#NEWLINE# def get_groups( self , env , token ) : #NEWLINE# #INDENT# 'Get groups for the given token.\n\n        :param env: The current WSGI environment dictionary.\n        :param token: Token to validate and return a group string for.\n\n        :returns: None if the token is invalid or a string containing a comma\n                  separated list of groups the authenticated user is a member\n                  of. The first group in the list is also considered a unique\n                  identifier for that user.\n        ' #NEWLINE# groups = None #NEWLINE# memcache_client = cache_from_env ( env ) #NEWLINE# if memcache_client : #NEWLINE# #INDENT# memcache_key = ( '%s/auth/%s' % ( self . reseller_prefix , token ) ) #NEWLINE# cached_auth_data = memcache_client . get ( memcache_key ) #NEWLINE# if cached_auth_data : #NEWLINE# #INDENT# ( expires , groups ) = cached_auth_data #NEWLINE# if ( expires < time ( ) ) : #NEWLINE# #INDENT# groups = None #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# if env . get ( 'HTTP_AUTHORIZATION' ) : #NEWLINE# #INDENT# if expires . swauth_remote : #NEWLINE# #INDENT# self . logger . warning ( 'S3-style authorization not supported yet with swauth_remote mode.' ) #NEWLINE# return None #NEWLINE# #UNINDENT# try : #NEWLINE# #INDENT# account = env [ 'HTTP_AUTHORIZATION' ] . split ( ' ' ) [ 1 ] #NEWLINE# ( account , user , sign ) = account . split ( ':' ) #NEWLINE# #UNINDENT# except Exception : #NEWLINE# #INDENT# self . logger . debug ( ( 'Swauth cannot parse Authorization header value %r' % env [ 'HTTP_AUTHORIZATION' ] ) ) #NEWLINE# return None #NEWLINE# #UNINDENT# path = quote ( ( '/v1/%s/%s/%s' % ( self . auth_account , account , user ) ) ) #NEWLINE# resp = self . make_pre_authed_request ( env , 'GET' , path ) . get_response ( self . app ) #NEWLINE# if ( ( resp . status_int // 100 ) != 2 ) : #NEWLINE# #INDENT# return None #NEWLINE# #UNINDENT# if ( 'x-object-meta-account-id' in resp . headers ) : #NEWLINE# #INDENT# account_id = resp . headers [ 'x-object-meta-account-id' ] #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# path = quote ( ( '/v1/%s/%s' % ( self . auth_account , account ) ) ) #NEWLINE# resp2 = self . make_pre_authed_request ( env , 'HEAD' , path ) . get_response ( self . app ) #NEWLINE# if ( ( resp2 . status_int // 100 ) != 2 ) : #NEWLINE# #INDENT# return None #NEWLINE# #UNINDENT# account_id = resp2 . headers [ 'x-container-meta-account-id' ] #NEWLINE# #UNINDENT# path = env [ 'PATH_INFO' ] #NEWLINE# env [ 'PATH_INFO' ] = path . replace ( ( '%s:%s' % ( account , user ) ) , account_id , 1 ) #NEWLINE# detail = json . loads ( resp . body ) #NEWLINE# password = detail [ 'auth' ] . split ( ':' ) [ ( - 1 ) ] #NEWLINE# msg = base64 . urlsafe_b64decode ( unquote ( token ) ) #NEWLINE# if isinstance ( password , unicode ) : #NEWLINE# #INDENT# password = password . encode ( 'utf-8' ) #NEWLINE# #UNINDENT# if isinstance ( msg , unicode ) : #NEWLINE# #INDENT# msg = msg . encode ( 'utf-8' ) #NEWLINE# #UNINDENT# s = base64 . encodestring ( hmac . new ( password , msg , sha1 ) . digest ( ) ) . strip ( ) #NEWLINE# if ( s != sign ) : #NEWLINE# #INDENT# return None #NEWLINE# #UNINDENT# groups = [ g [ 'name' ] for g in detail [ 'groups' ] ] #NEWLINE# if ( '.admin' in groups ) : #NEWLINE# #INDENT# groups . remove ( '.admin' ) #NEWLINE# groups . append ( account_id ) #NEWLINE# #UNINDENT# groups = ',' . join ( groups ) #NEWLINE# return groups #NEWLINE# #UNINDENT# if ( not groups ) : #NEWLINE# #INDENT# if self . swauth_remote : #NEWLINE# #INDENT# with Timeout ( self . swauth_remote_timeout ) : #NEWLINE# #INDENT# conn = http_connect ( self . swauth_remote_parsed . hostname , self . swauth_remote_parsed . port , 'GET' , ( '%s/v2/.token/%s' % ( self . swauth_remote_parsed . path , quote ( token ) ) ) , ssl = ( self . swauth_remote_parsed . scheme == 'https' ) ) #NEWLINE# resp = conn . getresponse ( ) #NEWLINE# resp . read ( ) #NEWLINE# conn . close ( ) #NEWLINE# #UNINDENT# if ( ( resp . status // 100 ) != 2 ) : #NEWLINE# #INDENT# return None #NEWLINE# #UNINDENT# expires_from_now = float ( resp . getheader ( 'x-auth-ttl' ) ) #NEWLINE# groups = resp . getheader ( 'x-auth-groups' ) #NEWLINE# if memcache_client : #NEWLINE# #INDENT# memcache_client . set ( memcache_key , ( ( time ( ) + expires_from_now ) , groups ) , time = expires_from_now ) #NEWLINE# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# path = quote ( ( '/v1/%s/.token_%s/%s' % ( self . auth_account , token [ ( - 1 ) ] , token ) ) ) #NEWLINE# resp = self . make_pre_authed_request ( env , 'GET' , path ) . get_response ( self . app ) #NEWLINE# if ( ( resp . status_int // 100 ) != 2 ) : #NEWLINE# #INDENT# return None #NEWLINE# #UNINDENT# detail = json . loads ( resp . body ) #NEWLINE# if ( detail [ 'expires' ] < time ( ) ) : #NEWLINE# #INDENT# self . make_pre_authed_request ( env , 'DELETE' , path ) . get_response ( self . app ) #NEWLINE# return None #NEWLINE# #UNINDENT# groups = [ g [ 'name' ] for g in detail [ 'groups' ] ] #NEWLINE# if ( '.admin' in groups ) : #NEWLINE# #INDENT# groups . remove ( '.admin' ) #NEWLINE# groups . append ( detail [ 'account_id' ] ) #NEWLINE# #UNINDENT# groups = ',' . join ( groups ) #NEWLINE# if memcache_client : #NEWLINE# #INDENT# memcache_client . set ( memcache_key , ( detail [ 'expires' ] , groups ) , time = float ( ( detail [ 'expires' ] - time ( ) ) ) ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# return groups