auth: Revert back to authentication using a web form

Using Kerberos authentication for this part seems to be more complicated
than necessary and does not provide any benefits.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/templates/login.html b/src/templates/login.html
index f0bb492ebfae0b48b1233cf7ac9524287942d327..51c4d3aa10997c3e821e089d4b9a2decb5b135bf 100644 (file)
--- a/src/templates/login.html
+++ b/src/templates/login.html
@@ -1,29 +1,48 @@
 {% extends "base.html" %}
 
-{% block title %}{{ _("Log In") }}{% end block %}
+{% block title %}{{ _("Sign In") }}{% end block %}
 
-{% block container %}
-       <div class="grid-x grid-padding-x align-center">
-               <div class="cell medium-6">
-                       <div class="callout">
-                               <h3>{{ _("Log In") }}</h3>
+{% block body %}
+       <section class="section">
+               <div class="container">
+                       <div class="columns is-centered">
+                               <div class="column is-one-third">
+                                       <h1 class="title is-1">{{ _("Sign In") }}</h1>
 
-                               {% if failed %}
-                                       <p>{{ _("Login failed") }}</p>
-                               {% end %}
+                                       <form method="POST" action="">
+                                               {% raw xsrf_form_html() %}
 
-                               <form method="POST" action="">
-                                       {% raw xsrf_form_html() %}
+                                               <div class="field">
+                                                       <p class="control has-icons-left">
+                                                               <input class="input {% if failed %}is-danger{% end %}"
+                                                                       type="text" name="username" placeholder="{{ _("Username") }}"
+                                                                       {% if username %}value="{{ username }}"{% end %}>
+                                                               <span class="icon is-small is-left">
+                                                                       <i class="fas fa-user"></i>
+                                                               </span>
+                                                       </p>
+                                               </div>
 
-                                       <input type="text" name="username"
-                                               placeholder="{{ _("Username") }}" required>
+                                               <div class="field">
+                                                       <p class="control has-icons-left">
+                                                               <input class="input {% if failed %}is-danger{% end %}"
+                                                                       type="password" name="password" placeholder="{{ _("Password") }}">
+                                                               <span class="icon is-small is-left">
+                                                                       <i class="fas fa-lock"></i>
+                                                               </span>
+                                                       </p>
+                                               </div>
 
-                                       <input type="password" name="password"
-                                               placeholder="{{ _("Password") }}" required>
-
-                                       <button type="submit" class="primary button">{{ _("Log In") }}</button>
-                               </form>
+                                               <div class="field">
+                                                       <p class="control">
+                                                               <button class="button is-primary is-fullwidth">
+                                                                       {{ _("Sign In") }}
+                                                               </button>
+                                                       </p>
+                                               </div>
+                                       </form>
+                               </div>
                        </div>
                </div>
-       </div>
+       </section>
 {% end %}

diff --git a/src/web/auth.py b/src/web/auth.py
index 76a9c6b2fa77354839a817580d55cae188a90e74..622147ab0f33817941d33c9b192494ff7d2ba47a 100644 (file)
--- a/src/web/auth.py
+++ b/src/web/auth.py
@@ -9,18 +9,25 @@ from . import base
 log = logging.getLogger("pbs.web.auth")
 
 class LoginHandler(base.KerberosAuthMixin, base.BaseHandler):
-       def get(self):
-               username = self.get_authenticated_user()
-               if not username:
-                       # Ask to authenticate
-                       self.authenticate_redirect()
-                       return
+       def get(self, username=None, failed=False):
+               if self.current_user:
+                       raise tornado.web.HTTPError(403, "Already logged in")
+
+               self.render("login.html", username=username, failed=failed)
+
+       @base.ratelimit(requests=10, minutes=5)
+       def post(self):
+               # Fetch credentials
+               username = self.get_argument("username")
+               password = self.get_argument("password")
 
-               # Strip the realm
-               username, delim, realm = username.partition("@")
+               # Try to authenticate the user
+               if not self._auth_with_credentials(username, password):
+                       return self.get(username=username, failed=True)
 
+               # If the authentication was successful, we create a new session
                with self.db.transaction():
-                       # Otherwise fetch the authenticated user
+                       # Fetch the authenticated user
                        user = self.backend.users.get_by_name(username)
                        if not user:
                                raise tornado.web.HTTPError(500, "Could not find user %s" % username)

diff --git a/src/web/base.py b/src/web/base.py
index dbfc74b28ab55a0c15de786d088b26f01219325e..15dd79a76d5d0841ea1df7973642fc348afa8fa8 100644 (file)
--- a/src/web/base.py
+++ b/src/web/base.py
@@ -61,7 +61,7 @@ class KerberosAuthMixin(object):
                        return
 
                # Perform GSS API Negotiation
-               if auth_header.startswith("Negotiate"):
+               if auth_header.startswith("Negotiate "):
                        return self._auth_negotiate(auth_header)
 
                # Perform Basic Authentication
@@ -128,6 +128,10 @@ class KerberosAuthMixin(object):
                except:
                        raise tornado.web.HTTPError(400, "Authorization data was malformed")
 
+               # Authenticate against Kerberos
+               return self._auth_with_credentials(username, password)
+
+       def _auth_with_credentials(self, username, password):
                # Check the credentials against the Kerberos database
                try:
                        kerberos.checkPassword(username, password,