plone.session 3.5

Python 2.4 / Zope 2.10 / Plone 3

To use this version of plone.session under Python 2.4, add the backported hmac module to your buildout (which will also bring in the backported hashlib module.)

Theory of operation

The optional add-on installs a css resource which updates the cookie when loaded. This allows the cookie to be updated every time a page is loaded. While this CSS cannot cached by proxy servers, it may be cached for a time on the client. By controlling the max-age of the CSS resource, it is possible to control how often the browser actually fetches the CSS and hence how often the cookie is updated.

With short timeouts (15 or 30 minutes say), a user may not have loaded a new page before their cookie becomes invalid. A javascript is included which polls the cookie refresh CSS periodically while the user is active on the page (key presses or mouse moves.) If the refresh CSS max-age has passed, then the browser will refetch the CSS and the cookie will be updated. The poll interval may be configured on the refresh CSS query string minutes parameter, with the default being 5 minutes.

Caveat

This has been tested and shown to work on Internet Explorer 7, Firefox 4, Safari 5 and Chrome 6. Unfortunately Internet Explorer 6 does not seem to respect the caching headers for javascript fetched resources, so if you have a lot of IE6 users you may want to increase the poll interval to reduce server load.

Requirements

• You need a Microsoft Windows Server running IIS. Preferably Windows Server 2003 or a later version.

• The server must be a member of the Windows domain you want to authenticate users for. It does not need to be an Active Directory server itself.

• You site should use LDAPMultiPlugins to use the same Active Directory as a user source. (Use plone.app.ldap to set this up with Plone.)

Python

• The Windows server needs to have Python 2.6 <http://www.python.org/download/> and the Python Win 32 extensions installed. (Currently Python 2.6.5 and pywin32-214.)

• Until pywin32-215 is released, apply this fix to the file:

  C:\Python26\Lib\site-packages\win32comext\axscript\client\framework.py

  and remove the framework.pyc and framework.pyo files.

• Place a copy of tktauth.py (from plone/session of this package) into:

  C:\Python26\Lib\site-packages\

• Follow these instructions on how to configure Python for IIS. In bullet point 2.d. use:

  Executable: "C:\Python26\python.exe -u %s %s"

  instead. This will ensure files are opened in universal newline mode. You can choose to only configure these settings for the specific web site and not the entire IIS. Adjust settings accordingly and create the web site first as detailed in the next chapter.

IIS

• Find and open the IIS management console.

• Create a new Web Site, by going into the Web Sites folder and using the right-click menu. You should get a wizard asking you for various questions:

  Description: SSO login service
  
  TCP port: 80
  
  Path: c:\Inetpub\sso
  
  Allow anonymous access to this Web site: <not checked>
  
  Permissions: Read, Run scripts, Execute

• If you are running IIS 6, you need to go to the Web Service Extensions folder and change Active Server Pages to be Allowed. Otherwise you will get rather unhelpful 404 Not Found errors for the asp scripts.

IIS script

• Copy the login.asp and test.asp scripts (from the iis-login folder of this package) into root path of the web site (for example C:Inetpubsso).

• You need to modify the SECRET constant found in the login.asp to the same shared secret set on plone.session’s Manage secrets tab.

• Modify the ALLOWED_SITES constant in login.asp to include the URLs of your Plone sites.

• Modify the DEFAULT_NEXT constant in login.asp to refer the the URL of logged_in on one of your Plone sites.

• Access http://LOGONSERVER/test.asp to confirm access permissions are correctly configured.

Configuring browsers to allow automatic logon

Browsers must be configured to “trust” the logon server for user authentication data to be sent automatically.

By default, Internet Explorer sends logon information to servers within the “Intranet Zone”, so long as the site is accessed using it’s intranet name (http://LOGONSERVER/login.asp). If the site is accessed using a fully qualified domain name or IP address, it must be explicitly added to the list of trusted sites.

Firefox configuration information may be found in this article.

Configuring your Plone site

Ensure that you have setup authentication to Active Directory and that you can login with the your current Windows user name.

Set the following configuration options through the Zope interface:

• In /Plone/acl_users/session. On the Manage secrets tab set a shared secret.

• In /Plone/portal_properties/site_properties set external_login_url to http://LOGONSERVER/login.asp.

For Plone versions before 4.1:

• In /Plone/portal_actions/user/login. On the Properties tab set URL (Expression) to ${portal/portal_properties/site_properties/external_login_url}?next=${globals_view/navigationRootUrl}/logged_in.

For Plone 4.1 and later you may instead set:

• In /Plone/portal_properties/site_properties set external_login_iframe to True.

Note for developers testing this under Windows XP

• IIS may be installed as an additional component using the Windows XP installation CD.

• The IIS management console can be located at:

  Start -> Control Panel -> Adminstrative Tools -> Internet Information Services

• The pywin32 installer setup IIS sufficiently for me not to need to follow the instructions on how to configure Python for IIS.

• I could not find how to setup a separate site, so placed the asp scripts directly in C:Inetpubwwwroot - the “Default Web Site”

• From the IIS management console, select “Default Web Site”. You should see login.asp and test.asp in the right hand pane. With each file, right-click Properties. On the File Security tab click Edit… on Anonymous access and authentication control. Uncheck Anonymous access and check Basic authentication (to be used as a fallback) and Integrated Windows authentication.

• Access http://localhost/test.asp to confirm IIS authentication works as expected.

• Set the secret in login.asp and Manage secrets of plone.session.

• Set SITE_URL in login.asp to http://localhost:8080/Plone (or whatever the address of your site is.)

• Add a Plone user with the same name as your Windows login name (e.g. Administrator), this avoids setting up Active Directory.

• Follow the section above to configure your Plone site, but set Login Form to http://localhost/login.asp.

3.5 - 2011-03-19

• Disable secure cookie in development mode, to ease local testing. [hannosch]

3.4 - 2011-03-02

• Added metadata.xml to the default profile. [vincentfretin]

3.3 - 2010-12-30

• Update login.asp to match Plone 4.1 SSO login form functionality. [elro]

• Fix remove. [elro]

3.2 - 2010-12-14

• Remove external_login method, the normal logged_in script can be used instead. [elro]

• Fix refresh. [elro]

3.1 - 2010-11-11

• Remove SessionPlugin.validate(ticket) method, it was not required. [elro]

3.1b1 - 2010-10-18

• Session refresh. [elro]

• SessionPlugin.validate(ticket) method. [elro]

• Close <input> tags properly (chameleon compatibility) [swampmonkey]

3.0 - 2010-07-18

• Update package metadata. [hannosch]

3.0b5 - 2010-06-13

• Make sure to load the right meta ZCML. [hannosch]

• Avoid deprecation warnings under Zope 2.13. [hannosch]

• Removed dependency on GPL licensed Products.PloneTestCase. [hannosch]

3.0b4 - 2010-05-23

• Make the secure option of cookies configurable. This allows to restrict cookies to HTTPS connections alone. This closes http://dev.plone.org/plone/ticket/7897. [pfurman, hannosch]

• Use the standard libraries doctest module, instead of the deprecated one from zope.testing. [hannosch]

• Marked the session cookie as HTTPOnly. [hannosch]

• PEP8 cleanup. [hannosch]

• Relicense as BSD following PF Board decision. http://lists.plone.org/pipermail/membership/2010-April/001123.html [elro]

3.0b3 - 2010-04-09

• Example IIS login form and documentation. This builds on work by Hanno and I at Jarn for Centrepoint. [elro]

• Support authentication by an external form, perhaps one running on an IIS server with Integrated Windows Authentication. [elro]

3.0b2 - 2010-03-09

• Prefix setupSession with underscore, the method should be unavailable TTW. [elro]

• Catch a ComponentLookupError in authenticateCredentials. [elro]

3.0b1 - 2010-03-05

• Add back the hash management UI with added functionality to set shared secret. [elro]

• Add properties for cookie domain and ticket validity timeout. [elro]

• Use mod_auth_tkt format cookies to give us a session validity timeout. By default we use a more secure HMAC SHA-256 hashing scheme. An MD5 based scheme compatible with other mod_auth_tkt implementations is optional. [elro]

• Remove the source component indirection. [elro]

3.0a2 - 2009-11-13

• Remove hash management UI which had been accidentally re-merged. [davisagli]

3.0a1 - 2009-04-04

• Avoid deprecation warning for the sha module in Python 2.6. [hannosch]

• Declare test dependencies in an extra. [hannosch]

• Specify package dependencies. [hannosch]

• Fixed the remaining tests to work with the new keyring backend. [hannosch]

• Fixed a component lookup call in the HashSession source. [davisagli, hannosch]

• Update default (hash) session source to use plone.keyring to manage the secrets. [wichert]

2.1 - 2009-02-04

• Protect the setupSession call with the ManageUsers permission. Fixes possible privilege escalation. [maurits]

• Make the cookie lifetime configurable. Patch by Rok Garbas. Fixes http://dev.plone.org/plone/ticket/7248 [wichert, garbas]

2.0 - 2008-07-08

• Fix CSRF protection for managing server secrets via the Plone session plugin for PAS. Fixes http://dev.plone.org/plone/ticket/8176 [witsch]

1.2 - 2007-02-15

• Use the binascii base64 methods to encode/decode the session cookie. This prevents newlines being inserted in long cookies. [wichert]

1.1 - 2007-09-11

• Use the userid instead of the login name in session identifiers. This has the side-effect of working around a bug in PAS which caused us to mix up users when the login name used was an inexact match for another login name. [wichert]

1.0 - 2007-08-15

• First stable release [wichert]