Merge pull request #2195 from dannon/remoteuser_work

[16.01] Prepass on remote user header based on maildomain and normalize confi…

lib/galaxy/web/framework/middleware/remoteuser.py

@@ -40,13 +40,14 @@ errorpage = """
 
 
 class RemoteUser( object ):
-    def __init__( self, app, maildomain=None, display_servers=None, admin_users=None, remote_user_header=None, remote_user_secret_header=None ):
+    def __init__( self, app, maildomain=None, display_servers=None, admin_users=None, remote_user_header=None, remote_user_secret_header=None, normalize_remote_user_email=False ):
         self.app = app
         self.maildomain = maildomain
         self.display_servers = display_servers or []
         self.admin_users = admin_users or []
         self.remote_user_header = remote_user_header or 'HTTP_REMOTE_USER'
         self.config_secret_header = remote_user_secret_header
+        self.normalize_remote_user_email = normalize_remote_user_email
 
     def __call__( self, environ, start_response ):
         # Allow display servers
@@ -59,11 +60,21 @@ class RemoteUser( object ):
             if host in self.display_servers:
                 environ[ self.remote_user_header ] = 'remote_display_server@%s' % ( self.maildomain or 'example.org' )
                 return self.app( environ, start_response )
-        # Apache sets REMOTE_USER to the string '(null)' when using the
-        # Rewrite* method for passing REMOTE_USER and a user is
-        # un-authenticated.  Any other possible values need to go here as well.
+
+        if self.remote_user_header in environ:
+            # process remote user with configuration options.
+            if self.normalize_remote_user_email:
+                environ[self.remote_user_header] = environ[self.remote_user_header].lower()
+            if self.maildomain and '@' not in environ[self.remote_user_header]:
+                environ[self.remote_user_header] = "%s@%s" % (environ[self.remote_user_header], self.maildomain)
+
         path_info = environ.get('PATH_INFO', '')
 
+        # The API handles its own authentication via keys
+        # Check for API key before checking for header
+        if path_info.startswith( '/api/' ):
+            return self.app( environ, start_response )
+
         # If the secret header is enabled, we expect upstream to send along some key
         # in HTTP_GX_SECRET, so we'll need to compare that here to the correct value
         #
@@ -76,12 +87,7 @@ class RemoteUser( object ):
         # seems improbable that an attacker with access to the server hosting
         # Galaxy would not have access to Galaxy itself, and be attempting to
         # attack the system
-        if path_info.startswith( '/api/' ):
-            # The API handles its own authentication via keys
-            # Check for API key before checking for header
-            return self.app( environ, start_response )
-
-        elif self.config_secret_header is not None:
+        if self.config_secret_header is not None:
             if environ.get('HTTP_GX_SECRET') is None:
                 title = "Access to Galaxy is denied"
                 message = """
@@ -95,7 +101,6 @@ class RemoteUser( object ):
                 access Galaxy.
                 """
                 return self.error( start_response, title, message )
-
             if not safe_str_cmp(environ.get('HTTP_GX_SECRET', ''), self.config_secret_header):
                 title = "Access to Galaxy is denied"
                 message = """
@@ -110,6 +115,9 @@ class RemoteUser( object ):
                 """
                 return self.error( start_response, title, message )
 
+        # Apache sets REMOTE_USER to the string '(null)' when using the
+        # Rewrite* method for passing REMOTE_USER and a user is
+        # un-authenticated.  Any other possible values need to go here as well.
         if not environ.get(self.remote_user_header, '(null)').startswith('(null)'):
             if not environ[ self.remote_user_header ].count( '@' ):
                 if self.maildomain is not None:
@@ -127,7 +135,6 @@ class RemoteUser( object ):
                         before you may access Galaxy.
                     """
                     return self.error( start_response, title, message )
-
             user_accessible_paths = (
                 '/user/api_keys',
                 '/user/edit_username',

lib/galaxy/web/framework/webapp.py

@@ -382,8 +382,6 @@ class GalaxyWebTransaction( base.DefaultWebTransaction,
             assert self.app.config.remote_user_header in self.environ, \
                 "use_remote_user is set but %s header was not provided" % self.app.config.remote_user_header
             remote_user_email = self.environ[ self.app.config.remote_user_header ]
-            if getattr( self.app.config, "normalize_remote_user_email", False ):
-                remote_user_email = remote_user_email.lower()
             if galaxy_session:
                 # An existing session, make sure correct association exists
                 if galaxy_session.user is None:

lib/galaxy/webapps/galaxy/buildapp.py

@@ -688,7 +688,8 @@ def wrap_in_middleware( app, global_conf, **local_conf ):
                           display_servers=util.listify( conf.get( 'display_servers', '' ) ),
                           admin_users=conf.get( 'admin_users', '' ).split( ',' ),
                           remote_user_header=conf.get( 'remote_user_header', 'HTTP_REMOTE_USER' ),
-                          remote_user_secret_header=conf.get('remote_user_secret', None) )
+                          remote_user_secret_header=conf.get('remote_user_secret', None),
+                          normalize_remote_user_email=conf.get('normalize_remote_user_email', False))
     # The recursive middleware allows for including requests in other
     # requests or forwarding of requests, all on the server side.
     if asbool(conf.get('use_recursive', True)):