Merge lp:~vorlon/summit/oauth2-support into lp:summit

[Steve Langasek]

Preliminary support for oauth2. This pulls in a new django module dependency, and also only works if you also register and add in oauth2 keys, which you need to get from your oauth2 provider.

[lp:~vorlon/summit/oauth2-support]

226. By Steve Langasek on 2014-05-18

Replace another reference to /openid/login with login_url

Unmerged revisions

226. By Steve Langasek on 2014-05-18

Replace another reference to /openid/login with login_url

225. By Steve Langasek on 2014-04-02

Initial support for Debian SSO

224. By Steve Langasek on 2014-04-01

Simplify the oauth2 support

we don't actually need separate url handlers, we can just include the
upstream ones and set LOGIN_URL to whichever provider we want (e.g.,
/login/google-oauth2) in our individual django app. If someone really
wants to have multiple auth providers from the same app, they can figure
that out on their own, but currently it doesn't look like an interesting use
case.

223. By Steve Langasek on 2014-04-01

Make the 'login' link on the navbar configurable via LOGIN_URL in settings.

222. By Steve Langasek on 2014-04-01

Initial support for oauth2 (using the Google backend for testing)

=== modified file 'requirements.txt'
--- requirements.txt	2014-05-04 14:00:34 +0000
+++ requirements.txt	2014-05-18 00:12:52 +0000
@@ -12,6 +12,7 @@
 bzr>=2.4b
 distribute==0.6.10
 django-openid-auth==0.5
+python-social-auth
 # psycopg2==2.0.13 - only needed for production like environments
 python-openid==2.2.4
 pytz==2010b

=== modified file 'summit/common/context_processors.py'
--- summit/common/context_processors.py	2013-03-07 01:48:40 +0000
+++ summit/common/context_processors.py	2014-05-18 00:12:52 +0000
@@ -38,6 +38,10 @@
     return {'login_next': request.get_full_path()}
 
 
+def login_url(request):
+    return {'login_url': settings.LOGIN_URL}
+
+
 def summit_version(request):
     """
     add The Summit Scheduler version to template context processor.

=== modified file 'summit/common/templates/base.html'
--- summit/common/templates/base.html	2013-08-28 10:37:08 +0000
+++ summit/common/templates/base.html	2014-05-18 00:12:52 +0000
@@ -35,7 +35,7 @@
             {% endif %}
             <a class="top-login-item" href="{% url logout %}" title="Log Out: {{ user.username }}">Log out</a>
     {% else %}
-        <a class="top-login-item" href="/openid/login/?next={{login_next}}" title="Log In">Log in</a>
+        <a class="top-login-item" href="{{login_url}}?next={{login_next}}" title="Log In">Log in</a>
     {% endif %}
 {% endblock %}
 {% block main_nav_links %}

=== added file 'summit/common/templates/done.html'
--- summit/common/templates/done.html	1970-01-01 00:00:00 +0000
+++ summit/common/templates/done.html	2014-05-18 00:12:52 +0000
@@ -0,0 +1,10 @@
+{% extends "website_base.html" %}
+{% load url from future %}
+
+{% block title %}Logged In{% endblock %}
+
+{% block content %}
+  <p>
+    You are logged in as {{ user.username }}!  (<a href="/logout/">Logout</a>)
+  </p>
+{% endblock %}

=== added file 'summit/common/templates/login.html'
--- summit/common/templates/login.html	1970-01-01 00:00:00 +0000
+++ summit/common/templates/login.html	2014-05-18 00:12:52 +0000
@@ -0,0 +1,13 @@
+{% extends "website_base.html" %}
+{% load url from future %}
+
+{% block title %}Login{% endblock %}
+
+{% block content %}
+  <form action="{% url 'social:begin' 'google-oauth2' %}" method="post">
+    {% csrf_token %}
+    <div>
+      <input type="submit" value="Log in through Google"/>
+    </div>
+  </form>
+{% endblock %}

=== modified file 'summit/schedule/templates/schedule/actions.html'
--- summit/schedule/templates/schedule/actions.html	2013-05-09 23:50:37 +0000
+++ summit/schedule/templates/schedule/actions.html	2014-05-18 00:12:52 +0000
@@ -38,7 +38,7 @@
     {% endif %}
 {% else %}
     {% if not user.is_authenticated %}
-        <p><a href="/openid/login?next={{login_next}}">Log in now</a></p>
+        <p><a href="{{login_url}}?next={{login_next}}">Log in now</a></p>
     {% endif %}
 {% endifequal %}
 

=== modified file 'summit/settings.py'
--- summit/settings.py	2013-11-15 14:54:49 +0000
+++ summit/settings.py	2014-05-18 00:12:52 +0000
@@ -95,10 +95,13 @@
     "django.contrib.messages.context_processors.messages",
     "common.context_processors.next_summit",
     "common.context_processors.login_redirect",
+    "common.context_processors.login_url",
     "common.context_processors.url_base",
     "common.context_processors.summit_version",
     "common.context_processors.site_menu",
     "common.context_processors.track_display_name",
+    "social.apps.django_app.context_processors.backends",
+    "social.apps.django_app.context_processors.login_redirect",
 )
 
 MIDDLEWARE_CLASSES = (
@@ -123,6 +126,7 @@
     'django.contrib.messages',
     'django.contrib.sessions',
     'django_openid_auth',
+    'social.apps.django_app.default',
     'django.contrib.admin',
     'django.contrib.sites',
     'django.contrib.staticfiles',
@@ -140,6 +144,7 @@
 TEST_RUNNER = "local_tests.LocalAppsTestSuiteRunner"
 
 AUTHENTICATION_BACKENDS = (
+    'social-backends.debian.DebianOAuth2',
     'django_openid_auth.auth.OpenIDBackend',
     'django.contrib.auth.backends.ModelBackend',
 )

=== added directory 'summit/social-backends'
=== added file 'summit/social-backends/__init__.py'
=== added file 'summit/social-backends/debian.py'
--- summit/social-backends/debian.py	1970-01-01 00:00:00 +0000
+++ summit/social-backends/debian.py	2014-05-18 00:12:52 +0000
@@ -0,0 +1,55 @@
+"""
+Debian OAuth2 SSO backend
+Based on the Google backend for python-social-auth
+"""
+from requests import HTTPError
+
+from social.backends.oauth import BaseOAuth2
+from social.exceptions import AuthMissingParameter, AuthCanceled
+
+
+class DebianOAuth2(BaseOAuth2):
+    """Debian OAuth2 authentication backend"""
+    name = 'debian-oauth2'
+    REDIRECT_STATE = False
+    AUTHORIZATION_URL = 'https://sso.debian.org/o/authorize'
+    ACCESS_TOKEN_URL = 'https://sso.debian.org/o/token/'
+    ACCESS_TOKEN_METHOD = 'POST'
+    # FIXME: unconfirmed
+    REVOKE_TOKEN_URL = 'https://sso.debian.org/o/revoke'
+    REVOKE_TOKEN_METHOD = 'GET'
+    DEFAULT_SCOPE = ['openid email profile']
+    EXTRA_DATA = [
+        ('refresh_token', 'refresh_token', True),
+        ('expires_in', 'expires'),
+        ('token_type', 'token_type', True)
+    ]
+
+    def revoke_token_params(self, token, uid):
+        return {'token': token}
+
+    def revoke_token_headers(self, token, uid):
+        return {'Content-type': 'application/json'}
+
+    def get_user_id(self, details, response):
+        """Use Debian email as unique id"""
+        if self.setting('USE_UNIQUE_USER_ID', False):
+            return response['id']
+        else:
+            return details['email']
+
+    def get_user_details(self, response):
+        """Return user details from Debian account"""
+        email = response.get('email', '')
+        return {'username': email.split('@', 1)[0],
+                'email': email,
+                'fullname': response.get('name', ''),
+                'first_name': response.get('given_name', ''),
+                'last_name': response.get('family_name', '')}
+
+    def user_data(self, access_token, *args, **kwargs):
+        """Return user data from Debian SSO API"""
+        return self.get_json(
+            'https://sso.debian.org/api/v1/people/getOpenIdConnect',
+            params={'access_token': access_token, 'alt': 'json'}
+        )

=== modified file 'summit/urls.py'
--- summit/urls.py	2013-05-10 14:45:54 +0000
+++ summit/urls.py	2014-05-18 00:12:52 +0000
@@ -61,6 +61,11 @@
 )
 
 urlpatterns += patterns(
+    '',
+    url(r'', include('social.apps.django_app.urls', namespace='social')),
+)
+
+urlpatterns += patterns(
     'summit.schedule.views',
     url(r'^today/(?P<summit_name>[\w-]+)/$', 'today_view', name='today'),
     url(r'^past/', 'past', name='past'),