):
-                try:
-                    account.yubikey_set.get(pk=self.yubikey)
-                except YubiKey.DoesNotExist:
-                    raise forms.ValidationError(_("This key is not valid for "
-                                                "this account"))
             if user is not None and user.is_active:
                     return self.cleaned_data
             else:

=== added file 'identityprovider/templates/ubuntu/registration/two_step.html'
--- identityprovider/templates/ubuntu/registration/two_step.html	1970-01-01 00:00:00 +0000
+++ identityprovider/templates/ubuntu/registration/two_step.html	2011-05-12 13:21:07 +0000
@@ -0,0 +1,122 @@
+
+{% extends "twocols.html" %}
+
+{% comment %}
+Copyright 2010 Canonical Ltd.  This software is licensed under the
+GNU Affero General Public License version 3 (see the file  LICENSE).
+{% endcomment %}
+
+{% load i18n %}
+
+{% block extra_header %}
+    <meta http-equiv="Expires" content="0" />
+    <meta http-equiv="Cache-Control" content="no-cache" />
+    <meta http-equiv="Pragma" content="no-cache" />
+    <style type="text/css">
+    form input[type='text'].yubifield {
+        background: white
+        url("/assets/identityprovider/yubiright_16x16.gif") no-repeat scroll 2px 2px;
+        padding-left: 20px;
+    }
+    </style>
+{% endblock %}
+
+{% block menu %}{% endblock %}
+
+{% block leftcol %}
+<div id="auth">
+    {% if rpconfig %}
+        {% include "widgets/trusted_rp.html" %}
+    {% else %}
+        <h2 class="main">{% blocktrans %}Log in to Ubuntu Single Sign On{% endblocktrans %}</h2>
+    {% endif %}
+
+    <div id="auth-text">
+        {% if token and rpconfig %}
+        <p>
+          {% blocktrans with rpconfig.displayname as rpconfigname %}You are here because {{ rpconfigname }} uses the Ubuntu Single Sign On service.{% endblocktrans %}
+
+        </p>
+        {% endif %}
+        <p>
+        {% blocktrans %}Please note that if you've registered with Launchpad you can use your existing Launchpad credentials to log in.{% endblocktrans %}
+        </p>
+    </div>
+
+    <form id="login-form" action="+login" method="post" name="loginform">
+        <p class="input-row{% if form.email.errors or form.non_field_errors %} haserrors{% endif %}">
+            <label class="formLabel">{% trans "Email address" %}</label><br />
+            {{ form.email }}
+            {% if form.email.errors %}
+              <span class="error">{{ form.email.errors|join:"" }}</span>
+            {% endif %}
+        </p>
+
+        <p class="input-row{% if form.password.errors or form.non_field_errors %} haserrors{% endif %}">
+            <label class="formLabel" for="id_password">{% trans "Password" %}</label><br />
+            {{ form.password }}
+            {% if form.password.errors %}
+              <span class="error">
+                {{ form.password.errors|join:"" }}
+              </span>
+            {% endif %}
+            {% if form.non_field_errors %}
+                <span class="error">{{ form.non_field_errors|join:"" }}</span>
+            {% endif %}
+        </p>
+
+        {% if form.otp %}
+        <p class="input-row{% if form.email.errors or form.non_field_errors %} haserrors{% endif %}">
+            <label class="formLabel yubikey">{% trans "One time password" %}</label><br />
+            {{ form.otp }}
+                <span class="formHelp">
+                    This form requires the use of a "one time password" device.
+                    You should have been assigned this device and been given
+                    instructions on how to use it.
+                              </span>
+            {% if form.otp.errors %}
+              <span class="error">{{ form.otp.errors|join:"" }}</span>
+            {% endif %}
+        </p>
+        {% endif %}
+
+        <p style="clear: both">
+{% if not readonly %}
+            <a href="+forgot_password{% if form.email.data %}?email={{ form.email.data|urlencode }}{% endif %}" id="forgotpw-link">{% trans "Forgot your password?" %}</a>
+{% endif %}
+        </p>
+
+        <div class="actions">
+            {% if next %}<input type="hidden" name="next" value="{{ next }}" />{% endif %}
+            <button type="submit" class="btn" name="continue"><span><span>{% trans "Continue" %}</span></span></button>
+            {% if token %}{% trans "or" %}
+            <a href="+cancel">{% trans "cancel" %}</a>{% endif %}
+        </div>
+        <div style="clear: both">&nbsp;</div>
+    </form>
+    <script type="text/javascript">
+    document.loginform.email.focus();
+    </script>
+</div>
+
+{% endblock %}
+
+{% block rightcol %}
+    <h2 class="main">{% trans "Are you new?" %}</h2>
+    <p>
+      {% blocktrans %}This is a new service to provide a single, central login service for all Ubuntu-related sites.{% endblocktrans %}
+    </p>
+{%if not embedded %}
+    <p class="findoutmore">
+      <a href="/+description">{% trans "Find out more" %}</a>
+    </p>
+{% endif %}
+    <p class="last">
+    {{ brand.provides_access }}
+    </p>
+{% if not readonly %}
+    <p>
+        <a href="+new_account{% if form.email.data %}?email={{ form.email.data|urlencode }}{% endif %}" class="btn alt"><span><span>{% trans "New account" %}</span></span></a>
+    </p>
+{% endif %}
+{% endblock %}

=== modified file 'identityprovider/tests/test_views_ui.py'
--- identityprovider/tests/test_views_ui.py	2011-01-19 20:57:48 +0000
+++ identityprovider/tests/test_views_ui.py	2011-05-12 13:21:07 +0000
@@ -19,6 +19,10 @@
 from openid.message import IDENTIFIER_SELECT
 
 from identityprovider import decorators, signed
+from identityprovider.forms import (
+    LoginForm,
+    OTPLoginForm,
+)
 from identityprovider.models import AUTHTOKEN_LENGTH, authtoken as at
 from identityprovider.models import EmailAddress, Person, OpenIDRPConfig
 from identityprovider.models.const import EmailStatus
@@ -722,6 +726,26 @@
         r = self.client.get('/+suspended')
         self.assertTemplateUsed(r, 'account/suspended.html')
 
+    def test_login_when_account_requires_otp(self):
+        account = Account.objects.get_by_email('[e-mail]')
+        account.require_key = True
+        account.save()
+
+        r = self.client.post('/+login', {'email': '[e-mail]',
+                                         'password': 'test',
+                                         'next': '/+edit'})
+        self.assertRedirects(r, '/+two_step_auth/')
+
+
+    def test_login_when_account_does_not_require_otp(self):
+        account = Account.objects.get_by_email('[e-mail]')
+        account.save()
+
+        r = self.client.post('/+login', {'email': '[e-mail]',
+                                         'password': 'test',
+                                         'next': '/+edit'})
+        self.assertRedirects(r, '/+edit')
+
 
 class UIViewsLPModelTestCase(LPAccountTestCase):
     def test_new_account_when_person_does_not_exist(self):

=== modified file 'identityprovider/urls.py'
--- identityprovider/urls.py	2011-05-10 14:32:26 +0000
+++ identityprovider/urls.py	2011-05-12 13:21:07 +0000
@@ -32,6 +32,7 @@
     (r'^%(optional_token)s\+new_account$' % repls, 'new_account'),
     (r'^%(optional_token)s\+forgot_password$' % repls, 'forgot_password'),
     (r'^%(optional_token)s\+enter_token$' % repls, 'enter_token'),
+    (r'^\+two_step_auth/$', 'two_step_auth'),
     (r'^token/%(authtoken)s/$' % repls, 'claim_token'),
 
     # Django's URL-reversing doesn't like to play with regex

=== modified file 'identityprovider/views/account.py'
--- identityprovider/views/account.py	2011-05-11 14:40:45 +0000
+++ identityprovider/views/account.py	2011-05-12 13:21:07 +0000
@@ -5,7 +5,6 @@
 
 from django.conf import settings
 from django.contrib.auth.decorators import login_required
-from django.contrib.auth.models import User
 from django.http import HttpResponseRedirect
 from django.shortcuts import render_to_response, get_object_or_404
 from django.template import RequestContext
@@ -24,7 +23,7 @@
     send_validation_email_request,
     YubiKey,
 )
-from oauth_backend.models import Consumer, Token
+from oauth_backend.models import Token
 from identityprovider.models.const import EmailStatus
 from identityprovider.views.utils import (redirection_url_for_token,
     set_session_token_info)
@@ -32,7 +31,6 @@
 
 
 def index(request, token=None):
-    #TODO: DT Dynamic based on openid request
     request.token = token
     context = RequestContext(request)
     if request.user.is_authenticated():
@@ -41,7 +39,7 @@
         if not request.session.test_cookie_worked():
             request.session.set_test_cookie()
         context = RequestContext(request, {
-            'form': OTPLoginForm(), #LoginForm(),
+            'form': LoginForm(),
         })
         resp = render_to_response('registration/login.html', context)
     resp[YADIS_HEADER_NAME] = '%s+xrds' % settings.SSO_ROOT_URL

=== modified file 'identityprovider/views/ui.py'
--- identityprovider/views/ui.py	2011-05-11 15:33:26 +0000
+++ identityprovider/views/ui.py	2011-05-12 13:21:07 +0000
@@ -82,6 +82,11 @@
             username = form.cleaned_data['email']
             password = form.cleaned_data['password']
             user = auth.authenticate(username=username, password=password)
+            # get the acct based on the user
+            # check for key Required
+            # if required redirect else go on
+            if user.require_key:
+                return HttpResponseRedirect('/+two_step_auth/')
             auth.login(request, user)
             next = request.POST.get('next')
             limitlogin().reset_count(request)
@@ -108,6 +113,10 @@
     return render_to_response('registration/login.html', context)
 
 
+def two_step_auth(request):
+    context = RequestContext(request, {})
+    return render_to_response('registration/two_step.html', context)
+
 def _is_safe_redirect_url(url):
     """ Check whether 'url' resolves into a valid URL this application can
     serve. """