<gh_stars>100-1000
# -*- mode: python; encoding: utf-8 -*-
#
# Copyright 2013 <NAME>, Opera Software ASA
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License.  You may obtain a copy of
# the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
# License for the specific language governing permissions and limitations under
# the License.

# Accepted password hash schemes.  They need to be supported by the passlib
# Python package; see http://packages.python.org/passlib for details.
PASSWORD_HASH_SCHEMES = %(installation.config.password_hash_schemes)r

# Default password hash scheme.  Must be included in PASSWORD_HASH_SCHEMES.
DEFAULT_PASSWORD_HASH_SCHEME = %(installation.config.default_password_hash_scheme)r

# (Approximate) minimum password hash time in seconds.  Higher means safer
# passwords (more difficult to decrypt using brute-force) but slower sign-in
# operation.
MINIMUM_PASSWORD_HASH_TIME = %(installation.config.minimum_password_hash_time)r

# Calibrated minimum rounds per password hash scheme.
MINIMUM_ROUNDS = %(installation.config.minimum_rounds)r

# External authentication providers.
PROVIDERS = {

    # GitHub OAuth-based authentication.
    "github": {
        "enabled": %(installation.config.provider_github.enabled)r,

        # Allow authenticated user to create a Critic user.
        "allow_user_registration": %(installation.config.provider_github.allow_user_registration)r,
        # Verify user email addresses provided by GitHub.
        "verify_email_addresses": %(installation.config.provider_github.verify_email_addresses)r,

        # Client ID and secret.  These are generated by registering an
        # application at https://github.com/settings/applications/new.
        "client_id": %(installation.config.provider_github.client_id)r,
        "client_secret": %(installation.config.provider_github.client_secret)r,

        # Bypass /createuser on first sign in, creating a user automatically.
        "bypass_createuser": %(installation.config.provider_github.bypass_createuser)r,

        # Authentication callback URI.  This same URI must be provided
        # to GitHub when registering the application.  The path
        # component must be "/oauth/github".
        "redirect_uri": %(installation.config.provider_github.redirect_uri)r
    },

    # Google OAuth-based authentication.
    "google": {
        "enabled": %(installation.config.provider_google.enabled)r,

        # Allow authenticated user to create a Critic user.
        "allow_user_registration": %(installation.config.provider_google.allow_user_registration)r,
        # Verify user email addresses provided by Google.
        "verify_email_addresses": %(installation.config.provider_google.verify_email_addresses)r,

        # Client ID and secret.  These are generated by creating a project at
        # https://cloud.google.com/console/project, and then creating an OAuth2
        # client id using the project administration UI.
        "client_id": %(installation.config.provider_google.client_id)r,
        "client_secret": %(installation.config.provider_google.client_secret)r,

        # Bypass /createuser on first sign in, creating a user automatically.
        "bypass_createuser": %(installation.config.provider_google.bypass_createuser)r,

        # Authentication callback URI.  This same URI must be provided
        # to Google when creating the OAuth2 client id.  The path
        # component must be "/oauth/google".
        "redirect_uri": %(installation.config.provider_google.redirect_uri)r
    },

}

# Authentication databases.
DATABASES = {

    # Using Critic's own user database for authentication.
    "internal": {},

    # Using an LDAP database for authentication.
    "ldap": {
        # Input fields.
        #
        # Each element is a tuple containing:
        #  [0]: True if the field should use <input type=password>
        #  [1]: Internal field identifier
        #  [2]: Field label
        #  [3]: (Optional) Longer description / help text
        "fields": [
            (False, "username", "Username:"),
            (True, "password", "Password:"),
        ],

        # LDAP server URL.
        "url": "%(installation.config.ldap_url)s",

        # Use TLS when connecting to LDAP server.
        "use_tls": True,

        # Credentials field.
        #
        # Identifier of the field whose value will be used as the credentials
        # (e.g. password) in the bind request used for authentication.
        "credentials": "password",

        # The following two values are all interpreted as Python format strings
        # that can reference field values, e.g. using "%%(username)s".  The input
        # values will have been escaped for safe usage in LDAP expressions.

        # LDAP search base.
        "search_base": "%(installation.config.ldap_search_base)s",

        # LDAP search filter.
        "search_filter": "(uid=%%(username)s)",

        # The following settings control if and how Critic user records are
        # created after successful authentication of a user.

        # If true, Critic user records are created automatically if
        # authentication succeeds but a matching record is not found.
        "create_user": %(installation.config.ldap_create_user)r,

        # User name LDAP attribute.
        #
        # This is the LDAP attribute whose value is used as the Critic username,
        # both when looking for an existing user record and when creating a new
        # one (if one isn't found.)
        #
        # If the attribute is missing or empty it will be considered an
        # authentication error.
        "username_attribute": "%(installation.config.ldap_username_attribute)s",

        # Full name LDAP attribute.
        #
        # This is the LDAP attribute to use as the (initial) full name when
        # creating a new Critic user record.  It is not used if an existing user
        # record is found.
        #
        # If the attribute is missing or empty, the user is created with the
        # username as full name.
        "fullname_attribute": "%(installation.config.ldap_fullname_attribute)s",

        # Email LDAP attribute.
        #
        # This is the LDAP attribute to use as the (initial) primary email
        # address when creating a new Critic user record.  It is not used if an
        # existing user record is found.
        #
        # If the attribute is missing or empty, the user is created with no
        # primary email address.
        "email_attribute": "%(installation.config.ldap_email_attribute)s",

        # List of required LDAP groups.
        #
        # If the list is empty, no group membership is required.
        "require_groups": [

            # {
            #     # Distinguished name of the required group.
            #     "dn": "cn=SomeGroup,ou=Groups,dc=example,dc=com",
            #
            #     # Group attribute containing the list of members.
            #     "members_attribute": "memberUid",
            #
            #     # Value to search for in the list of members.
            #     #
            #     # The value is interpreted as a Python format string, and can
            #     # reference field values.  It can also reference the
            #     # distinguished name of the user signing in as "%%(dn)s".
            #     "member_value": "%%(username)s",
            # },

        ],

        # Maximum age of cached successful authentication attempts, in seconds.
        # If set to zero, caching is disabled altogether.
        "cache_max_age": %(installation.config.ldap_cache_max_age)r,
    },

}

DATABASE = %(installation.config.auth_database)r

ENABLE_ACCESS_TOKENS = %(installation.config.enable_access_tokens)r

# -*- mode: python; encoding: utf-8 -*-
#
# Copyright 2013 <NAME>, Opera Software ASA
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
# use this file except in compliance with the License.  You may obtain a copy of
# the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
# License for the specific language governing permissions and limitations under
# the License.

# Accepted password hash schemes.  They need to be supported by the passlib
# Python package; see http://packages.python.org/passlib for details.
PASSWORD_HASH_SCHEMES = %(installation.config.password_hash_schemes)r

# Default password hash scheme.  Must be included in PASSWORD_HASH_SCHEMES.
DEFAULT_PASSWORD_HASH_SCHEME = %(installation.config.default_password_hash_scheme)r

# (Approximate) minimum password hash time in seconds.  Higher means safer
# passwords (more difficult to decrypt using brute-force) but slower sign-in
# operation.
MINIMUM_PASSWORD_HASH_TIME = %(installation.config.minimum_password_hash_time)r

# Calibrated minimum rounds per password hash scheme.
MINIMUM_ROUNDS = %(installation.config.minimum_rounds)r

# External authentication providers.
PROVIDERS = {

    # GitHub OAuth-based authentication.
    "github": {
        "enabled": %(installation.config.provider_github.enabled)r,

        # Allow authenticated user to create a Critic user.
        "allow_user_registration": %(installation.config.provider_github.allow_user_registration)r,
        # Verify user email addresses provided by GitHub.
        "verify_email_addresses": %(installation.config.provider_github.verify_email_addresses)r,

        # Client ID and secret.  These are generated by registering an
        # application at https://github.com/settings/applications/new.
        "client_id": %(installation.config.provider_github.client_id)r,
        "client_secret": %(installation.config.provider_github.client_secret)r,

        # Bypass /createuser on first sign in, creating a user automatically.
        "bypass_createuser": %(installation.config.provider_github.bypass_createuser)r,

        # Authentication callback URI.  This same URI must be provided
        # to GitHub when registering the application.  The path
        # component must be "/oauth/github".
        "redirect_uri": %(installation.config.provider_github.redirect_uri)r
    },

    # Google OAuth-based authentication.
    "google": {
        "enabled": %(installation.config.provider_google.enabled)r,

        # Allow authenticated user to create a Critic user.
        "allow_user_registration": %(installation.config.provider_google.allow_user_registration)r,
        # Verify user email addresses provided by Google.
        "verify_email_addresses": %(installation.config.provider_google.verify_email_addresses)r,

        # Client ID and secret.  These are generated by creating a project at
        # https://cloud.google.com/console/project, and then creating an OAuth2
        # client id using the project administration UI.
        "client_id": %(installation.config.provider_google.client_id)r,
        "client_secret": %(installation.config.provider_google.client_secret)r,

        # Bypass /createuser on first sign in, creating a user automatically.
        "bypass_createuser": %(installation.config.provider_google.bypass_createuser)r,

        # Authentication callback URI.  This same URI must be provided
        # to Google when creating the OAuth2 client id.  The path
        # component must be "/oauth/google".
        "redirect_uri": %(installation.config.provider_google.redirect_uri)r
    },

}

# Authentication databases.
DATABASES = {

    # Using Critic's own user database for authentication.
    "internal": {},

    # Using an LDAP database for authentication.
    "ldap": {
        # Input fields.
        #
        # Each element is a tuple containing:
        #  [0]: True if the field should use <input type=password>
        #  [1]: Internal field identifier
        #  [2]: Field label
        #  [3]: (Optional) Longer description / help text
        "fields": [
            (False, "username", "Username:"),
            (True, "password", "Password:"),
        ],

        # LDAP server URL.
        "url": "%(installation.config.ldap_url)s",

        # Use TLS when connecting to LDAP server.
        "use_tls": True,

        # Credentials field.
        #
        # Identifier of the field whose value will be used as the credentials
        # (e.g. password) in the bind request used for authentication.
        "credentials": "password",

        # The following two values are all interpreted as Python format strings
        # that can reference field values, e.g. using "%%(username)s".  The input
        # values will have been escaped for safe usage in LDAP expressions.

        # LDAP search base.
        "search_base": "%(installation.config.ldap_search_base)s",

        # LDAP search filter.
        "search_filter": "(uid=%%(username)s)",

        # The following settings control if and how Critic user records are
        # created after successful authentication of a user.

        # If true, Critic user records are created automatically if
        # authentication succeeds but a matching record is not found.
        "create_user": %(installation.config.ldap_create_user)r,

        # User name LDAP attribute.
        #
        # This is the LDAP attribute whose value is used as the Critic username,
        # both when looking for an existing user record and when creating a new
        # one (if one isn't found.)
        #
        # If the attribute is missing or empty it will be considered an
        # authentication error.
        "username_attribute": "%(installation.config.ldap_username_attribute)s",

        # Full name LDAP attribute.
        #
        # This is the LDAP attribute to use as the (initial) full name when
        # creating a new Critic user record.  It is not used if an existing user
        # record is found.
        #
        # If the attribute is missing or empty, the user is created with the
        # username as full name.
        "fullname_attribute": "%(installation.config.ldap_fullname_attribute)s",

        # Email LDAP attribute.
        #
        # This is the LDAP attribute to use as the (initial) primary email
        # address when creating a new Critic user record.  It is not used if an
        # existing user record is found.
        #
        # If the attribute is missing or empty, the user is created with no
        # primary email address.
        "email_attribute": "%(installation.config.ldap_email_attribute)s",

        # List of required LDAP groups.
        #
        # If the list is empty, no group membership is required.
        "require_groups": [

            # {
            #     # Distinguished name of the required group.
            #     "dn": "cn=SomeGroup,ou=Groups,dc=example,dc=com",
            #
            #     # Group attribute containing the list of members.
            #     "members_attribute": "memberUid",
            #
            #     # Value to search for in the list of members.
            #     #
            #     # The value is interpreted as a Python format string, and can
            #     # reference field values.  It can also reference the
            #     # distinguished name of the user signing in as "%%(dn)s".
            #     "member_value": "%%(username)s",
            # },

        ],

        # Maximum age of cached successful authentication attempts, in seconds.
        # If set to zero, caching is disabled altogether.
        "cache_max_age": %(installation.config.ldap_cache_max_age)r,
    },

}

DATABASE = %(installation.config.auth_database)r

ENABLE_ACCESS_TOKENS = %(installation.config.enable_access_tokens)r
# -*- mode: python; encoding: utf-8 -*- # # Copyright 2013 <NAME>, Opera Software ASA # # Licensed under the Apache License, Version 2.0 (the "License"); you may not # use this file except in compliance with the License.  You may obtain a copy of # the License at # #   http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the # License for the specific language governing permissions and limitations under # the License. # Accepted password hash schemes.  They need to be supported by the passlib # Python package; see http://packages.python.org/passlib for details. # Default password hash scheme.  Must be included in PASSWORD_HASH_SCHEMES. # (Approximate) minimum password hash time in seconds.  Higher means safer # passwords (more difficult to decrypt using brute-force) but slower sign-in # operation. # Calibrated minimum rounds per password hash scheme. # External authentication providers. # GitHub OAuth-based authentication. # Allow authenticated user to create a Critic user. # Verify user email addresses provided by GitHub. # Client ID and secret.  These are generated by registering an # application at https://github.com/settings/applications/new. # Bypass /createuser on first sign in, creating a user automatically. # Authentication callback URI.  This same URI must be provided # to GitHub when registering the application.  The path # component must be "/oauth/github". # Google OAuth-based authentication. # Allow authenticated user to create a Critic user. # Verify user email addresses provided by Google. # Client ID and secret.  These are generated by creating a project at # https://cloud.google.com/console/project, and then creating an OAuth2 # client id using the project administration UI. # Bypass /createuser on first sign in, creating a user automatically. # Authentication callback URI.  This same URI must be provided # to Google when creating the OAuth2 client id.  The path # component must be "/oauth/google". # Authentication databases. # Using Critic's own user database for authentication. # Using an LDAP database for authentication. # Input fields. # # Each element is a tuple containing: #  [0]: True if the field should use <input type=password> #  [1]: Internal field identifier #  [2]: Field label #  [3]: (Optional) Longer description / help text # LDAP server URL. # Use TLS when connecting to LDAP server. # Credentials field. # # Identifier of the field whose value will be used as the credentials # (e.g. password) in the bind request used for authentication. # The following two values are all interpreted as Python format strings # that can reference field values, e.g. using "%%(username)s".  The input # values will have been escaped for safe usage in LDAP expressions. # LDAP search base. # LDAP search filter. # The following settings control if and how Critic user records are # created after successful authentication of a user. # If true, Critic user records are created automatically if # authentication succeeds but a matching record is not found. # User name LDAP attribute. # # This is the LDAP attribute whose value is used as the Critic username, # both when looking for an existing user record and when creating a new # one (if one isn't found.) # # If the attribute is missing or empty it will be considered an # authentication error. # Full name LDAP attribute. # # This is the LDAP attribute to use as the (initial) full name when # creating a new Critic user record.  It is not used if an existing user # record is found. # # If the attribute is missing or empty, the user is created with the # username as full name. # Email LDAP attribute. # # This is the LDAP attribute to use as the (initial) primary email # address when creating a new Critic user record.  It is not used if an # existing user record is found. # # If the attribute is missing or empty, the user is created with no # primary email address. # List of required LDAP groups. # # If the list is empty, no group membership is required. # { #     # Distinguished name of the required group. #     "dn": "cn=SomeGroup,ou=Groups,dc=example,dc=com", # #     # Group attribute containing the list of members. #     "members_attribute": "memberUid", # #     # Value to search for in the list of members. #     # #     # The value is interpreted as a Python format string, and can #     # reference field values.  It can also reference the #     # distinguished name of the user signing in as "%%(dn)s". #     "member_value": "%%(username)s", # }, # Maximum age of cached successful authentication attempts, in seconds. # If set to zero, caching is disabled altogether.