diff --git a/lib/galaxy/web/framework/middleware/remoteuser.py b/lib/galaxy/web/framework/middleware/remoteuser.py index 540b3feefa1..cb6a1c6afa9 100644 --- a/lib/galaxy/web/framework/middleware/remoteuser.py +++ b/lib/galaxy/web/framework/middleware/remoteuser.py @@ -40,13 +40,14 @@ errorpage = """ class RemoteUser( object ): - def __init__( self, app, maildomain=None, display_servers=None, admin_users=None, remote_user_header=None, remote_user_secret_header=None ): + def __init__( self, app, maildomain=None, display_servers=None, admin_users=None, remote_user_header=None, remote_user_secret_header=None, normalize_remote_user_email=False ): self.app = app self.maildomain = maildomain self.display_servers = display_servers or [] self.admin_users = admin_users or [] self.remote_user_header = remote_user_header or 'HTTP_REMOTE_USER' self.config_secret_header = remote_user_secret_header + self.normalize_remote_user_email = normalize_remote_user_email def __call__( self, environ, start_response ): # Allow display servers @@ -59,11 +60,21 @@ class RemoteUser( object ): if host in self.display_servers: environ[ self.remote_user_header ] = 'remote_display_server@%s' % ( self.maildomain or 'example.org' ) return self.app( environ, start_response ) - # Apache sets REMOTE_USER to the string '(null)' when using the - # Rewrite* method for passing REMOTE_USER and a user is - # un-authenticated. Any other possible values need to go here as well. + + if self.remote_user_header in environ: + # process remote user with configuration options. + if self.normalize_remote_user_email: + environ[self.remote_user_header] = environ[self.remote_user_header].lower() + if self.maildomain and '@' not in environ[self.remote_user_header]: + environ[self.remote_user_header] = "%s@%s" % (environ[self.remote_user_header], self.maildomain) + path_info = environ.get('PATH_INFO', '') + # The API handles its own authentication via keys + # Check for API key before checking for header + if path_info.startswith( '/api/' ): + return self.app( environ, start_response ) + # If the secret header is enabled, we expect upstream to send along some key # in HTTP_GX_SECRET, so we'll need to compare that here to the correct value # @@ -76,12 +87,7 @@ class RemoteUser( object ): # seems improbable that an attacker with access to the server hosting # Galaxy would not have access to Galaxy itself, and be attempting to # attack the system - if path_info.startswith( '/api/' ): - # The API handles its own authentication via keys - # Check for API key before checking for header - return self.app( environ, start_response ) - - elif self.config_secret_header is not None: + if self.config_secret_header is not None: if environ.get('HTTP_GX_SECRET') is None: title = "Access to Galaxy is denied" message = """ @@ -95,7 +101,6 @@ class RemoteUser( object ): access Galaxy. """ return self.error( start_response, title, message ) - if not safe_str_cmp(environ.get('HTTP_GX_SECRET', ''), self.config_secret_header): title = "Access to Galaxy is denied" message = """ @@ -110,6 +115,9 @@ class RemoteUser( object ): """ return self.error( start_response, title, message ) + # Apache sets REMOTE_USER to the string '(null)' when using the + # Rewrite* method for passing REMOTE_USER and a user is + # un-authenticated. Any other possible values need to go here as well. if not environ.get(self.remote_user_header, '(null)').startswith('(null)'): if not environ[ self.remote_user_header ].count( '@' ): if self.maildomain is not None: @@ -127,7 +135,6 @@ class RemoteUser( object ): before you may access Galaxy. """ return self.error( start_response, title, message ) - user_accessible_paths = ( '/user/api_keys', '/user/edit_username', diff --git a/lib/galaxy/web/framework/webapp.py b/lib/galaxy/web/framework/webapp.py index efb3254aa4c..4d8db1d59e2 100644 --- a/lib/galaxy/web/framework/webapp.py +++ b/lib/galaxy/web/framework/webapp.py @@ -382,8 +382,6 @@ class GalaxyWebTransaction( base.DefaultWebTransaction, assert self.app.config.remote_user_header in self.environ, \ "use_remote_user is set but %s header was not provided" % self.app.config.remote_user_header remote_user_email = self.environ[ self.app.config.remote_user_header ] - if getattr( self.app.config, "normalize_remote_user_email", False ): - remote_user_email = remote_user_email.lower() if galaxy_session: # An existing session, make sure correct association exists if galaxy_session.user is None: diff --git a/lib/galaxy/webapps/galaxy/buildapp.py b/lib/galaxy/webapps/galaxy/buildapp.py index 2d1a86006c4..1967e73c270 100644 --- a/lib/galaxy/webapps/galaxy/buildapp.py +++ b/lib/galaxy/webapps/galaxy/buildapp.py @@ -688,7 +688,8 @@ def wrap_in_middleware( app, global_conf, **local_conf ): display_servers=util.listify( conf.get( 'display_servers', '' ) ), admin_users=conf.get( 'admin_users', '' ).split( ',' ), remote_user_header=conf.get( 'remote_user_header', 'HTTP_REMOTE_USER' ), - remote_user_secret_header=conf.get('remote_user_secret', None) ) + remote_user_secret_header=conf.get('remote_user_secret', None), + normalize_remote_user_email=conf.get('normalize_remote_user_email', False)) # The recursive middleware allows for including requests in other # requests or forwarding of requests, all on the server side. if asbool(conf.get('use_recursive', True)):