auth | Odoo Connects Everything

odoo dingtalk pc and mobile client auth common template

ODOO阿里钉钉桌面和移动客户端免登认证通用模板
钉钉的免登接口是先要通过基于前端H5的JSAPI获取到code后才能进行后台服务端校验，但其PC端和手机端开发很可能是两个不同风格的小团队耦合而成，所以调用接口需要整合一下才能对外透明，也难怪后台应用针对两端的首页都可以分别进行配置：

<template id="entry" name="renjie_dingtalk entry">
    <t t-call="web.layout">
        <t t-set="head">
            <script t-if="type == 'mobile'" type="text/javascript" src="//g.alicdn.com/dingding/open-develop/1.9.0/dingtalk.js"></script>
            <script t-if="type == 'pc'" type="text/javascript" src="//g.alicdn.com/dingding/dingtalk-pc-api/2.7.0/index.js"></script>
        </t>
        <script type="text/javascript">
            /**
             * author: i@renjie.me
             */
            var auth = {
                corpId: "<t t-raw="corp_id"/>",
                onSuccess: function(ret){
                    location.href = "/auth_dingtalk/sso" + location.search + "\u0026code=" + ret.code + "\u0026state=<t t-raw="state"/>";
                },
                onFail: function(err){}
            };
            <t t-if="type == 'mobile'">
            dd.ready(function(){
                dd.runtime.permission.requestAuthCode(auth);
            });
            </t>
            <t t-if="type == 'pc'">
            DingTalkPC.runtime.permission.requestAuthCode(auth);
            </t>
        </script>
    </t>
</template>

</t>

/**

* author: i@renjie.me

var auth = {

corpId: "<t t-raw="corp_id"/>",

onSuccess: function(ret){

location.href = "/auth_dingtalk/sso" + location.search + "\u0026code=" + ret.code + "\u0026state=<t t-raw="state"/>";

onFail: function(err){}

};

dd.ready(function(){

dd.runtime.permission.requestAuthCode(auth);

});

</t>

DingTalkPC.runtime.permission.requestAuthCode(auth);

</t>

</script>

</t>

</template>

python ldap userPassword salt sha md5 encrypt

odoo自带的auth_ldap模块虽然实现了ldap统一账户的验证，但如果用户一旦修改密码就变成同名的本地用户。这是因为odoo默认先验证本地res.users信息，如果没有记录，或者有记录但密码字段为空才会去ldap服务器验证

根据其原理，可以在修改密码的时候对接上ldap的密码信息就完美了，但用modify指令写入的userPassword值是原文存储，即明文直接写入在服务器也是明文，这就需要在请求端预先加密成ldap标准的密文格式

网上看到有很多php的实现都是要写点代码什么的，照葫芦折腾几下才发现python的passlib库居然有现成拿来即用的函数

>>> from passlib.hash import ldap_salted_sha1 as ssha
>>> ssha.encrypt("test", salt_size=16)
'{SSHA}tiULq3HOY1XRLW+bjGkHe3awnZCHcE5JSam1tnaOce49B4Dw'

>>> from passlib.hash import ldap_salted_sha1 as ssha

>>> ssha.encrypt("test", salt_size=16)

'{SSHA}tiULq3HOY1XRLW+bjGkHe3awnZCHcE5JSam1tnaOce49B4Dw'

以此类推

>>> import passlib.hash
>>> dir(passlib.hash)
['__class__', '__delattr__', '__dict__', '__dir__', '__doc__', '__format__', '__getattr__', '__getattribute__', '__hash__', '__init__', '__module__', '__name__', '__new__', '__package__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__', '__weakref__', 'apr_md5_crypt', 'atlassian_pbkdf2_sha1', 'bcrypt', 'bcrypt_sha256', 'bigcrypt', 'bsd_nthash', 'bsdi_crypt', 'cisco_pix', 'cisco_type7', 'crypt16', 'cta_pbkdf2_sha1', 'des_crypt', 'django_bcrypt', 'django_bcrypt_sha256', 'django_des_crypt', 'django_disabled', 'django_pbkdf2_sha1', 'django_pbkdf2_sha256', 'django_salted_md5', 'django_salted_sha1', 'dlitz_pbkdf2_sha1', 'fshp', 'grub_pbkdf2_sha512', 'hex_md4', 'hex_md5', 'hex_sha1', 'hex_sha256', 'hex_sha512', 'htdigest', 'ldap_bcrypt', 'ldap_bsdi_crypt', 'ldap_des_crypt', 'ldap_hex_md5', 'ldap_hex_sha1', 'ldap_md5', 'ldap_md5_crypt', 'ldap_pbkdf2_sha1', 'ldap_pbkdf2_sha256', 'ldap_pbkdf2_sha512', 'ldap_plaintext', 'ldap_salted_md5', 'ldap_salted_sha1', 'ldap_sha1', 'ldap_sha1_crypt', 'ldap_sha256_crypt', 'ldap_sha512_crypt', 'lmhash', 'md5_crypt', 'msdcc', 'msdcc2', 'mssql2000', 'mssql2005', 'mysql323', 'mysql41', 'nthash', 'oracle10', 'oracle11', 'pbkdf2_sha1', 'pbkdf2_sha256', 'pbkdf2_sha512', 'phpass', 'plaintext', 'postgres_md5', 'roundup_plaintext', 'scram', 'sha1_crypt', 'sha256_crypt', 'sha512_crypt', 'sun_md5_crypt', 'unix_disabled', 'unix_fallback']

>>> import passlib.hash

>>> dir(passlib.hash)

['__class__', '__delattr__', '__dict__', '__dir__', '__doc__', '__format__', '__getattr__', '__getattribute__', '__hash__', '__init__', '__module__', '__name__', '__new__', '__package__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__', '__weakref__', 'apr_md5_crypt', 'atlassian_pbkdf2_sha1', 'bcrypt', 'bcrypt_sha256', 'bigcrypt', 'bsd_nthash', 'bsdi_crypt', 'cisco_pix', 'cisco_type7', 'crypt16', 'cta_pbkdf2_sha1', 'des_crypt', 'django_bcrypt', 'django_bcrypt_sha256', 'django_des_crypt', 'django_disabled', 'django_pbkdf2_sha1', 'django_pbkdf2_sha256', 'django_salted_md5', 'django_salted_sha1', 'dlitz_pbkdf2_sha1', 'fshp', 'grub_pbkdf2_sha512', 'hex_md4', 'hex_md5', 'hex_sha1', 'hex_sha256', 'hex_sha512', 'htdigest', 'ldap_bcrypt', 'ldap_bsdi_crypt', 'ldap_des_crypt', 'ldap_hex_md5', 'ldap_hex_sha1', 'ldap_md5', 'ldap_md5_crypt', 'ldap_pbkdf2_sha1', 'ldap_pbkdf2_sha256', 'ldap_pbkdf2_sha512', 'ldap_plaintext', 'ldap_salted_md5', 'ldap_salted_sha1', 'ldap_sha1', 'ldap_sha1_crypt', 'ldap_sha256_crypt', 'ldap_sha512_crypt', 'lmhash', 'md5_crypt', 'msdcc', 'msdcc2', 'mssql2000', 'mssql2005', 'mysql323', 'mysql41', 'nthash', 'oracle10', 'oracle11', 'pbkdf2_sha1', 'pbkdf2_sha256', 'pbkdf2_sha512', 'phpass', 'plaintext', 'postgres_md5', 'roundup_plaintext', 'scram', 'sha1_crypt', 'sha256_crypt', 'sha512_crypt', 'sun_md5_crypt', 'unix_disabled', 'unix_fallback']

其中ldap_bcrypt,ldap_bsdi_crypt,ldap_des_crypt,ldap_hex_md5,ldap_hex_sha1,ldap_md5,ldap_md5_crypt,ldap_pbkdf2_sha1,ldap_pbkdf2_sha256,ldap_pbkdf2_sha512,ldap_plaintext,ldap_salted_md5,ldap_salted_sha1,ldap_sha1,ldap_sha1_crypt,ldap_sha256_crypt,ldap_sha512_crypt等都是ldap加密相关的兄弟函数，可谓是应有尽有非常丰富，看来在odoo端直接集成phpLDAPadmin里各种类型的加密密码更新都是易事了

tornado http basic and digest auth handler

from tornado.web import RequestHandler
from tornado.escape import utf8
from hashlib import md5

class BasicAuthHandler(RequestHandler):
    def get(self):
        realm = 'renjie'
        username = 'foo'
        password = 'bar'
        # Authorization: Basic base64("user:passwd")
        auth_header = self.request.headers.get('Authorization', None)
        if auth_header is not None:
            # Basic Zm9vOmJhcg==
            auth_mode, auth_base64 = auth_header.split(' ', 1)
            assert auth_mode == 'Basic'
            # 'Zm9vOmJhcg==' == base64("foo:bar")
            auth_username, auth_password = auth_base64.decode('base64').split(':', 1)
            if auth_username == username or auth_password == password:
                self.write('ok')
            else:
                self.write('fail')
        else:
            '''
            HTTP/1.1 401 Unauthorized
            WWW-Authenticate: Basic realm="renjie"
            '''
            self.set_status(401)
            self.set_header('WWW-Authenticate', 'Basic realm="%s"' % realm)

class DigestAuthHandler(RequestHandler):
    def get(self):
        realm = 'test'
        opaque = 'asdf'
        # Real implementations would use a random nonce.
        nonce = "1234"
        username = 'foo'
        password = 'bar'
        '''
        Authorization: Digest username="foo", 
                              realm="test", 
                              nonce="1234", 
                              uri="/auth/digest", 
                              response="e839337ef079c93238a4bf4f1ae712b3", 
                              opaque="asdf"
        '''
        auth_header = self.request.headers.get('Authorization', None)
        if auth_header is not None:
            auth_mode, params = auth_header.split(' ', 1)
            assert auth_mode == 'Digest'
            param_dict = {}
            for pair in params.split(','):
                k, v = pair.strip().split('=', 1)
                if v[0] == '"' and v[-1] == '"':
                    v = v[1:-1]
                param_dict[k] = v
            assert param_dict['realm'] == realm
            assert param_dict['opaque'] == opaque
            assert param_dict['nonce'] == nonce
            assert param_dict['username'] == username
            assert param_dict['uri'] == self.request.path
            h1 = md5(utf8('%s:%s:%s' % (username, realm, password))).hexdigest()
            h2 = md5(utf8('%s:%s' % (self.request.method,
                                     self.request.path))).hexdigest()
            digest = md5(utf8('%s:%s:%s' % (h1, nonce, h2))).hexdigest()
            if digest == param_dict['response']:
                self.write('ok')
            else:
                self.write('fail')
        else:
            self.set_status(401)
            # WWW-Authenticate: Digest realm="test", nonce="1234", opaque="asdf"
            self.set_header('WWW-Authenticate',
                            'Digest realm="%s", nonce="%s", opaque="%s"' %
                            (realm, nonce, opaque))

from tornado.web import RequestHandler

from tornado.escape import utf8

from hashlib import md5

class BasicAuthHandler(RequestHandler):

def get(self):

realm = 'renjie'

username = 'foo'

password = 'bar'

# Authorization: Basic base64("user:passwd")

auth_header = self.request.headers.get('Authorization', None)

if auth_header is not None:

# Basic Zm9vOmJhcg==

auth_mode, auth_base64 = auth_header.split(' ', 1)

assert auth_mode == 'Basic'

# 'Zm9vOmJhcg==' == base64("foo:bar")

auth_username, auth_password = auth_base64.decode('base64').split(':', 1)

if auth_username == username or auth_password == password:

self.write('ok')

else:

self.write('fail')

else:

'''

HTTP/1.1 401 Unauthorized

WWW-Authenticate: Basic realm="renjie"

'''

self.set_status(401)

self.set_header('WWW-Authenticate', 'Basic realm="%s"' % realm)

class DigestAuthHandler(RequestHandler):

def get(self):

realm = 'test'

opaque = 'asdf'

# Real implementations would use a random nonce.

nonce = "1234"

username = 'foo'

password = 'bar'

'''

Authorization: Digest username="foo",

realm="test",

nonce="1234",

uri="/auth/digest",

response="e839337ef079c93238a4bf4f1ae712b3",

opaque="asdf"

'''

auth_header = self.request.headers.get('Authorization', None)

if auth_header is not None:

auth_mode, params = auth_header.split(' ', 1)

assert auth_mode == 'Digest'

param_dict = {}

for pair in params.split(','):

k, v = pair.strip().split('=', 1)

if v[0] == '"' and v[-1] == '"':

v = v[1:-1]

param_dict[k] = v

assert param_dict['realm'] == realm

assert param_dict['opaque'] == opaque

assert param_dict['nonce'] == nonce

assert param_dict['username'] == username

assert param_dict['uri'] == self.request.path

h1 = md5(utf8('%s:%s:%s' % (username, realm, password))).hexdigest()

h2 = md5(utf8('%s:%s' % (self.request.method,

self.request.path))).hexdigest()

digest = md5(utf8('%s:%s:%s' % (h1, nonce, h2))).hexdigest()

if digest == param_dict['response']:

self.write('ok')

else:

self.write('fail')

else:

self.set_status(401)

# WWW-Authenticate: Digest realm="test", nonce="1234", opaque="asdf"

self.set_header('WWW-Authenticate',

'Digest realm="%s", nonce="%s", opaque="%s"' %

(realm, nonce, opaque))