Merge lp:~mandel/ubuntu-sso-client/webclient-use-dialog into lp:ubuntu-sso-client

[Manuel de la Peña]

- Added the required code to allow the webclient use authenticated proxies and request the creds when needed (LP: #933727).

Provides the required code to use auth proxies within sso.

[Brian Curtin (brian.curtin)]

140 + if (self.proxy_username is not None
141 + and self.proxy_password is not None):

"""if all((self.proxy_username, self.self.proxy_password)):""" would be a less verbose way of doing the same thing. I think it's clearer, but it's no more correct than what you have so it's merely a comment and not a requirement to fix.

424 + if "username" in settings and "password" in settings:

Just so you know I'm not crazy with the any/all builtins, I don't suggest """if all(key in settings for key in ("user", "pass"))""" :)

(comment for now - will approve/reject after I can run the tests)

[Brian Curtin (brian.curtin)]

> 140 + if (self.proxy_username is not None
> 141 + and self.proxy_password is not None):
>
> """if all((self.proxy_username, self.self.proxy_password)):""" would be a less
> verbose way of doing the same thing. I think it's clearer, but it's no more
> correct than what you have so it's merely a comment and not a requirement to
> fix.

I misunderstood the original lines. If "" and "" are acceptable username and password values, then my suggestion is incorrect and would change the behavior.

[lp:~mandel/ubuntu-sso-client/webclient-use-dialog]

911. By Manuel de la Peña on 2012-02-24

Merged fix-credentials-text into webclient-use-dialog.

912. By Manuel de la Peña on 2012-02-24

Merged fix-credentials-text into webclient-use-dialog.

913. By Manuel de la Peña on 2012-02-24

Merged fix-credentials-text into webclient-use-dialog.

914. By Manuel de la Peña on 2012-02-27

Merged with parent.

915. By Manuel de la Peña on 2012-02-27

Merged fix-credentials-text into webclient-use-dialog.

916. By Manuel de la Peña on 2012-02-29

Merged fix-credentials-text into webclient-use-dialog.

917. By Manuel de la Peña on 2012-02-29

Merged fix-credentials-text into webclient-use-dialog.

918. By Manuel de la Peña on 2012-02-29

Merged fix-credentials-text into webclient-use-dialog.

919. By Manuel de la Peña on 2012-02-29

Merged fix-credentials-text into webclient-use-dialog.

920. By Manuel de la Peña on 2012-03-01

Merged fix-credentials-text into webclient-use-dialog.

921. By Manuel de la Peña on 2012-03-01

Merged fix-credentials-text into webclient-use-dialog.

922. By Manuel de la Peña on 2012-03-05

Merged with trunk.

923. By Manuel de la Peña on 2012-03-05

Use add_feature instead of add_feature_by_type.

924. By Manuel de la Peña on 2012-03-06

Merged with trunk.

925. By Manuel de la Peña on 2012-03-07

Merged with trunk.

926. By Manuel de la Peña on 2012-03-07

Reuse vars from ubuntu-sso

[Natalia Bidart (nataliabidart)]

Thanks for this work!

* Could you please change this line:

            logger.error('Could not set credentials.')

to be:

            logger.exception('Could not set credentials:')

so the exception is logged and we know what happened? Please apply the same to every logger.error inside a try-except block.

* This new import from ubuntu_sso.utils.runner import spawn_program is not alphabetically ordered.

* Can you please move the constants EXCEPTION_RAISED and PROXY_CREDS_DIALOG to ubuntu_sso/__init__.py?

* Unless strictly necessary, please avoid having imports inside functions. Can this import be moved at the beginning of the python file?

    def _load_proxy_creds_from_keyring(self, domain):
        """Load the proxy creds from the keyring."""
        from ubuntu_sso.keyring import Keyring

Same for:

    def _launch_proxy_creds_dialog(self, domain, retry):
        """Launch the dialog used to get the creds."""
        from ubuntu_sso.utils import get_bin_dir

* I would guess you need to pass the app_name here?

        args = (os.path.join(bin_dir, PROXY_CREDS_DIALOG), '--domain', domain)

* Why are you defining new variables:

        self.proxy_username = None
        self.proxy_password = None

given that the BaseWebClient class already has:

        self.username = username
        self.password = password
?

* The import of ProxyUnauthorizedError is not alphabetically ordered.

* Shouldn't the self.session.unpause_message(message) be in a finally block?

* Instead of calling settings.get("host", "") twice, can you please assign that to a variable? same for port=settings.get("port", 0)).

review: Needs Fixing

[Manuel de la Peña (mandel)]

> Thanks for this work!
>
> * Could you please change this line:
>
> logger.error('Could not set credentials.')
>
> to be:
>
> logger.exception('Could not set credentials:')
>
> so the exception is logged and we know what happened? Please apply the same to
> every logger.error inside a try-except block.

Sorted, I always forget about the diff, thx!

>
> * This new import from ubuntu_sso.utils.runner import spawn_program is not
> alphabetically ordered.
>

Sorted out.

> * Can you please move the constants EXCEPTION_RAISED and PROXY_CREDS_DIALOG to
> ubuntu_sso/__init__.py?
>

Done.

> * Unless strictly necessary, please avoid having imports inside functions. Can
> this import be moved at the beginning of the python file?
>
> def _load_proxy_creds_from_keyring(self, domain):
> """Load the proxy creds from the keyring."""
> from ubuntu_sso.keyring import Keyring
>
>
> Same for:
>
> def _launch_proxy_creds_dialog(self, domain, retry):
> """Launch the dialog used to get the creds."""
> from ubuntu_sso.utils import get_bin_dir
>

Unfortunately there is a circular import due to the fact that keyring is in utils too, there is no other way to fix this atm.

> * I would guess you need to pass the app_name here?
>
> args = (os.path.join(bin_dir, PROXY_CREDS_DIALOG), '--domain', domain)
>

By the looks at the strings proposed by design (we need to talk about this with them) there is no need at the moment. This looks like a bug in the ui design.

> * Why are you defining new variables:
>
> self.proxy_username = None
> self.proxy_password = None
>
> given that the BaseWebClient class already has:
>
> self.username = username
> self.password = password
> ?
>

There is a diff between the username and password in the server side and the proxy username and password. We have two different pairs, when there is an auth issue coming from the server (that is username/password) and when there is an auth issue coming from the proxy (proxy_username/proxy_password). Do I make sense?

> * The import of ProxyUnauthorizedError is not alphabetically ordered.
>

Sorted!

> * Shouldn't the self.session.unpause_message(message) be in a finally block?
>

Is in order once the exception var is moved out.

> * Instead of calling settings.get("host", "") twice, can you please assign
> that to a variable? same for port=settings.get("port", 0)).

Certainly.

[lp:~mandel/ubuntu-sso-client/webclient-use-dialog]

927. By Manuel de la Peña on 2012-03-08

Fixed according to the reviews.

928. By Manuel de la Peña on 2012-03-08

Use try/finally to ensure that we always unpause the message.

[Alejandro J. Cura (alecu)]

Lovely branch!
I really like that you managed to work around the qt issue regarding proxy authentication.

just two typos ;-)

 * "going throw a proxy" -> *thru*
 * _on_aunthenticate

Otherwise a great branch.

review: Approve

[Manuel de la Peña (mandel)]

> Lovely branch!
> I really like that you managed to work around the qt issue regarding proxy
> authentication.
>
> just two typos ;-)
>
> * "going throw a proxy" -> *thru*
> * _on_aunthenticate
>
> Otherwise a great branch.

Fixed, thx for the review!!

[lp:~mandel/ubuntu-sso-client/webclient-use-dialog]

929. By Manuel de la Peña on 2012-03-09

Fixed typos.

[Natalia Bidart (nataliabidart)]

Looks good!

review: Approve

=== modified file 'ubuntu_sso/__init__.py'
--- ubuntu_sso/__init__.py	2012-02-11 19:25:01 +0000
+++ ubuntu_sso/__init__.py	2012-03-09 11:54:19 +0000
@@ -29,7 +29,9 @@
 # return codes for UIs
 USER_SUCCESS = 0
 USER_CANCELLATION = 10
+EXCEPTION_RAISED = 11
 
 # available UIs
 UI_EXECUTABLE_GTK = 'ubuntu-sso-login-gtk'
 UI_EXECUTABLE_QT = 'ubuntu-sso-login-qt'
+UI_PROXY_CREDS_DIALOG = 'ubuntu-sso-proxy-creds-qt'

=== modified file 'ubuntu_sso/qt/proxy_dialog.py'
--- ubuntu_sso/qt/proxy_dialog.py	2012-03-05 20:30:57 +0000
+++ ubuntu_sso/qt/proxy_dialog.py	2012-03-09 11:54:19 +0000
@@ -21,6 +21,7 @@
 from PyQt4.QtGui import QApplication, QDialog, QIcon
 from twisted.internet import defer
 
+from ubuntu_sso import EXCEPTION_RAISED, USER_SUCCESS, USER_CANCELLATION
 from ubuntu_sso.logger import setup_gui_logging
 from ubuntu_sso.keyring import Keyring
 from ubuntu_sso.qt.ui.proxy_credentials_dialog_ui import Ui_ProxyCredsDialog
@@ -37,10 +38,6 @@
     PROXY_CREDS_SAVE_BUTTON,
 )
 
-CREDS_ACQUIRED = 0
-USER_CANCELATION = -1
-EXCEPTION_RAISED = -2
-
 logger = setup_gui_logging("ubuntu_sso.qt.proxy_dialog")
 
 
@@ -107,15 +104,15 @@
             logger.debug('Save credentials as for domain %s.', self.domain)
             yield self.keyring.set_credentials(self.domain, creds)
         except Exception, e:
-            logger.error('Could not retrieve credentials.')
+            logger.exception('Could not set credentials:')
             self.done(EXCEPTION_RAISED)
         # pylint: disable=W0703, W0612
-        self.done(CREDS_ACQUIRED)
+        self.done(USER_SUCCESS)
 
     def _on_cancel_clicked(self, *args):
         """End the dialog."""
         logger.debug('User canceled credentials dialog.')
-        self.done(USER_CANCELATION)
+        self.done(USER_CANCELLATION)
 
     def _set_buttons(self):
         """Set the labels of the buttons."""

=== modified file 'ubuntu_sso/qt/tests/test_proxy_dialog.py'
--- ubuntu_sso/qt/tests/test_proxy_dialog.py	2012-02-13 16:16:03 +0000
+++ ubuntu_sso/qt/tests/test_proxy_dialog.py	2012-03-09 11:54:19 +0000
@@ -256,7 +256,7 @@
         self.patch(dialog, 'done', fake_done)
 
         dialog._on_cancel_clicked()
-        self.assertIn(('done', proxy_dialog.USER_CANCELATION), called)
+        self.assertIn(('done', proxy_dialog.USER_CANCELLATION), called)
 
     def assert_save_button(self, set_creds_callback, result_number):
         """Test the save button execution."""
@@ -288,7 +288,7 @@
     def test_on_save_clicked_correct(self):
         """Test that we do save the creds."""
         set_creds_cb = lambda: defer.succeed(True)
-        result_number = proxy_dialog.CREDS_ACQUIRED
+        result_number = proxy_dialog.USER_SUCCESS
         self.assert_save_button(set_creds_cb, result_number)
 
 

=== modified file 'ubuntu_sso/utils/webclient/__init__.py'
--- ubuntu_sso/utils/webclient/__init__.py	2012-02-09 18:11:02 +0000
+++ ubuntu_sso/utils/webclient/__init__.py	2012-03-09 11:54:19 +0000
@@ -19,6 +19,7 @@
 
 # pylint: disable=W0611
 from ubuntu_sso.utils.webclient.common import (
+    ProxyUnauthorizedError,
     UnauthorizedError,
     WebClientError,
 )

=== modified file 'ubuntu_sso/utils/webclient/common.py'
--- ubuntu_sso/utils/webclient/common.py	2012-02-09 18:11:02 +0000
+++ ubuntu_sso/utils/webclient/common.py	2012-03-09 11:54:19 +0000
@@ -17,14 +17,20 @@
 
 import cgi
 import collections
+import os
 
 from httplib2 import iri2uri
 from oauth import oauth
 from twisted.internet import defer
 from urlparse import urlparse
 
+from ubuntu_sso import USER_SUCCESS, UI_PROXY_CREDS_DIALOG
+from ubuntu_sso.logger import setup_logging
+from ubuntu_sso.utils.runner import spawn_program
 from ubuntu_sso.utils.webclient.timestamp import TimestampChecker
 
+logger = setup_logging("ubuntu_sso.utils.webclient.common")
+
 
 class WebClientError(Exception):
     """An http error happened while calling the webservice."""
@@ -34,8 +40,12 @@
     """The request ended with bad_request, unauthorized or forbidden."""
 
 
+class ProxyUnauthorizedError(WebClientError):
+    """Failure raised when there is an issue with the proxy auth."""
+
+
 class Response(object):
-    """A reponse object."""
+    """A response object."""
 
     def __init__(self, content, headers=None):
         """Initialize this instance."""
@@ -81,6 +91,8 @@
         """Initialize this instance."""
         self.username = username
         self.password = password
+        self.proxy_username = None
+        self.proxy_password = None
         self.oauth_sign_plain = oauth_sign_plain
 
     def request(self, iri, method="GET", extra_headers=None,
@@ -154,3 +166,59 @@
 
     def shutdown(self):
         """Shut down all pending requests (if possible)."""
+
+    @defer.inlineCallbacks
+    def _load_proxy_creds_from_keyring(self, domain):
+        """Load the proxy creds from the keyring."""
+        from ubuntu_sso.keyring import Keyring
+        keyring = Keyring()
+        try:
+            creds = yield keyring.get_credentials(domain)
+            logger.debug('Got credentials from keyring.')
+        except Exception, e:
+            logger.error('Error when retrieving the creds.')
+            raise WebClientError('Error when retrieving the creds.', e)
+        if creds is not None:
+            self.proxy_username = creds['username']
+            self.proxy_password = creds['password']
+            defer.returnValue(True)
+        defer.returnValue(False)
+
+    def _launch_proxy_creds_dialog(self, domain, retry):
+        """Launch the dialog used to get the creds."""
+        from ubuntu_sso.utils import get_bin_dir
+
+        bin_dir = get_bin_dir()
+        args = (os.path.join(bin_dir, UI_PROXY_CREDS_DIALOG), '--domain',
+                                                                  domain)
+        if retry:
+            args += ('--retry',)
+        return spawn_program(args)
+
+    @defer.inlineCallbacks
+    def request_proxy_auth_credentials(self, domain, retry):
+        """Request the auth creds to the user."""
+        if not retry:
+            if (self.proxy_username is not None
+                    and self.proxy_password is not None):
+                logger.debug('Not retry and credentials are present.')
+                defer.returnValue(True)
+            else:
+                creds_loaded = yield self._load_proxy_creds_from_keyring(
+                                                                      domain)
+                if creds_loaded:
+                    defer.returnValue(True)
+
+        try:
+            return_code = yield self._launch_proxy_creds_dialog(domain, retry)
+        except Exception, e:
+            logger.error('Error when running external ui process.')
+            raise WebClientError('Error when running external ui process.', e)
+
+        if return_code == USER_SUCCESS:
+            creds_loaded = yield self._load_proxy_creds_from_keyring(domain)
+            defer.returnValue(creds_loaded)
+        else:
+            logger.debug('Could not retrieve the credentials. Return code: %r',
+                         return_code)
+            defer.returnValue(False)

=== modified file 'ubuntu_sso/utils/webclient/libsoup.py'
--- ubuntu_sso/utils/webclient/libsoup.py	2012-02-07 19:36:50 +0000
+++ ubuntu_sso/utils/webclient/libsoup.py	2012-03-09 11:54:19 +0000
@@ -19,10 +19,12 @@
 
 from twisted.internet import defer
 
+from ubuntu_sso.logger import setup_logging
 from ubuntu_sso.utils.webclient.common import (
     BaseWebClient,
     HeaderDict,
     Response,
+    ProxyUnauthorizedError,
     UnauthorizedError,
     WebClientError,
 )
@@ -30,6 +32,8 @@
 URI_ANONYMOUS_TEMPLATE = "http://{host}:{port}/"
 URI_USERNAME_TEMPLATE = "http://{username}:{password}@{host}:{port}/"
 
+logger = setup_logging("ubuntu_sso.utils.webclient.libsoup")
+
 
 class WebClient(BaseWebClient):
     """A webclient with a libsoup backend."""
@@ -41,11 +45,12 @@
         from gi.repository import Soup, SoupGNOME
         self.soup = Soup
         self.session = Soup.SessionAsync()
-        self.session.add_feature_by_type(SoupGNOME.ProxyResolverGNOME)
+        self.session.add_feature(SoupGNOME.ProxyResolverGNOME())
         self.session.connect("authenticate", self._on_authenticate)
 
     def _on_message(self, session, message, d):
         """Handle the result of an http message."""
+        logger.debug('_on_message status code is %s', message.status_code)
         if message.status_code == httplib.OK:
             headers = HeaderDict()
             response_headers = message.get_property("response-headers")
@@ -57,14 +62,51 @@
         elif message.status_code == httplib.UNAUTHORIZED:
             e = UnauthorizedError(message.reason_phrase)
             d.errback(e)
+        elif message.status_code == httplib.PROXY_AUTHENTICATION_REQUIRED:
+            e = ProxyUnauthorizedError(message.reason_phrase)
+            d.errback(e)
         else:
             e = WebClientError(message.reason_phrase)
             d.errback(e)
 
-    def _on_authenticate(self, sesion, message, auth, retrying, data=None):
+    @defer.inlineCallbacks
+    def _on_authenticate(self, session, message, auth, retrying, data=None):
         """Handle the "authenticate" signal."""
-        if not retrying and self.username and self.password:
-            auth.authenticate(self.username, self.password)
+        self.session.pause_message(message)
+        try:
+            logger.debug('_on_authenticate: message status code is %s',
+                         message.status_code)
+            if not retrying and self.username and self.password:
+                auth.authenticate(self.username, self.password)
+            if auth.is_for_proxy():
+                logger.debug('_on_authenticate auth is for proxy.')
+                got_creds = yield self.request_proxy_auth_credentials(
+                                             self.session.props.proxy_uri.host,
+                                             retrying)
+                if got_creds:
+                    logger.debug('Got proxy credentials from user.')
+                    auth.authenticate(self.proxy_username, self.proxy_password)
+        finally:
+            self.session.unpause_message(message)
+
+    @defer.inlineCallbacks
+    def _on_proxy_authenticate(self, failure, iri, method="GET",
+                extra_headers=None, oauth_credentials=None, post_content=None):
+        """Deal with wrong settings."""
+        failure.trap(ProxyUnauthorizedError)
+        logger.debug('Proxy settings are wrong.')
+        got_creds = yield self.request_proxy_auth_credentials(
+                                           self.session.props.proxy_uri.host,
+                                           True)
+        if got_creds:
+            settings = dict(host=self.session.props.proxy_uri.host,
+                            port=self.session.props.proxy_uri.port,
+                            username=self.proxy_username,
+                            password=self.proxy_password)
+            self.force_use_proxy(settings)
+            response = yield self.request(iri, method, extra_headers,
+                                         oauth_credentials, post_content)
+            defer.returnValue(response)
 
     @defer.inlineCallbacks
     def request(self, iri, method="GET", extra_headers=None,
@@ -92,6 +134,8 @@
             message.request_body.append(post_content)
 
         self.session.queue_message(message, self._on_message, d)
+        d.addErrback(self._on_proxy_authenticate, iri, method, extra_headers,
+                     oauth_credentials, post_content)
         response = yield d
         defer.returnValue(response)
 

=== modified file 'ubuntu_sso/utils/webclient/qtnetwork.py'
--- ubuntu_sso/utils/webclient/qtnetwork.py	2012-02-07 19:36:50 +0000
+++ ubuntu_sso/utils/webclient/qtnetwork.py	2012-03-09 11:54:19 +0000
@@ -33,15 +33,19 @@
 )
 from twisted.internet import defer
 
+from ubuntu_sso.logger import setup_logging
 from ubuntu_sso.utils.webclient.common import (
     BaseWebClient,
     HeaderDict,
+    ProxyUnauthorizedError,
     Response,
     UnauthorizedError,
     WebClientError,
 )
 from ubuntu_sso.utils.webclient import gsettings
 
+logger = setup_logging("ubuntu_sso.utils.webclient.qtnetwork")
+
 
 class WebClient(BaseWebClient):
     """A webclient with a qtnetwork backend."""
@@ -52,6 +56,8 @@
         self.nam = QNetworkAccessManager(QCoreApplication.instance())
         self.nam.finished.connect(self._handle_finished)
         self.nam.authenticationRequired.connect(self._handle_authentication)
+        self.nam.proxyAuthenticationRequired.connect(
+                                      self._handle_bad_proxy_authentication)
         self.replies = {}
         self.setup_proxy()
 
@@ -65,6 +71,22 @@
         else:
             QNetworkProxyFactory.setUseSystemConfiguration(True)
 
+    def _perform_request(self, request, method, post_buffer):
+        """Return a deferred that will be fired with a Response object."""
+        d = defer.Deferred()
+        if method == "GET":
+            reply = self.nam.get(request)
+        elif method == "HEAD":
+            reply = self.nam.head(request)
+        else:
+            reply = self.nam.sendCustomRequest(request, method, post_buffer)
+        # deal with auth errors in case we get
+        # ProxyAuthenticationRequiredError
+        d.addErrback(self._handle_proxy_authentication, method, reply,
+                     post_buffer)
+        self.replies[reply] = d
+        return d
+
     @defer.inlineCallbacks
     def request(self, iri, method="GET", extra_headers=None,
                 oauth_credentials=None, post_content=None):
@@ -86,17 +108,9 @@
         for key, value in headers.iteritems():
             request.setRawHeader(key, value)
 
-        d = defer.Deferred()
-        if method == "GET":
-            reply = self.nam.get(request)
-        elif method == "HEAD":
-            reply = self.nam.head(request)
-        else:
-            post_buffer = QBuffer()
-            post_buffer.setData(post_content)
-            reply = self.nam.sendCustomRequest(request, method, post_buffer)
-        self.replies[reply] = d
-        result = yield d
+        post_buffer = QBuffer()
+        post_buffer.setData(post_content)
+        result = yield self._perform_request(request, method, post_buffer)
         defer.returnValue(result)
 
     def _handle_authentication(self, reply, authenticator):
@@ -104,6 +118,54 @@
         authenticator.setUser(self.username)
         authenticator.setPassword(self.password)
 
+    @defer.inlineCallbacks
+    def _handle_bad_proxy_authentication(self, proxy, authenticator):
+        """Handle when we have a bad proxy."""
+        current_proxy = self.nam.proxy()
+        host = unicode(current_proxy.hostName()).encode('utf8')
+        port = current_proxy.port()
+        settings = dict(host=host, port=port)
+        # HACK: work around for reported bugs: QTBUG-16728 and #QTBUG-14850
+        got_creds = yield self.request_proxy_auth_credentials(host, True)
+        if got_creds:
+            logger.debug('Got proxy credentials from user.')
+            settings.update({'username': self.proxy_username,
+                             'password': self.proxy_password})
+        if (settings and 'username' in settings
+               and 'password' in settings):
+            authenticator.setUser(self.proxy_username)
+            authenticator.setPassword(self.proxy_password)
+            self.force_use_proxy(settings)
+
+    @defer.inlineCallbacks
+    def _handle_proxy_authentication(self, failure, method, reply,
+            post_buffer=None, retry=False):
+        """The reply needs authentication."""
+        failure.trap(ProxyUnauthorizedError)
+        current_proxy = self.nam.proxy()
+        host = unicode(current_proxy.hostName()).encode('utf8')
+        port = current_proxy.port()
+        settings = dict(host=host, port=port)
+        # we have to auth the request and retry it
+        if not retry and self.proxy_username and self.proxy_password:
+            settings.update({'username': self.proxy_username,
+                             'password': self.proxy_password})
+        if retry or self.proxy_username is None or self.proxy_password is None:
+            got_creds = yield self.request_proxy_auth_credentials(host, retry)
+            if got_creds:
+                logger.debug('Got proxy credentials from user.')
+                settings.update({'username': self.proxy_username,
+                                 'password': self.proxy_password})
+        if (settings and 'username' in settings
+                and 'password' in settings):
+            self.force_use_proxy(settings)
+            # lets retry using the request
+            request = reply.request()
+            result = yield self._perform_request(request, method, post_buffer)
+            defer.returnValue(result)
+        else:
+            defer.returnValue(ProxyUnauthorizedError())
+
     def _handle_finished(self, reply):
         """The reply has finished processing."""
         assert reply in self.replies
@@ -118,19 +180,30 @@
             d.callback(response)
         else:
             error_string = reply.errorString()
+            logger.debug('_handle_finished error (%s,%s).', error,
+                         error_string)
             if error == QNetworkReply.AuthenticationRequiredError:
                 exception = UnauthorizedError(error_string, content)
+            elif error == QNetworkReply.ProxyAuthenticationRequiredError:
+                # we are going thru a proxy and we did not auth
+                exception = ProxyUnauthorizedError(error_string, content)
             else:
                 exception = WebClientError(error_string, content)
             d.errback(exception)
 
     def force_use_proxy(self, settings):
         """Setup this webclient to use the given proxy settings."""
-        proxy = QNetworkProxy(QNetworkProxy.HttpProxy,
-                              hostName=settings.get("host", ""),
-                              port=settings.get("port", 0),
-                              user=settings.get("username", ""),
+        host = settings.get("host", "")
+        port = settings.get("port", 0)
+        if "username" in settings and "password" in settings:
+            logger.debug('Using auth proxy for %s:%s', host, port)
+            proxy = QNetworkProxy(QNetworkProxy.HttpProxy, hostName=host,
+                              port=port, user=settings.get("username", ""),
                               password=settings.get("password", ""))
+        else:
+            logger.debug('Using nonauth proxy for %s:%s', host, port)
+            proxy = QNetworkProxy(QNetworkProxy.HttpProxy, hostName=host,
+                                                               port=port)
         self.nam.setProxy(proxy)
 
     def shutdown(self):

=== modified file 'ubuntu_sso/utils/webclient/tests/test_webclient.py'
--- ubuntu_sso/utils/webclient/tests/test_webclient.py	2012-02-13 13:14:18 +0000
+++ ubuntu_sso/utils/webclient/tests/test_webclient.py	2012-03-09 11:54:19 +0000
@@ -27,6 +27,12 @@
 from ubuntuone.devtools.testcases import TestCase
 from ubuntuone.devtools.testcases.squid import SquidTestCase
 
+from ubuntu_sso import (
+    keyring,
+    EXCEPTION_RAISED,
+    USER_SUCCESS,
+    USER_CANCELLATION,
+)
 from ubuntu_sso.utils import webclient
 from ubuntu_sso.utils.webclient.common import BaseWebClient, HeaderDict, oauth
 from ubuntu_sso.utils.webclient.tests import BaseMockWebServer
@@ -404,10 +410,119 @@
         result = yield self.wc.request(self.base_iri + SIMPLERESOURCE)
         self.assert_header_contains(result.headers["Via"], "squid")
 
+    @defer.inlineCallbacks
+    def test_auth_proxy_is_used_creds_requested(self):
+        """The authenticated proxy is used by the webclient."""
+        settings = self.get_auth_proxy_settings()
+        partial_settings = dict(host=settings['host'], port=settings['port'])
+
+        def fake_creds_request(domain, retry):
+            """Fake user interaction."""
+            self.wc.proxy_username = settings['username']
+            self.wc.proxy_password = settings['password']
+            return defer.succeed(True)
+
+        self.patch(self.wc, 'request_proxy_auth_credentials',
+                   fake_creds_request)
+
+        self.wc.force_use_proxy(partial_settings)
+        result = yield self.wc.request(self.base_iri + SIMPLERESOURCE)
+        self.assert_header_contains(result.headers["Via"], "squid")
+
+    @defer.inlineCallbacks
+    def test_auth_proxy_is_requested_creds_bad_details(self):
+        """Test using wrong credentials with the proxy."""
+        settings = self.get_auth_proxy_settings()
+        wrong_settings = dict(host=settings['host'], port=settings['port'],
+                              username=settings['password'],
+                              password=settings['username'])
+
+        def fake_creds_request(domain, retry):
+            """Fake user interaction."""
+            self.wc.proxy_username = settings['username']
+            self.wc.proxy_password = settings['password']
+            return defer.succeed(True)
+
+        self.patch(self.wc, 'request_proxy_auth_credentials',
+                   fake_creds_request)
+
+        self.wc.force_use_proxy(wrong_settings)
+        result = yield self.wc.request(self.base_iri + SIMPLERESOURCE)
+        self.assert_header_contains(result.headers["Via"], "squid")
+
+    @defer.inlineCallbacks
+    def test_auth_proxy_is_requested_creds_bad_details_user(self):
+        """Test using no creds and user providing the wrong ones."""
+        settings = self.get_auth_proxy_settings()
+        partial_settings = dict(host=settings['host'], port=settings['port'])
+
+        def fake_creds_request(domain, retry):
+            """Fake user interaction."""
+            if retry:
+                self.wc.proxy_username = settings['username']
+                self.wc.proxy_password = settings['password']
+            else:
+                self.wc.proxy_username = settings['password']
+                self.wc.proxy_password = settings['username']
+            return defer.succeed(True)
+
+        self.patch(self.wc, 'request_proxy_auth_credentials',
+                   fake_creds_request)
+
+        self.wc.force_use_proxy(partial_settings)
+        result = yield self.wc.request(self.base_iri + SIMPLERESOURCE)
+        self.assert_header_contains(result.headers["Via"], "squid")
+
+    @defer.inlineCallbacks
+    def test_auth_proxy_is_requested_creds_bad_details_everywhere(self):
+        """Test when we pass the wrong settings and get the wrong settings."""
+        settings = self.get_auth_proxy_settings()
+        wrong_settings = dict(host=settings['host'], port=settings['port'],
+                              username=settings['password'],
+                              password=settings['username'])
+
+        def fake_creds_request(domain, retry):
+            """Fake user interaction."""
+            if retry:
+                self.wc.proxy_username = settings['username']
+                self.wc.proxy_password = settings['password']
+            else:
+                self.wc.proxy_username = settings['password']
+                self.wc.proxy_password = settings['username']
+            return defer.succeed(True)
+
+        self.patch(self.wc, 'request_proxy_auth_credentials',
+                   fake_creds_request)
+
+        self.wc.force_use_proxy(wrong_settings)
+        result = yield self.wc.request(self.base_iri + SIMPLERESOURCE)
+        self.assert_header_contains(result.headers["Via"], "squid")
+
+    def test_auth_proxy_is_requested_user_cancels(self):
+        """Test when the user cancels the creds dialog."""
+        settings = self.get_auth_proxy_settings()
+        partial_settings = dict(host=settings['host'], port=settings['port'])
+
+        def fake_creds_request(domain, retry):
+            """Fake user interaction."""
+            return defer.succeed(False)
+
+        self.patch(self.wc, 'request_proxy_auth_credentials',
+                   fake_creds_request)
+
+        self.wc.force_use_proxy(partial_settings)
+        self.failUnlessFailure(self.wc.request(self.base_iri + SIMPLERESOURCE),
+                               webclient.WebClientError)
+
     if WEBCLIENT_MODULE_NAME.endswith(".txweb"):
         reason = "txweb does not support proxies."
         test_anonymous_proxy_is_used.skip = reason
         test_authenticated_proxy_is_used.skip = reason
+        test_auth_proxy_is_used_creds_requested.skip = reason
+        test_auth_proxy_is_requested_creds_bad_details.skip = reason
+        test_auth_proxy_is_requested_creds_bad_details_user.skip = reason
+        test_auth_proxy_is_requested_creds_bad_details_everywhere.skip = reason
+        test_auth_proxy_is_requested_user_cancels.skip = reason
 
 
 class HeaderDictTestCase(TestCase):
@@ -562,3 +677,93 @@
     """Test for the oauth signing code using HMAC-SHA1."""
 
     oauth_sign = "HMAC-SHA1"
+
+
+class FakeKeyring(object):
+    """A fake keyring."""
+
+    def __init__(self, creds):
+        """A fake keyring."""
+        self.creds = creds
+
+    def __call__(self):
+        """Fake instance callable."""
+        return self
+
+    def get_credentials(self, domain):
+        """A fake get_credentials."""
+        if isinstance(self.creds, Exception):
+            return defer.fail(self.creds)
+        return defer.succeed(self.creds)
+
+
+class RequestProxyAuthTestCase(TestCase):
+    """Test the spawn of the creds dialog."""
+
+    @defer.inlineCallbacks
+    def setUp(self):
+        """Set the different tests."""
+        yield super(RequestProxyAuthTestCase, self).setUp()
+        self.wc = webclient.webclient_factory()
+        self.addCleanup(self.wc.shutdown)
+        self.domain = 'domain'
+        self.retry = False
+        self.creds = dict(username='username', password='password')
+
+        self.keyring = FakeKeyring(self.creds)
+        self.patch(keyring, 'Keyring', self.keyring)
+
+        self.spawn_return_code = USER_SUCCESS
+
+        def fake_spawn_process(args):
+            """Fake spawning a process."""
+            if isinstance(self.spawn_return_code, Exception):
+                return defer.fail(self.spawn_return_code)
+            return defer.succeed(self.spawn_return_code)
+
+        self.patch(webclient.common, 'spawn_program', fake_spawn_process)
+
+    def test_spawn_error(self):
+        """Test the case when we cannot spawn the process."""
+        self.spawn_return_code = Exception()
+        self.failUnlessFailure(self.wc.request_proxy_auth_credentials(
+                                         self.domain, True),
+                                         webclient.WebClientError)
+
+    @defer.inlineCallbacks
+    def test_creds_acquired(self):
+        """Test the case in which we do get the creds."""
+        got_creds = yield self.wc.request_proxy_auth_credentials(self.domain,
+                                                           self.retry)
+        self.assertTrue(got_creds, 'Return true when creds are present.')
+        self.assertEqual(self.wc.proxy_username, self.creds['username'])
+        self.assertEqual(self.wc.proxy_password, self.creds['password'])
+
+    def test_creds_acquired_keyring_error(self):
+        """Test the case in which we cannot access the keyring."""
+        self.keyring.creds = Exception()
+        self.failUnlessFailure(self.wc.request_proxy_auth_credentials(
+                                         self.domain, self.retry),
+                                         webclient.WebClientError)
+
+    @defer.inlineCallbacks
+    def test_creds_none(self):
+        """Test the case in which we got None from the keyring."""
+        self.keyring.creds = None
+        got_creds = yield self.wc.request_proxy_auth_credentials(self.domain,
+                                                           self.retry)
+        self.assertFalse(got_creds, 'Return false when creds are not present.')
+
+    def test_user_cancelation(self):
+        """Test the case in which the user cancels."""
+        self.spawn_return_code = USER_CANCELLATION
+        got_creds = yield self.wc.request_proxy_auth_credentials(self.domain,
+                                                           self.retry)
+        self.assertFalse(got_creds, 'Return true when user cancels.')
+
+    def test_exception_error(self):
+        """Test the case in which something bad happened."""
+        self.spawn_return_code = EXCEPTION_RAISED
+        got_creds = yield self.wc.request_proxy_auth_credentials(self.domain,
+                                                           self.retry)
+        self.assertFalse(got_creds, 'Return true when user cancels.')