parameters: (self, request=None, username=None, password=None, user_agent=None,
                       remote_addr=None, accept_language=None,
                       totp_enabled='Disabled')
return_statement: return None
docstring: Perform the authentication of the user.
  
          :param username: The user to authenticate.
          :type username: str
          :param password: The password provided to authenticate with.
          :type password: str
          :param user_agent: The user-agent in the request.
          :type user_agent: str
          :param remote_addr: The hostname/ip in the request.
          :type remote_addr: str
          :param accept_language: The Accept Language in the request.
          :type accept_language: str
          :param totp_enabled: If TOTP is enabled and should be checked as well.
          :type totp_enabled: str
          :returns: :class:`crits.core.user.CRITsUser`, None
docstring_summary: Perform the authentication of the user.
docstring_tokens: Perform the authentication of the user .
function: def authenticate(self, request=None, username=None, password=None, user_agent=None,
                       remote_addr=None, accept_language=None,
                       totp_enabled='Disabled'):
          """
          Perform the authentication of the user.
  
          :param username: The user to authenticate.
          :type username: str
          :param password: The password provided to authenticate with.
          :type password: str
          :param user_agent: The user-agent in the request.
          :type user_agent: str
          :param remote_addr: The hostname/ip in the request.
          :type remote_addr: str
          :param accept_language: The Accept Language in the request.
          :type accept_language: str
          :param totp_enabled: If TOTP is enabled and should be checked as well.
          :type totp_enabled: str
          :returns: :class:`crits.core.user.CRITsUser`, None
          """
  
          # Need username and password for logins, checkem both
          if not all([username, password]):
              return None
  
          e = EmbeddedLoginAttempt()
          e.user_agent = user_agent
          e.remote_addr = remote_addr
          e.accept_language = accept_language
          fusername = username
          if '\\' in username:
              username = username.split("\\")[1]
          user = CRITsUser.objects(username=username).first()
          if user:
              # If the user needs TOTP and it is not disabled system-wide, and
              # the user has exceeded the login threshold for this time period
              # don't go any further. Track the invalid login and return.
              if (((user.totp and totp_enabled == 'Optional') or
                      totp_enabled == 'Required') and
                      self._exceeded_login_threshold(user)):
                  e.success = False
                  self.track_login_attempt(user, e)
                  user.reload()
                  return None
              config = CRITsConfig.objects().first()
              if not config:
                  return None
              if config.ldap_auth:
                  import ldap, ldapurl
                  try:
                      # If you are using Oracle's server that's based on
                      # Netscape's code, and your users can't login after
                      # password expiration warning kicks in, you need:
                      # python-ldap 2.4.15 installed and
                      # import ldap.controls.pwdpolicy to fix it
                      #
                      import ldap.controls.pwdpolicy
                  except ImportError:
                      logger.info("ldap.controls.pwdpolicy not present.")
                  try:
                      # don't parse the port if there is one
                      ldap_server = config.ldap_server.split(':')
                      scheme = "ldap"
                      if config.ldap_tls:
                          scheme = "ldaps"
                      url = ldapurl.LDAPUrl('%s://%s' % (scheme, ldap_server[0]))
                      if len(ldap_server) == 2:
                          l = ldap.initialize('%s:%s' % (url.unparse(),
                                                         ldap_server[1]))
                      else:
                          l = ldap.initialize(url.unparse())
                      l.protocol_version = 3
                      l.set_option(ldap.OPT_REFERRALS, 0)
                      l.set_option(ldap.OPT_TIMEOUT, 10)
                      # two-step ldap binding
                      if len(config.ldap_bind_dn) > 0:
                      	try:
                      		logger.info("binding with bind_dn: %s" % config.ldap_bind_dn)
                      		l.simple_bind_s(config.ldap_bind_dn, config.ldap_bind_password)
                      		filter = '(|(cn='+fusername+')(uid='+fusername+')(mail='+fusername+'))'
                      		# use the retrieved dn for the second bind
                          	un = l.search_s(config.ldap_userdn,ldap.SCOPE_SUBTREE,filter,['dn'])[0][0]
                          except Exception as err:
              			#logger.error("Error binding to LDAP for: %s" % config.ldap_bind_dn)
              			logger.error("authenticate ERR: %s" % err)
                          l.unbind()
                          if len(ldap_server) == 2:
                              l = ldap.initialize('%s:%s' % (url.unparse(),
                                                             ldap_server[1]))
                          else:
                              l = ldap.initialize(url.unparse())
                          l.protocol_version = 3
                          l.set_option(ldap.OPT_REFERRALS, 0)
                          l.set_option(ldap.OPT_TIMEOUT, 10)
                      else:
                          un = fusername
                      # setup auth for custom cn's
                      if len(config.ldap_usercn) > 0:
                          un = "%s%s,%s" % (config.ldap_usercn,
                                            fusername,
                                            config.ldap_userdn)
                      elif "@" in config.ldap_userdn:
                          un = "%s%s" % (fusername, config.ldap_userdn)
                      logger.info("Logging in user: %s" % un)
                      l.simple_bind_s(un, password)
                      user = self._successful_settings(user, e, totp_enabled)
                      if config.ldap_update_on_login:
                          user.update_from_ldap("Auto LDAP update", config, password)
                      l.unbind()
                      return user
                  except ldap.INVALID_CREDENTIALS:
                      l.unbind()
                      logger.info("Invalid LDAP credentials for: %s" % un)
                  except Exception as err:
                      logger.info("LDAP Auth error: %s" % err)
              # If LDAP auth fails, attempt normal CRITs auth.
              # This will help with being able to use local admin accounts when
              # you have LDAP auth enabled.
              if password and user.check_password(password):
                  self._successful_settings(user, e, totp_enabled)
                  if config.ldap_update_on_login:
                      user.update_from_ldap("Auto LDAP update", config)
                  return user
              else:
                  e.success = False
                  user.invalid_login_attempts += 1
  
              if user.is_active and user.invalid_login_attempts > settings.INVALID_LOGIN_ATTEMPTS:
                  user.is_active = False
                  logger.info("Account disabled due to too many invalid login attempts: %s" %
                              user.username)
  
                  if config.crits_email_end_tag:
                      subject = "CRITs Account Lockout" + config.crits_email_subject_tag
                  else:
                      subject = config.crits_email_subject_tag + "CRITs Account Lockout"
                  body = """
  
  You are receiving this email because your CRITs account has been locked out due to
  too many invalid login attempts.  If you did not perform this action,
  someone may be attempting to access your account.
  
  Please contact a site administrator to resolve.
  
  """
                  try:
                      user.email_user(subject, body)
                  except Exception, err:
                      logger.warning("Error sending email: %s" % str(err))
              self.track_login_attempt(user, e)
              user.reload()
          return None
function_tokens: def authenticate ( self , request = None , username = None , password = None , user_agent = None , remote_addr = None , accept_language = None , totp_enabled = 'Disabled' ) : # Need username and password for logins, checkem both if not all ( [ username , password ] ) : return None e = EmbeddedLoginAttempt ( ) e . user_agent = user_agent e . remote_addr = remote_addr e . accept_language = accept_language fusername = username if '\\' in username : username = username . split ( "\\" ) [ 1 ] user = CRITsUser . objects ( username = username ) . first ( ) if user : # If the user needs TOTP and it is not disabled system-wide, and # the user has exceeded the login threshold for this time period # don't go any further. Track the invalid login and return. if ( ( ( user . totp and totp_enabled == 'Optional' ) or totp_enabled == 'Required' ) and self . _exceeded_login_threshold ( user ) ) : e . success = False self . track_login_attempt ( user , e ) user . reload ( ) return None config = CRITsConfig . objects ( ) . first ( ) if not config : return None if config . ldap_auth : import ldap , ldapurl try : # If you are using Oracle's server that's based on # Netscape's code, and your users can't login after # password expiration warning kicks in, you need: # python-ldap 2.4.15 installed and # import ldap.controls.pwdpolicy to fix it # import ldap . controls . pwdpolicy except ImportError : logger . info ( "ldap.controls.pwdpolicy not present." ) try : # don't parse the port if there is one ldap_server = config . ldap_server . split ( ':' ) scheme = "ldap" if config . ldap_tls : scheme = "ldaps" url = ldapurl . LDAPUrl ( '%s://%s' % ( scheme , ldap_server [ 0 ] ) ) if len ( ldap_server ) == 2 : l = ldap . initialize ( '%s:%s' % ( url . unparse ( ) , ldap_server [ 1 ] ) ) else : l = ldap . initialize ( url . unparse ( ) ) l . protocol_version = 3 l . set_option ( ldap . OPT_REFERRALS , 0 ) l . set_option ( ldap . OPT_TIMEOUT , 10 ) # two-step ldap binding if len ( config . ldap_bind_dn ) > 0 : try : logger . info ( "binding with bind_dn: %s" % config . ldap_bind_dn ) l . simple_bind_s ( config . ldap_bind_dn , config . ldap_bind_password ) filter = '(|(cn=' + fusername + ')(uid=' + fusername + ')(mail=' + fusername + '))' # use the retrieved dn for the second bind un = l . search_s ( config . ldap_userdn , ldap . SCOPE_SUBTREE , filter , [ 'dn' ] ) [ 0 ] [ 0 ] except Exception as err : #logger.error("Error binding to LDAP for: %s" % config.ldap_bind_dn) logger . error ( "authenticate ERR: %s" % err ) l . unbind ( ) if len ( ldap_server ) == 2 : l = ldap . initialize ( '%s:%s' % ( url . unparse ( ) , ldap_server [ 1 ] ) ) else : l = ldap . initialize ( url . unparse ( ) ) l . protocol_version = 3 l . set_option ( ldap . OPT_REFERRALS , 0 ) l . set_option ( ldap . OPT_TIMEOUT , 10 ) else : un = fusername # setup auth for custom cn's if len ( config . ldap_usercn ) > 0 : un = "%s%s,%s" % ( config . ldap_usercn , fusername , config . ldap_userdn ) elif "@" in config . ldap_userdn : un = "%s%s" % ( fusername , config . ldap_userdn ) logger . info ( "Logging in user: %s" % un ) l . simple_bind_s ( un , password ) user = self . _successful_settings ( user , e , totp_enabled ) if config . ldap_update_on_login : user . update_from_ldap ( "Auto LDAP update" , config , password ) l . unbind ( ) return user except ldap . INVALID_CREDENTIALS : l . unbind ( ) logger . info ( "Invalid LDAP credentials for: %s" % un ) except Exception as err : logger . info ( "LDAP Auth error: %s" % err ) # If LDAP auth fails, attempt normal CRITs auth. # This will help with being able to use local admin accounts when # you have LDAP auth enabled. if password and user . check_password ( password ) : self . _successful_settings ( user , e , totp_enabled ) if config . ldap_update_on_login : user . update_from_ldap ( "Auto LDAP update" , config ) return user else : e . success = False user . invalid_login_attempts += 1 if user . is_active and user . invalid_login_attempts > settings . INVALID_LOGIN_ATTEMPTS : user . is_active = False logger . info ( "Account disabled due to too many invalid login attempts: %s" % user . username ) if config . crits_email_end_tag : subject = "CRITs Account Lockout" + config . crits_email_subject_tag else : subject = config . crits_email_subject_tag + "CRITs Account Lockout" body = """
  
  You are receiving this email because your CRITs account has been locked out due to
  too many invalid login attempts.  If you did not perform this action,
  someone may be attempting to access your account.
  
  Please contact a site administrator to resolve.
  
  """ try : user . email_user ( subject , body ) except Exception , err : logger . warning ( "Error sending email: %s" % str ( err ) ) self . track_login_attempt ( user , e ) user . reload ( ) return None