Merge lp:~pfalcon/linaro-license-protection/crowd-auth into lp:~linaro-automation/linaro-license-protection/trunk

[Paul Sokolovsky]

These are changes to switch l-l-p to Crowd API for group access authorization. Expectably, I didn't tear off old "OpenID teams" code, but rather went for adding new Crowd authz code, and allow app to be configured for which of them to use, allowing seamless transition and reverting if needed.

Well, to support switching to another authz method at all, and such "pluggable" architecture in particular, it of course first took some refactoring on existing codebase.

Actually, I submit this MRs with just refactoring existing setup, which doesn't change current authz method. That's to get early comments, while I'm working on Crowd authz "plugin" specifically.

Suggested review mode is to look at the commit individually.

[Milo Casagrande (milo)]

Paul,

thanks for kick-starting this work!
Overall the work looks great, and the refactoring too.

+class ViewHelpersTests(BaseServeViewTest):
+ def test_auth_group_error(self):
+ groups = ["linaro", "batman", "catwoman", "joker"]
+ request = Mock()
+ request.path = "mock_path"
+ response = views.group_auth_failed_response(request, groups)
+ self.assertIsNotNone(response)
+ self.assertTrue(isinstance(response, HttpResponse))
+ self.assertContains(response,
+ "You need to be the member of one of the linaro batman, catwoman "
+ "or joker teams in Launchpad.",
+ status_code=403)

Not something I'm really against, but I would be more interested in testing only
the status code I get, not the kind of "string" I will receive (to me that looks
already more than an unit test). I would test something like that:

self.failUnlessEqual(response.status_code, 403)

(not sure that that is working code though)

+def group_auth_failed_response(request, auth_groups):
+ """Construct a nice response detailing list of auth groups that
+ will allow access to the requested file."""
+ if len(auth_groups) > 1:
+ groups_string = "one of the " + auth_groups.pop(0) + " "
+ if len(auth_groups) > 1:
+ groups_string += ", ".join(auth_groups[0:-1])
+
+ groups_string += " or " + auth_groups[-1] + " teams"
+ else:
+ groups_string = "the " + auth_groups[0] + " team"

I personally try to avoid concatenating strings in that way. Why not something like:

if len(auth_group) > 1:
    groups_string = "one of the %s" % auth_groups.pop(0)
    if len(auth_groups) > 1:
        groups_string += (" %s" % ", ".join(auth_groups[0:-1])).rstrip()
    groups_string += " or %s teams" % auth_groups[-1]
else:
    groups_string = "the %s team" % auth_groups[0]

I prefer it since it is clearer what you are trying to achieve and you can easily spot spurious white spaces.

I'm approving since what I listed are not really blockers, and functionalities are OK, but if you feel to apply them, do while merging.

Another thing I noticed, but not related to this code review: we are missing a license for all the code in linaro-license-protection, and all license header too. We should probably apply one at one point.

review: Approve

[Georgy Redkozubov (gesha)]

Looks good.
+1 to Milo's comment on tests, afaics, you've missed a ',' in comparison string on line 202. Should be
202 + "You need to be the member of one of the linaro, batman, catwoman "

Otherwise approved.

review: Approve

[Paul Sokolovsky (pfalcon)]

> Not something I'm really against, but I would be more interested in testing only
the status code I get, not the kind of "string" I will receive (to me that looks
already more than an unit test). I would test something like that:

Well, if looking in more detail, what I did is factored out that string construction out of OpenIdAuth class. The was also test_openid_auth which exactly did that string test. Consequently, I moved that string test where its new routine belongs. I didn't add anything, I don't feel comfortable removing anything either - my idea was to preserve original semantics and tests which cover it.

> I personally try to avoid concatenating strings in that way.

Again, routine wasn't written by me ;-)

[Paul Sokolovsky (pfalcon)]

> afaics, you've missed a ',' in comparison string on line

Ok, let me fire up bzr blame. Well, Englishman can't be wrong with English usage - it was done by James ;-).

And of course, I'm in principle all for fixing side issues, but: 1) They may need more consideration (in this case, both test "simplification" and grammar), and 2) They should be done separately, to not skew topic branch context.

Re: 2), if we used git, I could just apply quick fix to main branch, and rebase mine, but with bzr, it just better wait in queue (to not introduce twisted merges).

[lp:~pfalcon/linaro-license-protection/crowd-auth]

195. By Paul Sokolovsky on 2013-05-29

Implement dynamic loading of settings.GROUP_AUTH_MODULE properly.

__import__() has peculiar behavior, so importlib.import_module() instead.
Caveat: Python 2.7 only.

196. By Paul Sokolovsky on 2013-05-30

Add "auth-groups" to list of known fields.

Mark "openid-launchpad-teams" as deprecated.

197. By Paul Sokolovsky on 2013-05-30

Simplify logic in BuildInfo.get().

198. By Paul Sokolovsky on 2013-05-30

Consistently handle "openid-launchpad-teams" -> "auth-groups" field rename.

Map old field name to new during parsing. Consistently use "auth-groups"
everywhere in the code.

199. By Paul Sokolovsky on 2013-05-30

Add parsing test for new "auth-groups" field.

200. By Paul Sokolovsky on 2013-05-30

Update README (also includes BUILD-INFO.txt spec) for latest changes.

In particular, format version is bumped to 0.5 (we should have 1.0 soon).

201. By Paul Sokolovsky on 2013-05-30

Rename openid_auth => group_auth_openid, for all auth mods to sort together.

202. By Paul Sokolovsky on 2013-06-03

Log auth atempt against Launchpad teams.

For helping with group migration.

203. By Paul Sokolovsky on 2013-06-03

PEP8 fixes.

204. By Paul Sokolovsky on 2013-06-03

Remove file which is regenerated from scratch every time.

205. By Paul Sokolovsky on 2013-06-03

Add Crowd API group auth plugin.

206. By Paul Sokolovsky on 2013-06-03

Typos/grammar.

207. By Paul Sokolovsky on 2013-06-03

Improve docstring for _set().

208. By Paul Sokolovsky on 2013-06-03

We use Auth-Groups directive in this file, so it's format 0.5 .

209. By Paul Sokolovsky on 2013-06-03

Applied isdisjoint() "optimization", with credit to Milo.

210. By Paul Sokolovsky on 2013-06-03

write_from_array(): Write 0.5 format files.

211. By Paul Sokolovsky on 2013-06-04

Handle errors during group auth properly.

212. By Paul Sokolovsky on 2013-06-04

First step toward normal logging setup.

213. By Paul Sokolovsky on 2013-06-04

Fix exception logging.

214. By Paul Sokolovsky on 2013-06-04

More test fixes for 0.5 format version.

215. By Paul Sokolovsky on 2013-06-04

Pyflakes fixes.

Unmerged revisions

=== modified file 'README'
--- README	2013-02-15 09:45:08 +0000
+++ README	2013-06-03 11:47:27 +0000
@@ -16,7 +16,9 @@
  * makes use of the regular directory structure on disk
  * click through licensing with each file potentially having a different
    license/theme
- * openid restrictions (by Launchpad teams)
+ * group-based access authorization restrictions (using group information
+   from external services, currently OpenID with team extensions is
+   (as used by Launchpad.net) and Atlassian Crowd are supported).
  * post-processing of all uploads (a script that manages uploads)
  * per-IP pass-through (for automatic services like a test framework)
 
@@ -46,12 +48,12 @@
 syntax).
 
 BUILD-INFO.txt file will allow one to specify the access restrictions
-(such as click-through licensing and OpenID-restrictions) and influence
+(such as click-through licensing and required groups) and influence
 the display (such as license-theme) of a particular build.
 
-WARNING: if you want a build type to be protected by OpenID, you need to
-ensure that the appropriate team is added to the list of django groups
-in the database.  Only django admins can do that.
+WARNING: if you want a build to be protected by OpenID-based groups, you
+need to ensure that the appropriate team is added to the list of django
+groups in the database. Only django admins can do that.
 
 Next step is to ensure that
 
@@ -108,15 +110,15 @@
     a placeholder and will be ignored. To be added later by build services?
  * License-Type: (required)
     open - Open builds. No license page is displayed.
-    protected - EULA protected builds. If 'OpenID-Launchpad-Teams' is defined
-      then OpenID protection is used, otherwise simple Accept/Decline license
+    protected - EULA protected builds. If 'Auth-Groups' is defined
+      then group authorization is used, otherwise simple Accept/Decline license
       page is displayed before accessing protected files.
  * Theme: (required only if License-Type is 'protected')
     Acceptable values are: stericsson, samsung.
     Theme name for selecting proper theming on download and license pages.
- * OpenID-Launchpad-Teams: (optional)
-    LP team names, members of which are allowed to access protected files. No
-    OpenID protection if absent.
+ * Auth-Groups: (optional)
+    Names of groups, members of which are allowed to access protected files.
+    No group-based protection if absent.
  * Collect-User-Data: (optional)
     Acceptable values are: yes, no.
     Defaults to 'no' if not present. If the field is set to 'yes' then
@@ -131,10 +133,20 @@
 - Field names are case insensitive.
 - Fields order doesn't matter, except 'Files-Pattern'
 
+History of BUILD-INFO.txt format changes
+........................................
+
+Changes from format version 0.1 to 0.5:
+
+1. Field "OpenID-Launchpad-Teams" is deprecated and renamed to
+"Auth-Groups". Old name is supported for archived builds, however
+it may lead to warnings, and at later time to errors, during
+publishing new builds, so client usage should be upgraded.
+
 BUILD-INFO.txt example:
 .......................
 
-Format-Version: 0.1
+Format-Version: 0.5
 
 Files-Pattern: *.img, *.tar.bz2
 Build-Name: landing-snowball
 
=== modified file 'license_protected_downloads/buildinfo.py'
--- license_protected_downloads/buildinfo.py	2013-05-29 13:41:12 +0000
+++ license_protected_downloads/buildinfo.py	2013-06-03 11:47:27 +0000
@@ -14,8 +14,11 @@
         self.file_info_array = [{}]
         self.fields_defined = [
                 "format-version", "files-pattern", "build-name", "theme",
-                "license-type", "openid-launchpad-teams", "collect-user-data",
-                "license-text"]
+                "license-type", "auth-groups", "collect-user-data",
+                "license-text",
+                # Deprecated
+                "openid-launchpad-teams",
+                ]
         self.full_file_name = fn
         self.search_path = self.get_search_path(fn)
         self.fname = os.path.basename(fn)
@@ -40,6 +43,7 @@
                 os.path.join(cls.get_search_path(path), "BUILD-INFO.txt"))
 
     def _set(self, key, value):
+        "key: file pattern, value: list of dicts of field/val pairs"
         if key in self.build_info_array[self.index]:
             # A repeated key indicates we have found another chunk of
             # build-info
@@ -91,10 +95,7 @@
         if index > self.max_index:
             return False
         block = self.file_info_array[index]
-        for key in block:
-            if field == key:
-                return block[field]
-        return False
+        return block.get(field, False)
 
     def parseLine(self, line):
         values = line.split(":", 1)
@@ -108,6 +109,9 @@
                 raise IncorrectDataFormatException(
                         "Field '%s' not allowed." % field)
             else:
+                # Rename any deprecated field names to new names
+                field_renames = {"openid-launchpad-teams": "auth-groups"}
+                field = field_renames.get(field, field)
                 return {field: value}
 
     def isValidField(self, field_name):
 
=== added file 'license_protected_downloads/group_auth_crowd.py'
--- license_protected_downloads/group_auth_crowd.py	1970-01-01 00:00:00 +0000
+++ license_protected_downloads/group_auth_crowd.py	2013-06-03 11:47:27 +0000
@@ -0,0 +1,52 @@
+import logging
+
+from django.conf import settings
+from django.shortcuts import redirect
+
+import requests
+
+
+log = logging.getLogger(__file__)
+
+
+def upgrade_requests():
+    """Ubuntu 12.04 comes with pretty old requests version. Add convenience
+    methods of newer versions straight to it, to avoid client-side
+    workarounds."""
+    if "json" not in dir(requests.models.Response):
+        def patchy_json(self):
+            import json
+            return json.loads(self.content)
+        requests.models.Response.json = patchy_json
+
+# We monkey-patch requests module on first load
+upgrade_requests()
+
+
+class GroupAuthError(Exception):
+    pass
+
+
+def process_group_auth(request, required_groups):
+    if not required_groups:
+        return True
+    if not request.user.is_authenticated():
+        # Force OpenID login
+        return redirect(settings.LOGIN_URL + "?next=" + request.path)
+
+    log.warn("Authenticating using Crowd API: %s",
+             request.user.username)
+
+    auth = (settings.ATLASSIAN_CROWD_API_USERNAME,
+            settings.ATLASSIAN_CROWD_API_PASSWORD)
+    params = {"username": request.user.username}
+    r = requests.get(settings.ATLASSIAN_CROWD_API_URL
+                     + "/user/group/nested.json", params=params, auth=auth)
+    if r.status_code != 200:
+        raise GroupAuthError(r.status_code)
+    data = r.json()
+    user_groups = set([x["name"] for x in data["groups"]])
+    for g in required_groups:
+        if g in user_groups:
+            return True
+    return False
 
=== renamed file 'license_protected_downloads/openid_auth.py' => 'license_protected_downloads/group_auth_openid.py'
--- license_protected_downloads/openid_auth.py	2012-08-23 13:37:29 +0000
+++ license_protected_downloads/group_auth_openid.py	2013-06-03 11:47:27 +0000
@@ -1,16 +1,21 @@
+import logging
+
 from django.conf import settings
-from django.shortcuts import redirect, render_to_response
+from django.shortcuts import redirect
 from django.contrib.auth.models import Group
-import bzr_version
-
-
-class OpenIDAuth:
-
-    @classmethod
-    def process_openid_auth(cls, request, openid_teams):
+
+
+log = logging.getLogger(__file__)
+
+
+def process_group_auth(request, openid_teams):
+        """Returns True if access granted, False if denied and Response
+        object if not enough authentication information available and
+        user should authenticate first (by following that Response).
+        """
 
         if not openid_teams:
-            return None
+            return True
 
         for openid_team in openid_teams:
             Group.objects.get_or_create(name=openid_team)
@@ -19,28 +24,10 @@
             # Force OpenID login
             return redirect(settings.LOGIN_URL + "?next=" + request.path)
 
+        log.warn("Authenticating using Launchpad OpenID Teams: %s",
+                 request.user.username)
         for group in request.user.groups.all():
             if group.name in openid_teams:
-                return None
-
-        # Construct a nice string of openid teams that will allow access to
-        # the requested file
-        if len(openid_teams) > 1:
-            teams_string = "one of the " + openid_teams.pop(0) + " "
-            if len(openid_teams) > 1:
-                teams_string += ", ".join(openid_teams[0:-1])
-
-            teams_string += " or " + openid_teams[-1] + " teams"
-        else:
-            teams_string = "the " + openid_teams[0] + " team"
-
-        response = render_to_response(
-            'openid_forbidden_template.html',
-            {'login': settings.LOGIN_URL + "?next=" + request.path,
-             'authenticated': request.user.is_authenticated(),
-             'openid_teams': teams_string,
-             'revno': bzr_version.get_my_bzr_revno(),
-             })
-
-        response.status_code = 403
-        return response
+                return True
+
+        return False
 
=== modified file 'license_protected_downloads/tests/__init__.py'
--- license_protected_downloads/tests/__init__.py	2013-04-19 12:13:03 +0000
+++ license_protected_downloads/tests/__init__.py	2013-06-03 11:47:27 +0000
@@ -11,6 +11,7 @@
     FileViewTests,
     HowtoViewTests,
     ViewTests,
+    ViewHelpersTests,
     )
 from license_protected_downloads.tests.test_openid_auth import TestOpenIDAuth
 from license_protected_downloads.tests.test_custom_commands \
@@ -32,4 +33,5 @@
     'TestPep8': TestPep8,
     'TestPyflakes': TestPyflakes,
     'ViewTests': ViewTests,
+    'ViewHelpersTests': ViewHelpersTests,
 }
 
=== modified file 'license_protected_downloads/tests/test_buildinfo.py'
--- license_protected_downloads/tests/test_buildinfo.py	2013-04-19 12:13:03 +0000
+++ license_protected_downloads/tests/test_buildinfo.py	2013-06-03 11:47:27 +0000
@@ -27,7 +27,16 @@
         self.assertEquals(build_info.getInfoForFile(),
             [{'build-name': 'landing-protected',
               'license-type': 'protected',
-              'openid-launchpad-teams': 'linaro'}])
+              'auth-groups': 'linaro'}])
+
+    def test_apply_to_dir_auth_groups_field(self):
+        dir_path = THIS_DIRECTORY + \
+            '/testserver_root/build-info/subdir2'
+        build_info = BuildInfo(dir_path)
+        self.assertEquals(build_info.getInfoForFile(),
+            [{'build-name': 'landing-protected',
+              'license-type': 'protected',
+              'auth-groups': 'linaro'}])
 
     def test_apply_to_nonexistent_file(self):
         with self.assertRaises(IOError):
@@ -47,8 +56,8 @@
         value = "notempty"
         build_info = BuildInfo(self.buildinfo_file_path)
         for pair in build_info.file_info_array:
-            if "openid-launchpad-teams" in pair:
-                value = pair["openid-launchpad-teams"]
+            if "auth-groups" in pair:
+                value = pair["auth-groups"]
 
         self.assertFalse(value)
 
 
=== modified file 'license_protected_downloads/tests/test_openid_auth.py'
--- license_protected_downloads/tests/test_openid_auth.py	2012-08-23 13:37:29 +0000
+++ license_protected_downloads/tests/test_openid_auth.py	2013-06-03 11:47:27 +0000
@@ -2,7 +2,7 @@
 from django.http import HttpResponse
 from mock import Mock, patch
 
-from license_protected_downloads.openid_auth import OpenIDAuth
+from license_protected_downloads import group_auth_openid as openid_auth
 
 
 class TestOpenIDAuth(TestCase):
@@ -27,14 +27,14 @@
     def test_check_team_membership_no_teams(self):
         mock_request = self.make_mock_request()
         openid_teams = []
-        self.assertIsNone(
-            OpenIDAuth.process_openid_auth(mock_request, openid_teams))
+        self.assertTrue(
+            openid_auth.process_group_auth(mock_request, openid_teams))
 
     def test_check_team_membership_no_authentication(self):
         mock_request = self.make_mock_request()
         mock_request.user.is_authenticated.return_value = False
         openid_teams = ["linaro"]
-        response = OpenIDAuth.process_openid_auth(mock_request, openid_teams)
+        response = openid_auth.process_group_auth(mock_request, openid_teams)
         self.assertIsNotNone(response)
         self.assertTrue(isinstance(response, HttpResponse))
         self.assertEquals(302, response.status_code)
@@ -45,8 +45,8 @@
         mock_request.user.groups.all.return_value = [
             self.make_mock_group("linaro")]
         openid_teams = ["linaro"]
-        response = OpenIDAuth.process_openid_auth(mock_request, openid_teams)
-        self.assertIsNone(response)
+        response = openid_auth.process_group_auth(mock_request, openid_teams)
+        self.assertTrue(response)
 
     def test_check_no_team_membership_authed(self):
         mock_request = self.make_mock_request()
@@ -54,12 +54,8 @@
         mock_request.user.groups.all.return_value = [
             self.make_mock_group("another-group")]
         openid_teams = ["linaro"]
-        response = OpenIDAuth.process_openid_auth(mock_request, openid_teams)
-        self.assertIsNotNone(response)
-        self.assertTrue(isinstance(response, HttpResponse))
-        self.assertContains(response,
-            "You need to be the member of the linaro team in Launchpad.",
-            status_code=403)
+        response = openid_auth.process_group_auth(mock_request, openid_teams)
+        self.assertFalse(response)
 
     def test_check_no_team_membership_authed_multi_teams(self):
         mock_request = self.make_mock_request()
@@ -67,13 +63,8 @@
         mock_request.user.groups.all.return_value = [
             self.make_mock_group("another-group")]
         openid_teams = ["linaro", "batman", "catwoman", "joker"]
-        response = OpenIDAuth.process_openid_auth(mock_request, openid_teams)
-        self.assertIsNotNone(response)
-        self.assertTrue(isinstance(response, HttpResponse))
-        self.assertContains(response,
-            "You need to be the member of one of the linaro batman, catwoman "
-            "or joker teams in Launchpad.",
-            status_code=403)
+        response = openid_auth.process_group_auth(mock_request, openid_teams)
+        self.assertFalse(response)
 
     @patch("django.contrib.auth.models.Group.objects.get_or_create")
     def test_auto_adding_groups(self, get_or_create_mock):
@@ -83,7 +74,7 @@
             self.make_mock_group("another-group")]
 
         openid_teams = ["linaro", "linaro-infrastructure"]
-        OpenIDAuth.process_openid_auth(mock_request, openid_teams)
+        openid_auth.process_group_auth(mock_request, openid_teams)
 
         expected = [
             ((), {'name': 'linaro'}), ((), {'name': 'linaro-infrastructure'})]
 
=== modified file 'license_protected_downloads/tests/test_splicebuildinfos.py'
--- license_protected_downloads/tests/test_splicebuildinfos.py	2013-04-19 12:13:03 +0000
+++ license_protected_downloads/tests/test_splicebuildinfos.py	2013-06-03 11:47:27 +0000
@@ -20,16 +20,16 @@
             'test-protected.txt':
             [{'license-type': 'protected',
               'build-name': 'landing-protected',
-              'openid-launchpad-teams': 'linaro'}],
+              'auth-groups': 'linaro'}],
             'test-protected-2.txt':
             [{'license-type': 'protected',
               'build-name': 'landing-protected',
-              'openid-launchpad-teams': 'linaro'}]}
+              'auth-groups': 'linaro'}]}
 
         result = {'test-protected.txt, test-protected-2.txt':
                   [{'license-type': 'protected',
                     'build-name': 'landing-protected',
-                    'openid-launchpad-teams': 'linaro'}]}
+                    'auth-groups': 'linaro'}]}
 
         build_info_res = SpliceBuildInfos.merge_duplicates(build_info_dict)
         self.assertEquals(build_info_res, result)
 
=== modified file 'license_protected_downloads/tests/test_views.py'
--- license_protected_downloads/tests/test_views.py	2013-04-02 09:58:42 +0000
+++ license_protected_downloads/tests/test_views.py	2013-06-03 11:47:27 +0000
@@ -2,6 +2,7 @@
 
 from django.conf import settings
 from django.test import Client, TestCase
+from django.http import HttpResponse
 import hashlib
 import os
 import tempfile
@@ -10,6 +11,8 @@
 import urlparse
 import json
 
+from mock import Mock
+
 from license_protected_downloads import bzr_version
 from license_protected_downloads.buildinfo import BuildInfo
 from license_protected_downloads.config import INTERNAL_HOSTS
@@ -19,6 +22,7 @@
 from license_protected_downloads.views import _process_include_tags
 from license_protected_downloads.views import _sizeof_fmt
 from license_protected_downloads.views import is_same_parent_dir
+from license_protected_downloads import views
 
 THIS_DIRECTORY = os.path.dirname(os.path.abspath(__file__))
 TESTSERVER_ROOT = os.path.join(THIS_DIRECTORY, "testserver_root")
@@ -903,5 +907,19 @@
             self.assertEqual(response.status_code, 200)
 
 
+class ViewHelpersTests(BaseServeViewTest):
+    def test_auth_group_error(self):
+        groups = ["linaro", "batman", "catwoman", "joker"]
+        request = Mock()
+        request.path = "mock_path"
+        response = views.group_auth_failed_response(request, groups)
+        self.assertIsNotNone(response)
+        self.assertTrue(isinstance(response, HttpResponse))
+        self.assertContains(response,
+            "You need to be the member of one of the linaro batman, catwoman "
+            "or joker teams in Launchpad.",
+            status_code=403)
+
+
 if __name__ == '__main__':
     unittest.main()
 
=== added directory 'license_protected_downloads/tests/testserver_root/build-info/subdir2'
=== added file 'license_protected_downloads/tests/testserver_root/build-info/subdir2/BUILD-INFO.txt'
--- license_protected_downloads/tests/testserver_root/build-info/subdir2/BUILD-INFO.txt	1970-01-01 00:00:00 +0000
+++ license_protected_downloads/tests/testserver_root/build-info/subdir2/BUILD-INFO.txt	2013-06-03 11:47:27 +0000
@@ -0,0 +1,7 @@
+Format-Version: 0.1
+
+
+Files-Pattern: *
+Build-Name: landing-protected
+License-Type: protected
+Auth-Groups: linaro
 
=== added file 'license_protected_downloads/tests/testserver_root/build-info/subdir2/testfile.txt'
=== removed file 'license_protected_downloads/tests/testserver_root/build-info/write-test/BUILD-INFO.txt'
--- license_protected_downloads/tests/testserver_root/build-info/write-test/BUILD-INFO.txt	2013-04-19 12:13:03 +0000
+++ license_protected_downloads/tests/testserver_root/build-info/write-test/BUILD-INFO.txt	1970-01-01 00:00:00 +0000
@@ -1,42 +0,0 @@
-Format-Version: 0.1
-
-Files-Pattern: *openid*
-license-type: protected
-build-name: landing-protected
-openid-launchpad-teams: linaro
-
-Files-Pattern: *panda*
-license-type: open
-build-name: landing-panda
-
-Files-Pattern: *.txt
-license-type: protected
-build-name: landing-protected
-openid-launchpad-teams: 
-theme: stericsson
-collect-user-data: yes
-license-text: <p>IMPORTANT — PLEASE READ THE FOLLOWING AGREEMENT CAREFULLY.</p>
- <p>
-   THIS IS A LEGALLY BINDING AGREEMENT
- </p>
-
-Files-Pattern: *origen*
-theme: samsung
-license-type: protected
-build-name: landing-origen
-license-text: <p>IMPORTANT — PLEASE READ THE FOLLOWING AGREEMENT CAREFULLY.</p>
- <p>
-  THIS IS A LEGALLY BINDING AGREEMENT BETWEEN YOU, an individual or a
-  legal entity, (“LICENSEE”) AND HAL 1000.
- </p>
-
-Files-Pattern: *snowball*
-theme: stericsson
-license-type: protected
-build-name: landing-snowball
-license-text: <p>IMPORTANT — PLEASE READ THE FOLLOWING AGREEMENT CAREFULLY.</p>
- <p>
-  THIS IS A LEGALLY BINDING AGREEMENT BETWEEN YOU, an individual or a
-  legal entity, (“LICENSEE”) AND ME, THE TEST SERVER.
- </p>
-
 
=== modified file 'license_protected_downloads/views.py'
--- license_protected_downloads/views.py	2013-05-09 11:15:33 +0000
+++ license_protected_downloads/views.py	2013-06-03 11:47:27 +0000
@@ -23,7 +23,9 @@
 from buildinfo import BuildInfo, IncorrectDataFormatException
 from render_text_files import RenderTextFiles
 from models import License
-from openid_auth import OpenIDAuth
+# Load group auth "plugin" dynamically
+import importlib
+group_auth = importlib.import_module(settings.GROUP_AUTH_MODULE)
 from BeautifulSoup import BeautifulSoup
 import config
 
@@ -242,7 +244,7 @@
         license_type = build_info.get("license-type")
         license_text = build_info.get("license-text")
         theme = build_info.get("theme")
-        openid_teams = build_info.get("openid-launchpad-teams")
+        auth_groups = build_info.get("auth-groups")
         max_index = build_info.max_index
     elif os.path.isfile(open_eula_path):
         return "OPEN"
@@ -256,7 +258,7 @@
         license_type = "protected"
         license_file = os.path.join(settings.PROJECT_ROOT,
                                     'templates/licenses/' + theme + '.txt')
-        openid_teams = False
+        auth_groups = False
         with open(license_file, "r") as infile:
             license_text = infile.read()
     elif _check_special_eula(path):
@@ -264,7 +266,7 @@
         license_type = "protected"
         license_file = os.path.join(settings.PROJECT_ROOT,
                                     'templates/licenses/' + theme + '.txt')
-        openid_teams = False
+        auth_groups = False
         with open(license_file, "r") as infile:
             license_text = infile.read()
     elif _check_special_eula(base_path + "/*"):
@@ -279,7 +281,7 @@
             return "OPEN"
 
         # File matches a license, isn't open.
-        if openid_teams:
+        if auth_groups:
             return "OPEN"
         elif license_text:
             for i in range(max_index):
@@ -392,6 +394,30 @@
     return response
 
 
+def group_auth_failed_response(request, auth_groups):
+    """Construct a nice response detailing list of auth groups that
+    will allow access to the requested file."""
+    if len(auth_groups) > 1:
+        groups_string = "one of the " + auth_groups.pop(0) + " "
+        if len(auth_groups) > 1:
+            groups_string += ", ".join(auth_groups[0:-1])
+
+        groups_string += " or " + auth_groups[-1] + " teams"
+    else:
+        groups_string = "the " + auth_groups[0] + " team"
+
+    response = render_to_response(
+        'openid_forbidden_template.html',
+        {'login': settings.LOGIN_URL + "?next=" + request.path,
+         'authenticated': request.user.is_authenticated(),
+         'openid_teams': groups_string,
+         'revno': bzr_version.get_my_bzr_revno(),
+         })
+
+    response.status_code = 403
+    return response
+
+
 def file_server(request, path):
     """Serve up a file / directory listing or license page as required"""
     path = iri_to_uri(path)
@@ -415,16 +441,19 @@
             return HttpResponseForbidden(
                 "Error parsing BUILD-INFO.txt")
 
-        launchpad_teams = build_info.get("openid-launchpad-teams")
-        if launchpad_teams:
-            launchpad_teams = launchpad_teams.split(",")
-            launchpad_teams = [team.strip() for team in launchpad_teams]
+        auth_groups = build_info.get("auth-groups")
+        if auth_groups:
+            auth_groups = auth_groups.split(",")
+            auth_groups = [g.strip() for g in auth_groups]
             # TODO: use logging!
-            print "Checking membership in OpenID groups:", launchpad_teams
-            openid_response = OpenIDAuth.process_openid_auth(
-                request, launchpad_teams)
-            if openid_response:
-                return openid_response
+            print "Checking membership in auth groups:", auth_groups
+            response = group_auth.process_group_auth(request, auth_groups)
+            if response == False:
+                return group_auth_failed_response(request, auth_groups)
+            elif response == True:
+                pass
+            else:
+                return response
 
     if target_type == "dir":
         # Generate a link to the parent directory (if one exists)
 
=== modified file 'settings.py'
--- settings.py	2013-02-26 19:38:30 +0000
+++ settings.py	2013-06-03 11:47:27 +0000
@@ -124,6 +124,10 @@
 LOGIN_URL = '/linaro-openid/login/'
 LOGIN_REDIRECT_URL = '/'
 
+# Name of "plugin" module to use for group authentication
+GROUP_AUTH_MODULE = 'license_protected_downloads.group_auth_openid'
+
+# Config for django_openid_auth.auth.OpenIDBackend
 OPENID_CREATE_USERS = True
 OPENID_SSO_SERVER_URL = 'https://login.launchpad.net/'
 OPENID_UPDATE_DETAILS_FROM_SREG = True
@@ -132,6 +136,11 @@
 OPENID_USE_AS_ADMIN_LOGIN = True
 OPENID_USE_EMAIL_FOR_USERNAME = True
 
+ATLASSIAN_CROWD_API_URL = \
+    "https://login.linaro.org:8443/crowd/rest/usermanagement/1"
+ATLASSIAN_CROWD_API_USERNAME = None
+ATLASSIAN_CROWD_API_PASSWORD = None
+
 # A sample logging configuration. The only tangible logging
 # performed by this configuration is to send an email to
 # the site admins on every HTTP 500 error.