| 119 | |
| 120 | class ProxyAuthHandler(AuthHandlerBase): |
| 121 | def handle_auth( |
| 122 | self, |
| 123 | request, |
| 124 | headers=None, |
| 125 | remote_addr=None, |
| 126 | remote_user=None, |
| 127 | authorization=None, |
| 128 | **kwargs, |
| 129 | ): |
| 130 | remote_addr = headers.get("x-forwarded-for", remote_addr) |
| 131 | extra = {"remote_addr": remote_addr} |
| 132 | |
| 133 | # Needed to support st2client which does not connect via st2web |
| 134 | if authorization and not remote_user: |
| 135 | try: |
| 136 | auth_value = base64.b64decode(authorization[1]) |
| 137 | except Exception: |
| 138 | LOG.audit("Invalid authorization header", extra=extra) |
| 139 | abort_request() |
| 140 | return |
| 141 | |
| 142 | split = auth_value.split(b":", 1) |
| 143 | if len(split) != 2: |
| 144 | LOG.audit("Invalid authorization header", extra=extra) |
| 145 | abort_request() |
| 146 | return |
| 147 | |
| 148 | remote_user = split[0] |
| 149 | if six.PY3 and isinstance(remote_user, six.binary_type): |
| 150 | remote_user = remote_user.decode("utf-8") |
| 151 | |
| 152 | if remote_user: |
| 153 | ttl = getattr(request, "ttl", None) |
| 154 | username = self._get_username_for_request(remote_user, request) |
| 155 | try: |
| 156 | token = self._create_token_for_user(username=username, ttl=ttl) |
| 157 | except TTLTooLargeException as e: |
| 158 | abort_request( |
| 159 | status_code=http_client.BAD_REQUEST, message=six.text_type(e) |
| 160 | ) |
| 161 | return token |
| 162 | |
| 163 | LOG.audit("Access denied to anonymous user.", extra=extra) |
| 164 | abort_request() |
| 165 | |
| 166 | |
| 167 | class StandaloneAuthHandler(AuthHandlerBase): |