From: Quentin Smith <quentin@mit.edu>
Date: Thu, 29 Oct 2009 06:12:01 +0000 (-0400)
Subject: Revert "Replace weird username logic with the old logic."
X-Git-Tag: 0.1.0^2~23
X-Git-Url: http://xvm.mit.edu/gitweb/invirt/packages/invirt-web.git/commitdiff_plain/398eae28374e91d447a09252087b1f5f1ac57957

Revert "Replace weird username logic with the old logic."

This reverts r2519. The "weird username logic" is in fact correctly
implementing the documented CherryPy authentication API.

svn path=/package_branches/invirt-web/cherrypy-rebased/; revision=2712
---

diff --git a/code/view.py b/code/view.py
index a3f2278..91c375a 100644
--- a/code/view.py
+++ b/code/view.py
@@ -100,7 +100,7 @@ cherrypy.tools.jsonify = cherrypy.Tool('before_finalize', jsonify_tool_callback,
 
 def require_login():
     """If the user isn't logged in, raise 403 with an error."""
-    if not cherrypy.request.login:
+    if cherrypy.request.login is False:
         raise cherrypy.HTTPError(403,
             "You are not authorized to access that resource")
 
@@ -115,17 +115,26 @@ def require_POST():
 cherrypy.tools.require_POST = cherrypy.Tool('on_start_resource', require_POST, priority=150)
 
 def remote_user_login():
-    """Get the current user based on the SSL or GSSAPI environment variables"""
+    """Get the current user based on the SSL or GSSAPI environment
+variables and store it in the request object's login variable. This
+conforms to the CherryPy API:
+http://www.cherrypy.org/wiki/RequestObject#login
+
+If the user is logged in successfully, cherrypy.request.login is set
+to the username. If the user failed to log in, cherrypy.request.login
+is set to False. If the user did not attempt authentication,
+cherrypy.request.login is set to None."""
     environ = cherrypy.request.wsgi_environ
     user = environ.get('REMOTE_USER')
     if user is None:
-        cherrypy.request.login = None
         return
+    else:
+        cherrypy.request.login = None # clear what cherrypy put there
 
     if environ.get('AUTH_TYPE') == 'Negotiate':
         # Convert the krb5 principal into a krb4 username
         if not user.endswith('@%s' % config.kerberos.realm):
-            cherrypy.request.login = None
+            cherrypy.request.login = False # failed to login
         else:
             cherrypy.request.login = user.split('@')[0].replace('/', '.')
     else: