10 changed files with 83 additions and 166 deletions
--- a/.env.sample
+++ b/.env.sample
@ -1,4 +0,0 @@
-SECRET_KEY=ldskjflkdsnejnjsdnf
-DEBUG=False
-ENABLE_DEBUG_LOG=True
-ALLOWED_HOSTS=localhost,.ungleich.ch
--- a/.gitignore
+++ b/.gitignore
@ -1,6 +1,3 @@
-.idea/
 venv/
 db.sqlite3
 aux/
-__pycache__/
-static/
--- a/README.md
+++ b/README.md
@ -18,57 +18,63 @@ Related documentation:

 ## Overview ##

-This repository the reference implementation of the ungleichotp server.
+This repository the reference implementation of the ungleichotp
+server.
+
+


 ## Using the ungleichotpclient ##

-The client can be used to test the ungleich-otp-server.
-
-All client commands need the parameters --auth-name and --auth-realm.
-Also either --auth-seed or --auth-token needs to be specified.
 ```
 python manage.py ungleichotpclient create \
    --server-url https://otp.ungleich.ch/ungleichotp/
-    --auth-name admin
-    --auth-realm ungleich-admin
-    [--auth-seed THESEEDFORADMIN]
-    [--auth-token THECURRENTTOKEN]
+    --name admin
+    --realm ungleich-admin
+    --seed AVALIDSEED
 ```

-### Creating new users
+Assuming you want to verify
+(name=ipv6only, realm=ungleich-intern, token=498593) is a
+valid triple and you do have credentials to access ungleich-otp
+(name=info@ungleich.ch, realm=ungleich-admin, seed=PZKBPTHDGSLZBKIZ),
+then the following call will verify the token:

 ```
--name USERNAME --realm REALMOFUSER create
-```
-
-The seed is randomly created.
-
-### Listing users
-
-```
-list
-```
-
-### Deleting users
-
-```
--name USERNAME --realm REALMOFUSER delete
-```
-
-
-### Verifying a token is correct
-
-Verify using:
-
-```
--name USERNAME --realm REALMOFUSER --token TOKENTOBEVERIFIED verify
+UNGLEICHOTPNAME=info@ungleich.ch \
+UNGLEICHOTPREALM=ungleich-admin \
+UNGLEICHOTPSEED=PZKBPTHDGSLZBKIZ \
+UNGLEICHOTPSERVER=http://localhost:8000/ungleichotp/verify/ \
+    python ungleichotpclient.py -n  -r ungleich --token 498593
 ```

 You can also verify using a seed:

 ```
--name USERNAME --realm REALMOFUSER --seed SEEDOFUSER verify
+UNGLEICHOTPNAME=info@ungleich.ch \
+UNGLEICHOTPREALM=ungleich-admin \
+UNGLEICHOTPSEED=PZKBPTHDGSLZBKIZ \
+UNGLEICHOTPSERVER=http://localhost:8000/ungleichotp/verify/ \
+    python ungleichotpclient.py -n  -r ungleich --seed CEKXVG3235PO2HDW
+```
+
+The client requires pyotp.
+
+## Sample 2018-12-30
+
+create:
+(venv) [23:07] line:ungleich-otp% python manage.py ungleichotpclient create --server-url http://localhost:8000/ungleichotp/ --auth-name info@ungleich.ch --auth-realm ungleich-admin --auth-seed PZKBPTHDGSLZBKIZ  --name nico$(date +%s) --realm ungleich-admin
+
+verify:
+
+```
+(venv) [23:07] line:ungleich-otp% python manage.py ungleichotpclient verify --server-url http://localhost:8000/ungleichotp/ --auth-name info@ungleich.ch --auth-realm ungleich-admin --auth-seed PZKBPTHDGSLZBKIZ  --name nico1546206660 --realm ungleich-admin --seed IXTARIU4H2F574M3
+```
+
+list:
+
+```
+(venv) [23:14] line:ungleich-otp% python manage.py ungleichotpclient list --server-url http://localhost:8000/ungleichotp/ --auth-name info@ungleich.ch --auth-realm ungleich-admin --auth-seed PZKBPTHDGSLZBKIZ
 ```


@ -100,13 +106,13 @@ All micro services that are trusted to authenticate another micro
 service should have an entry in the ungleich-auth realm, which allows
 them to verify a token of somebody else.

-```
+
 | Name             | Capabilities                               |
 |------------------+--------------------------------------------|
 | ungleich-admin   | authenticate, create, delete, list, update |
-| ungleich-auth    | authenticate, verify                       |
-| all other realms | authenticate                               |
-```
+| ungleich-auth    | authenticate                               |
+| all other realms | NO ACCESS                                  |
+


 ## Verify using http POST  ##
@ -118,12 +124,12 @@ Request JSON object:

 ```
 {
-    auth_name: "auth-name",
-    auth_realm: "auth-realm",
-    auth_token: "current time based token",
-    name: "name that wants to be authenticated",
-    realm: "realm that wants to be authenticated",
-    token: "token that wants to be authenticated"
+    name: "your-name",
+    realm: "your-realm",
+    token: "current time based token",
+    verifyname: "name that wants to be authenticated",
+    verifyrealm: "realm that wants to be authenticated",
+    verifytoken: "token that wants to be authenticated",
 }
 ```

@ -160,8 +166,8 @@ your application.

 ## Limitations ##

-* Name, Realm and seed are hard coded to 128 bytes length.
-  This can be changed, if necessary.
+* Name, Realm and seed are hard coded to 128 bytes length. This can be
+  changed, if necessary.
 * Only python3 support for ungleichotp


@ -186,8 +192,8 @@ your application.
 - [x] (server) Implement creating new "User" by POST / Model based
 - [n] (server) Remove hard coded JSON in /verify (no - good enough for the moment)
 - [x] (server) Fully rename server from ungleichotp to ungleichotpserver
- [x] (security) Ensure that only the right realms can verify
- [x] (security) Ensure that only the right realms can manage
+- [ ] (security) Ensure that only the right realms can verify
+- [ ] (security) Ensure that only the right realms can manage
 - [ ] (doc) Add proper documentation
 - [ ] (server) Add tests for verify
 - [ ] (server) Add tests for authentication
@ -200,18 +206,14 @@ your application.
 - [ ] (client) Bootstrap Django + DRF (including an object for CRUD)
 - [ ] (client) Add custom authentication / remote auth
 - [ ] (client) Show case: any realm vs. specific realm
- [x] (library) Write a "client library" that can use ungleichotp
- [x] (library) extract generic parts from server
+- [ ] (library) Write a "client library" that can use ungleichotp
+- [ ] (library) extract generic parts from server
 - [ ] (library) upload to pypi



 ## Changelog

-### 0.8, 2019-02-08
-
-* Verify needed to call super()
-
 ### 0.6, 2018-11-18

 * Reuse TokenSerializer for VerifySerializer logic
--- a/logs/.gitignore
+++ b/logs/.gitignore
@ -1,2 +0,0 @@
-*
-!.gitignore
--- a/otpauth/management/commands/ungleichotpclient.py
+++ b/otpauth/management/commands/ungleichotpclient.py
@ -14,16 +14,16 @@ class Command(BaseCommand):
        parser.add_argument('--server-url', required=True)

        # For creating / verifying
-        parser.add_argument('--name', help="Name to create/verify")
-        parser.add_argument('--realm', help="Realm for create/verify")
-        parser.add_argument('--token', help="Token for create/verify")
-        parser.add_argument('--seed', help="Seed for create/verify")
+        parser.add_argument('--name')
+        parser.add_argument('--realm')
+        parser.add_argument('--token')
+        parser.add_argument('--seed')

        # How to authenticate against ungleich-otp
-        parser.add_argument('--auth-name', required=True, help="Name for auth")
-        parser.add_argument('--auth-realm', required=True, help="Realm for auth")
-        parser.add_argument('--auth-token', help="Token for auth")
-        parser.add_argument('--auth-seed', help="Seed for auth")
+        parser.add_argument('--auth-name', required=True)
+        parser.add_argument('--auth-realm', required=True)
+        parser.add_argument('--auth-token')
+        parser.add_argument('--auth-seed')

        parser.add_argument('command', choices=['create',
                                                'delete',
--- a/otpauth/models.py
+++ b/otpauth/models.py
@ -2,11 +2,6 @@ from django.db import models
 from django.contrib.auth.models import AbstractUser
 from rest_framework import exceptions
 from rest_framework import authentication
-import json
-import logging
-import pyotp
-
-logger = logging.getLogger(__name__)


 class OTPSeed(AbstractUser):
@ -22,13 +17,7 @@ class OTPSeed(AbstractUser):
        """
        inject username to ensure it stays unique / is setup at all
        """
-        if not self.is_superuser:
-            self.username = "{}@{}".format(self.name, self.realm)
-        else:
-            self.name = self.username
-            self.realm = "ungleich-admin"
-            self.seed = pyotp.random_base32()
-
+        self.username = "{}@{}".format(self.name, self.realm)
        super().save(*args, **kwargs)

    def __str__(self):
@ -38,20 +27,19 @@ from otpauth.serializer import TokenSerializer

 class OTPAuthentication(authentication.BaseAuthentication):
    def authenticate(self, request):
-        logger.debug("in authenticate {}".format(json.dumps(request.data)))
        serializer = TokenSerializer(data=request.data)

        if serializer.is_valid():
+            print("trying to save... {}".format(serializer))
            instance, token = serializer.save()
        else:
-            logger.error("serializer is invalid")
+            print("Invalide serialize,")
            raise exceptions.AuthenticationFailed()

        # not dealing with admin realm -> can only be auth [see serializer]
        if not instance.realm == "ungleich-admin":
            if not request.path == "/ungleichotp/verify/":
-                logger.debug("request.path is not /ungleichotp/verify/")
                raise exceptions.AuthenticationFailed()

-        logger.debug("AUTH DONE: {} - {}".format(request.path, instance))
+        print("AUTH DONE: {} - {}".format(request.path, instance))
        return (instance, token)
--- a/otpauth/serializer.py
+++ b/otpauth/serializer.py
@ -1,11 +1,8 @@
-import logging
 import pyotp
 import otpauth
 from rest_framework import serializers, exceptions
 from otpauth.models import OTPSeed

-logger = logging.getLogger(__name__)
-
 # For accessing / modifying the data -- currently unused
 class OTPSerializer(serializers.ModelSerializer):
    class Meta:
@ -34,34 +31,22 @@ class TokenSerializer(serializers.Serializer):
        auth_realm =  self.validated_data.get(self.realm_name)

        # only 2 special realms can login
-        # if not auth_realm in ["ungleich-admin", "ungleich-auth" ]:
-        #     logger.error("Auth-realm is neither ungleich-admin "
-        #                  "nor ungleich-auth".format()
-        #     )
-        #     raise exceptions.AuthenticationFailed()
+        if not auth_realm in ["ungleich-admin", "ungleich-auth" ]:
+            raise exceptions.AuthenticationFailed()

-        logger.debug("auth: [{}]{}@'{}' {} + {})".format(
-            self.name_name, auth_name, auth_realm,
-            auth_token, self.validated_data
-        ))
+        print("auth: [{}]{}@'{}' {} + {})".format(self.name_name, auth_name, auth_realm, auth_token, self.validated_data))

        # 1. Verify that the connection might authenticate
        try:
-            logger.debug("Checking in db for name:{} & realm:{}".format(
-                auth_name, auth_realm
-            ))
            db_instance = otpauth.models.OTPSeed.objects.get(name=auth_name, realm=auth_realm)
        except (OTPSeed.MultipleObjectsReturned, OTPSeed.DoesNotExist):
-            logger.error("OTPSeed name: {}, realm: {} does not exist".format(
-                auth_name, auth_realm
-            ))
+            print("does not exist")
            raise exceptions.AuthenticationFailed()
-        logger.debug("Found seed: {}".format(db_instance.seed))
+
        totp = pyotp.TOTP(db_instance.seed)
-        logger.debug("calculated token = {}".format(totp.now()))
+        print("calculated token = {}".format(totp.now()))

        if not totp.verify(auth_token, valid_window=3):
-            logger.error("totp not verified")
            raise exceptions.AuthenticationFailed()

        return (db_instance, auth_token)
@ -80,8 +65,4 @@ class VerifySerializer(TokenSerializer):
        auth_realm = self.validated_data.get("auth_realm")

        if not auth_realm == "ungleich-auth":
-            logger.error("Auth-realm is not ungleich-auth")
            raise exceptions.AuthenticationFailed()
-
-        # Do the authentication part
-        super().save()
--- a/otpauth/views.py
+++ b/otpauth/views.py
@ -7,11 +7,6 @@ from rest_framework.response import Response
 from django.http import JsonResponse
 from otpauth.serializer import VerifySerializer, OTPSerializer, TokenSerializer
 from otpauth.models import OTPSeed
-import json
-import logging
-
-logger = logging.getLogger(__name__)
-

 class OTPVerifyViewSet(viewsets.ModelViewSet):
    serializer_class = OTPSerializer
@ -25,7 +20,7 @@ class OTPVerifyViewSet(viewsets.ModelViewSet):
        Now we inspect the payload and return ok,
        if they also verify
        """
-        logger.debug("in verify {}".format(json.dumps(request.data)))
+
        serializer = VerifySerializer(data=request.data)
        if serializer.is_valid():
            serializer.save()
--- a/requirements.txt
+++ b/requirements.txt
@ -1,10 +1,9 @@
 pyotp>=2.2.6
-django==2.2.16
+django>=2.1.2
 djangorestframework
-python-decouple>=3.1

 # DB
-psycopg2>=2.8,<2.9
+psycopg2

 # Recommended
 markdown
--- a/ungleichotpserver/settings.py
+++ b/ungleichotpserver/settings.py
@ -10,8 +10,6 @@ For the full list of settings and their values, see
 https://docs.djangoproject.com/en/2.1/ref/settings/
 """

-from decouple import config, Csv
-
 import os

 # Build paths inside the project like this: os.path.join(BASE_DIR, ...)
@ -22,7 +20,7 @@ BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 # See https://docs.djangoproject.com/en/2.1/howto/deployment/checklist/

 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = config('SECRET_KEY')
+SECRET_KEY = 'h^*!&u7yaac_6t02kk4de%$aagp6_j#+_wnw3@rqu6os0tlv#r'

 # SECURITY WARNING: don't run with debug turned on in production!

@ -131,8 +129,10 @@ DEBUG_DATABASES = {
    }
 }

-DEBUG = config('DEBUG', False, cast=bool)
-ALLOWED_HOSTS = config('ALLOWED_HOSTS', default='localhost', cast=Csv())
+DEBUG = False
+ALLOWED_HOSTS = [
+    ".ungleich.ch"
+]

 DATABASES = {
    'default': {
@ -146,45 +146,6 @@ BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 STATIC_ROOT = os.path.join(BASE_DIR, "static")
 STATIC_URL = '/static/'

-LOGGING = {
-    'disable_existing_loggers': False,
-    'version': 1,
-    'formatters': {
-        'standard': {
-            'format': '%(asctime)s %(levelname)s %(name)s: %(message)s'
-        }
-    },
-    'handlers': {
-        'default': {
-            'level': 'DEBUG',
-            'class': 'logging.handlers.RotatingFileHandler',
-            'filename': 'logs/debug.log',
-            'maxBytes': 1024*1024*5,
-            'backupCount': 10,
-            'formatter': 'standard',
-        },
-        'console': {
-            'class': 'logging.StreamHandler',
-        },
-    },
-}
-
-if config('ENABLE_DEBUG_LOG', cast=bool, default=False):
-    loggers_dict = {}
-    modules_to_log_list = config(
-        'MODULES_TO_LOG', default='django', cast=Csv()
-    )
-    for custom_module in modules_to_log_list:
-        logger_item = {
-            custom_module: {
-                'handlers': ['default'],
-                'level': 'DEBUG',
-                'propagate': True
-            }
-        }
-        loggers_dict.update(logger_item)
-
-    LOGGING['loggers'] = loggers_dict


 if "DEBUG" in os.environ: