django-otp-0.3.11/0000755000076600000240000000000013060076604014430 5ustar psagersstaff00000000000000django-otp-0.3.11/CHANGES0000644000076600000240000001366113060076400015424 0ustar psagersstaff00000000000000v0.3.11 - March 8, 2017 - Built-in QR Code support -------------------------------------------------- - `#20`_: Generate HOTP and TOTP otpauth URLs and corresponding QR Codes. To enable this feature, install ``django_otp[qrcode]`` or just install the `qrcode`_ package. - Support for Python 2.6 and Django 1.4 were dropped in this version (long overdue). .. _#20: https://bitbucket.org/psagers/django-otp/issues/20/how-to-pair-from-the-admin .. _qrcode: https://pypi.python.org/pypi/qrcode/ v0.3.8 - November 27, 2016 - Forward compatbility for Django 2.0 ---------------------------------------------------------------- - Treat :attr:`~django.contrib.auth.models.User.is_authenticated` and :attr:`~django.contrib.auth.models.User.is_anonymous` as properties in Django 1.10 and later. - Add explict on_delete behavior for all foreign keys. v0.3.7 - September 24, 2016 - Convenience API --------------------------------------------- - Added a convenience API for verifying TOTP tokens: :meth:`django_otp.oath.TOTP.verify`. v0.3.6 - September 4, 2016 - Django 1.10 ---------------------------------------- - `#11`_: Don't break the laziness of ``request.user``. - `#16`_: Improved error message for invalid tokens. - `#17`_: Support the new middleware API in Django 1.10. .. _#11: https://bitbucket.org/psagers/django-otp/issues/11/wasteful-queries-on-every-request .. _#16: https://bitbucket.org/psagers/django-otp/issues/16/inappropriate-error-when-_verify_token .. _#17: https://bitbucket.org/psagers/django-otp/issues/17/django-110-new-style-middleware v0.3.5 - April 13, 2016 - Fix default TOTP key ---------------------------------------------- - The default (random) key for a new TOTP device is now forced to a unicode string. v0.3.4 - January 10, 2016 - Python 3 cleanup -------------------------------------------- - All modules include all four Python 3 __future__ imports for consistency. - Migrations no longer have byte strings in them. v0.3.3 - October 15, 2015 - Django 1.9 -------------------------------------- - Fix the addstatictoken management command under Django 1.9. v0.3.2 - October 11, 2015 - Django 1.8 -------------------------------------- - Stop importing models into the root of the package. - Use ModelAdmin.raw_id_fields for foreign keys to users. - General cleanup and compatibility with Django 1.9a1. v0.3.1 - April 3, 2015 - Django 1.8 ----------------------------------- - Add support for the new app registry, when available. - Add Django 1.8 to the test matrix and fix a few test bugs. v0.3.0 - February 7, 2015 - Support Django migrations ----------------------------------------------------- - All plugins now have both Django and South migrations. Please see the `upgrade notes`_ for details on upgrading from previous versions. .. _upgrade notes: https://pythonhosted.org/django-otp/overview.html#upgrading v0.2.7 - April 26, 2014 - Fix for Custom user models with South --------------------------------------------------------------- - Updated the otp_totp South migrations to support custom user models. Thanks to https://bitbucket.org/robirichter. v0.2.6 - April 18, 2014 - Fix for Python 3.2 with South ------------------------------------------------------- - Removed South-generated unicode string literals. v0.2.4 - April 15, 2014 - TOTP plugin fix (migration warning) ------------------------------------------------------------- - Per the RFC, :class:`~django_otp.plugins.otp_totp.models.TOTPDevice` will no longer verify the same token twice. - Cosmetic fixes to the admin login form on Django 1.6. .. warning:: This includes a model change in TOTPDevice. If you are upgrading and your project uses South, you should first convert it to South with ``manage migrate otp_totp 0001 --fake``. If you're not using South, you will need to generate and run the appropriate SQL manually. v0.2.3 - March 3, 2014 - Fix pickling ------------------------------------- - OTPMiddleware no longer interferes with pickling request.user. v0.2.2 - December 31, 2013 - Require Django 1.4.2 ------------------------------------------------- - Update Django requirement to 1.4.2, the first version with django.utils.six. v0.2.1 - November 19, 2013 - Bug fix ------------------------------------ - Fix unicode representation of devices in some exotic scenarios. v0.2.0 - November 10, 2013 - Django 1.6 --------------------------------------- - Now supports Django 1.4 to 1.6 on Python 2.6, 2.7, 3.2, and 3.3. This is the first release for Python 3. v0.1.8 - August 20, 2013 - user_has_device API ----------------------------------------------- - Add :func:`django_otp.user_has_device` to detect whether a user has any devices configured. This change supports a fix in django-otp-agents 0.1.4. v0.1.7 - July 3, 2013 - Decorator improvement ----------------------------------------------- - Add if_configured argument to :func:`~django_otp.decorators.otp_required`. v0.1.6 - May 9, 2013 - Unit test improvements --------------------------------------------- - Major unit test cleanup. Tests should pass or be skipped under all supported versions of Django, with or without custom users and timzeone support. v0.1.5 - May 8, 2013 - OTPAdminSite improvement ----------------------------------------------- - OTPAdminSite now selects an apporpriate login template automatically, based on the current Django version. Django versions 1.3 to 1.5 are currently supported. - Unit test cleanup. v0.1.3 - March 10, 2013 - Django 1.5 compatibility -------------------------------------------------- - Add support for custom user models in Django 1.5. - Stop using ``Device.objects``: Django doesn't allow access to an abstract model's manager any more. v0.1.2 - October 8, 2012 - Bug fix ---------------------------------- - Fix an exception when an empty login form is submitted. v0.1.0 - August 20, 2012 - Initial Release ------------------------------------------ Initial release. .. vim: ft=rst nospell tw=80 django-otp-0.3.11/django_otp/0000755000076600000240000000000013060076604016554 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/__init__.py0000644000076600000240000001133313016631037020664 0ustar psagersstaff00000000000000import sys import django from django.contrib.auth.signals import user_logged_in DEVICE_ID_SESSION_KEY = 'otp_device_id' def login(request, device): """ Persist the given OTP device in the current session. The device will be rejected if it does not belong to ``request.user``. This is called automatically any time :func:`django.contrib.auth.login` is called with a user having an ``otp_device`` atribute. If you use Django's :func:`~django.contrib.auth.views.login` view with the django-otp authentication forms, then you won't need to call this. :param request: The HTTP request :type request: :class:`~django.http.HttpRequest` :param device: The OTP device used to verify the user. :type device: :class:`~django_otp.models.Device` """ user = getattr(request, 'user', None) if (user is not None) and (device is not None) and (device.user_id == user.id): request.session[DEVICE_ID_SESSION_KEY] = device.persistent_id request.user.otp_device = device def _handle_auth_login(sender, request, user, **kwargs): """ Automatically persists an OTP device that was set by an OTP-aware AuthenticationForm. """ if hasattr(user, 'otp_device'): login(request, user.otp_device) user_logged_in.connect(_handle_auth_login) def match_token(user, token): """ Attempts to verify a :term:`token` on every device attached to the given user until one of them succeeds. When possible, you should prefer to verify tokens against specific devices. :param user: The user supplying the token. :type user: :class:`~django.contrib.auth.models.User` :param string token: An OTP token to verify. :returns: The device that accepted ``token``, if any. :rtype: :class:`~django_otp.models.Device` or ``None`` """ matches = (d for d in devices_for_user(user) if d.verify_token(token)) return next(matches, None) def devices_for_user(user, confirmed=True): """ Return an iterable of all devices registered to the given user. Returns an empty iterable for anonymous users. :param user: standard or custom user object. :type user: :class:`~django.contrib.auth.models.User` :param confirmed: If ``None``, all matching devices are returned. Otherwise, this can be any true or false value to limit the query to confirmed or unconfirmed devices, respectively. :rtype: iterable """ if _user_is_anonymous(user): return for model in device_classes(): for device in model.objects.devices_for_user(user, confirmed=confirmed): yield device def user_has_device(user, confirmed=True): """ Return ``True`` if the user has at least one device. Returns ``False`` for anonymous users. :param user: standard or custom user object. :type user: :class:`~django.contrib.auth.models.User` :param confirmed: If ``None``, all matching devices are considered. Otherwise, this can be any true or false value to limit the query to confirmed or unconfirmed devices, respectively. """ try: next(devices_for_user(user, confirmed=confirmed)) except StopIteration: has_device = False else: has_device = True return has_device def device_classes(): """ Returns an iterable of all loaded device models. """ from django_otp.models import Device try: from django.apps import apps except ImportError: for model in _device_classes_legacy(): yield model else: for config in apps.get_app_configs(): for model in config.get_models(): if issubclass(model, Device): yield model def _device_classes_legacy(): """ Find device models in Django < 1.7. """ from django.db.models import get_apps, get_models from django_otp.models import Device for app in get_apps(): for model in get_models(app): if issubclass(model, Device): yield model def import_class(path): """ Imports a class based on a full Python path ('pkg.pkg.mod.Class'). This does not trap any exceptions if the path is not valid. """ module, name = path.rsplit('.', 1) __import__(module) mod = sys.modules[module] cls = getattr(mod, name) return cls def _user_is_authenticated(user): """ Wraps django's user.is_authenticated to support both Django 2 and pre-1.10. """ return user.is_authenticated if (django.VERSION >= (1, 10)) else user.is_authenticated() def _user_is_anonymous(user): """ Wraps django's user.is_anonymous to support both Django 2 and pre-1.10. """ return user.is_anonymous if (django.VERSION >= (1, 10)) else user.is_anonymous() django-otp-0.3.11/django_otp/admin.py0000644000076600000240000000621612644530040020217 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals import django from django import forms from django.contrib.admin.forms import AdminAuthenticationForm from django.contrib.admin.sites import AdminSite from .forms import OTPAuthenticationFormMixin def _admin_template_for_django_version(): minor_django_version = django.VERSION[:2] if minor_django_version <= (1, 4): return 'otp/admin14/login.html' elif minor_django_version == (1, 5): return 'otp/admin15/login.html' elif minor_django_version == (1, 6): return 'otp/admin16/login.html' elif minor_django_version == (1, 7): return 'otp/admin17/login.html' elif minor_django_version == (1, 8): return 'otp/admin18/login.html' else: return 'otp/admin19/login.html' class OTPAdminAuthenticationForm(AdminAuthenticationForm, OTPAuthenticationFormMixin): """ An :class:`~django.contrib.admin.forms.AdminAuthenticationForm` subclass that solicits an OTP token. This has the same behavior as :class:`~django_otp.forms.OTPAuthenticationForm`. """ otp_device = forms.CharField(required=False, widget=forms.Select) otp_token = forms.CharField(required=False) # This is a placeholder field that allows us to detect when the user clicks # the otp_challenge submit button. otp_challenge = forms.CharField(required=False) def __init__(self, *args, **kwargs): super(OTPAdminAuthenticationForm, self).__init__(*args, **kwargs) # A litle extra cheese to make it prettier. minor_django_version = django.VERSION[:2] if minor_django_version < (1, 6): self.fields['otp_token'].widget.attrs['style'] = 'width: 14em;' def clean(self): self.cleaned_data = super(OTPAdminAuthenticationForm, self).clean() self.clean_otp(self.get_user()) return self.cleaned_data class OTPAdminSite(AdminSite): """ This is an :class:`~django.contrib.admin.AdminSite` subclass that requires two-factor authentication. Only users that can be verified by a registered OTP device will be authorized for this admin site. Unverified users will be treated as if :attr:`~django.contrib.auth.models.User.is_staff` is ``False``. """ #: The default instance name of this admin site. You should instantiate #: this class as ``OTPAdminSite(OTPAdminSite.name)`` to make sure the admin #: templates render the correct URLs. name = 'otpadmin' login_form = OTPAdminAuthenticationForm #: We automatically select a modified login template based on your Django #: version. If it doesn't look right, your version may not be supported, in #: which case feel free to replace it. login_template = _admin_template_for_django_version() def __init__(self, name='otpadmin'): super(OTPAdminSite, self).__init__(name) def has_permission(self, request): """ In addition to the default requirements, this only allows access to users who have been verified by a registered OTP device. """ return super(OTPAdminSite, self).has_permission(request) and request.user.is_verified() django-otp-0.3.11/django_otp/conf.py0000644000076600000240000000145612644303763020067 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals import django.conf from django.utils.six import iteritems class Settings(object): """ This is a simple class to take the place of the global settings object. An instance will contain all of our settings as attributes, with default values if they are not specified by the configuration. """ defaults = { 'OTP_LOGIN_URL': django.conf.settings.LOGIN_URL, } def __init__(self): """ Loads our settings from django.conf.settings, applying defaults for any that are omitted. """ for name, default in iteritems(self.defaults): value = getattr(django.conf.settings, name, default) setattr(self, name, value) settings = Settings() django-otp-0.3.11/django_otp/decorators.py0000644000076600000240000000207213016630500021264 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from django.contrib.auth.decorators import user_passes_test from django_otp import user_has_device, _user_is_authenticated from django_otp.conf import settings def otp_required(view=None, redirect_field_name='next', login_url=None, if_configured=False): """ Similar to :func:`~django.contrib.auth.decorators.login_required`, but requires the user to be :term:`verified`. By default, this redirects users to :setting:`OTP_LOGIN_URL`. :param if_configured: If ``True``, an authenticated user with no confirmed OTP devices will be allowed. Default is ``False``. :type if_configured: bool """ if login_url is None: login_url = settings.OTP_LOGIN_URL def test(user): return user.is_verified() or (if_configured and _user_is_authenticated(user) and not user_has_device(user)) decorator = user_passes_test(test, login_url=login_url, redirect_field_name=redirect_field_name) return decorator if (view is None) else decorator(view) django-otp-0.3.11/django_otp/forms.py0000644000076600000240000002444112771555440020271 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from django import forms from django.utils.translation import ugettext_lazy as _ from django.contrib.auth.forms import AuthenticationForm from . import match_token, devices_for_user from .models import Device class OTPAuthenticationFormMixin(object): """ Shared functionality for :class:`~django.contrib.auth.forms.AuthenticationForm` subclasses that wish to handle OTP tokens. Subclasses must do the following in order to use this: #. Define three additional form fields:: otp_device = forms.CharField(required=False, widget=forms.Select) otp_token = forms.CharField(required=False) otp_challenge = forms.CharField(required=False) - ``otp_device`` will be a select widget with all of the user's devices listed. Until the user has entered a valid username and password, this will be empty and may be omitted. - ``otp_token`` is where the user will enter their token. - ``otp_challenge`` is a placeholder field that captures an alternate submit button of the same name. #. Override :meth:`~django.forms.Form.clean` to call :meth:`clean_otp` after invoking the inherited :meth:`~django.forms.Form.clean`. See :class:`OTPAuthenticationForm` for an example. #. See :class:`OTPAuthenticationForm` for information about writing a login template for this form. The file ``django_otp/templates/otp/admin/login.html`` is also a useful example. You will most likely be able to use :class:`OTPAuthenticationForm`, :class:`django_otp.admin.OTPAdminAuthenticationForm`, or :class:`OTPTokenForm` directly. If these do not suit your needs--for instance if your primary authentication is not by password--they should serve as useful examples. """ def clean_otp(self, user): """ Processes the ``otp_*`` fields. :param user: A user that has been authenticated by the first factor (such as a password). :type user: :class:`~django.contrib.auth.models.User` :rasies: :exc:`~django.core.exceptions.ValidationError` if the user is not fully authenticated by an OTP token. """ if user is None: return device = self._chosen_device(user) token = self.cleaned_data.get('otp_token') user.otp_device = None try: if self.cleaned_data.get('otp_challenge'): self._handle_challenge(device) elif token: user.otp_device = self._verify_token(user, token, device) else: raise forms.ValidationError(_('Please enter your OTP token.'), code='required') finally: if user.otp_device is None: self._update_form(user) def _chosen_device(self, user): device_id = self.cleaned_data.get('otp_device') if device_id: device = Device.from_persistent_id(device_id) else: device = None # SECURITY: The form doesn't validate otp_device for us, since we don't # have the list of choices until we authenticate the user. Without the # following, an attacker could authenticate using some other user's OTP # device. if (device is not None) and (device.user_id != user.id): device = None return device def _handle_challenge(self, device): try: challenge = device.generate_challenge() if (device is not None) else None except Exception as e: raise forms.ValidationError(_('Error generating challenge: {0}'.format(e))) else: if challenge is None: raise forms.ValidationError(_('The selected OTP device is not interactive')) else: raise forms.ValidationError(_('OTP Challenge: {0}').format(challenge)) def _verify_token(self, user, token, device=None): if device is not None: device = device if device.verify_token(token) else None else: device = match_token(user, token) if device is None: raise forms.ValidationError(_('Invalid token. Please make sure you have entered it correctly.'), code='invalid') return device def _update_form(self, user): if 'otp_device' in self.fields: self.fields['otp_device'].widget.choices = self.device_choices(user) if 'password' in self.fields: self.fields['password'].widget.render_value = True @staticmethod def device_choices(user): return list((d.persistent_id, d.name) for d in devices_for_user(user)) class OTPAuthenticationForm(OTPAuthenticationFormMixin, AuthenticationForm): """ This form provides the one-stop OTP authentication solution. It should only be used when two-factor authentication is required: it does not have an OTP-optional mode. The form has four fields: #. ``username`` is inherited from :class:`~django.contrib.auth.forms.AuthenticationForm`. #. ``password`` is inherited from :class:`~django.contrib.auth.forms.AuthenticationForm`. #. ``otp_device`` uses a :class:`~django.forms.Select` to allow the user to choose one of their registered devices. It will be empty as long as ``form.get_user()`` is ``None`` and should generally be omitted from the template in that case. #. ``otp_token`` is the field for entering an OTP token. It should always be included. In addition, if ``form.get_user()`` is not ``None``, the template should include an additional submit button named ``otp_challenge``. Pressing this button when ``otp_device`` is set to an interactive device will cause us to generate a challenge value for the user. Pressing the challenge button with a non-interactive device selected has no effect. The intended behavior of the form is as follows: - Initially the ``username``, ``password``, and ``otp_token`` fields should be visible. Validation of ``username`` and ``password`` is the same as for :class:`~django.contrib.auth.forms.AuthenticationForm`. If we are able to authenticate the user based on username and password, then one of two things happens: - If the user submitted an OTP token, we will enumerate all of the user's OTP devices, asking each one to verify it in turn. If one of them succeeds, then authentication is fully successful and the user is logged in. - If the user did not submit an OTP token or none of user's devices accepted it, then a :exc:`~django.core.exceptions.ValidationError` is raised. - In either case, as long as the user is authenticated by their password, ``form.get_user()`` will return the authenticated :class:`~django.contrib.auth.models.User` object. From here on, this documentation assumes that username/password authentication succeeds on all subsequent submissions. If validation was not successful, then the form will be displayed again and this time the template should be sure to include the (now populated) ``otp_device`` field as well as the ``otp_challenge`` submit button. - The user will then have to choose a specific device to authenticate against (or accept the default). If they press the ``otp_challenge`` button, we will ask that device to generate a challenge. The device will return a message for the user, which will be incorporated into the :exc:`~django.core.exceptions.ValidationError` message. - If the user presses any other submit button, we will authenticate the username and password as always and then verify the OTP token against the chosen device. When that succeeds, authentication and verification are successful and the user is logged in. """ otp_device = forms.CharField(required=False, widget=forms.Select) otp_token = forms.CharField(required=False) # This is a placeholder field that allows us to detect when the user clicks # the otp_challenge submit button. otp_challenge = forms.CharField(required=False) def clean(self): self.cleaned_data = super(OTPAuthenticationForm, self).clean() self.clean_otp(self.get_user()) return self.cleaned_data class OTPTokenForm(OTPAuthenticationFormMixin, forms.Form): """ A form that verifies an authenticated user. It looks very much like :class:`~django_otp.forms.OTPAuthenticationForm`, but without the username and password. The first argument must be an authenticated user; you can use this in place of :class:`~django.contrib.auth.forms.AuthenticationForm` by currying it:: from functools import partial from django.contrib.auth.decoratorrs import login_required from django.contrib.auth.views import login @login_required def verify(request): form_cls = partial(OTPTokenForm, request.user) return login(request, template_name='my_verify_template.html', authentication_form=form_cls) This form will ask the user to choose one of their registered devices and enter an OTP token. Validation will succeed if the token is verified. See :class:`~django_otp.forms.OTPAuthenticationForm` for details on writing a compatible template (leaving out the username and password, of course). :param user: An authenticated user. :type user: :class:`~django.contrib.auth.models.User` :param request: The current request. :type request: :class:`~django.http.HttpRequest` """ otp_device = forms.ChoiceField(choices=[]) otp_token = forms.CharField(required=False) otp_challenge = forms.CharField(required=False) def __init__(self, user, request=None, *args, **kwargs): super(OTPTokenForm, self).__init__(*args, **kwargs) self.user = user self.fields['otp_device'].choices = self.device_choices(user) def clean(self): super(OTPTokenForm, self).clean() self.clean_otp(self.user) return self.cleaned_data def get_user(self): return self.user django-otp-0.3.11/django_otp/middleware.py0000644000076600000240000000354213016630520021241 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals try: from django.utils.deprecation import MiddlewareMixin except ImportError: MiddlewareMixin = object from django.utils.functional import SimpleLazyObject from django_otp import DEVICE_ID_SESSION_KEY, _user_is_authenticated from django_otp.models import Device class OTPMiddleware(MiddlewareMixin): """ This must be installed after :class:`~django.contrib.auth.middleware.AuthenticationMiddleware` and performs an analagous function. Just as AuthenticationMiddleware populates ``request.user`` based on session data, OTPMiddleware populates ``request.user.otp_device`` to the :class:`~django_otp.models.Device` object that has verified the user, or ``None`` if the user has not been verified. As a convenience, this also installs ``user.is_verified()``, which returns ``True`` if ``user.otp_device`` is not ``None``. """ def process_request(self, request): user = getattr(request, 'user', None) if user is not None: request.user = SimpleLazyObject(lambda: self._verify_user(request, user)) return None def _verify_user(self, request, user): """ Sets OTP-related fields on an authenticated user. """ user.otp_device = None user.is_verified = lambda: user.otp_device is not None if _user_is_authenticated(user): device_id = request.session.get(DEVICE_ID_SESSION_KEY) device = Device.from_persistent_id(device_id) if device_id else None if (device is not None) and (device.user_id != user.id): device = None if (device is None) and (DEVICE_ID_SESSION_KEY in request.session): del request.session[DEVICE_ID_SESSION_KEY] user.otp_device = device return user django-otp-0.3.11/django_otp/models.py0000644000076600000240000001236013016627574020424 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from django.conf import settings from django.core.exceptions import ObjectDoesNotExist from django.db import models from django.utils import six class DeviceManager(models.Manager): """ The :class:`~django.db.models.Manager` object installed as ``Device.objects``. """ def devices_for_user(self, user, confirmed=None): """ Returns a queryset for all devices of this class that belong to the given user. :param user: The user. :type user: :class:`~django.contrib.auth.models.User` :param confirmed: If ``None``, all matching devices are returned. Otherwise, this can be any true or false value to limit the query to confirmed or unconfirmed devices, respectively. """ devices = self.model.objects.filter(user=user) if confirmed is not None: devices = devices.filter(confirmed=bool(confirmed)) return devices class Device(models.Model): """ Abstract base model for a :term:`device` attached to a user. Plugins must subclass this to define their OTP models. .. _unsaved_device_warning: .. warning:: OTP devices are inherently stateful. For example, verifying a token is logically a mutating operation on the device, which may involve incrementing a counter or otherwise consuming a token. A device must be committed to the database before it can be used in any way. .. attribute:: user *ForeignKey*: Foreign key to your user model, as configured by :setting:`AUTH_USER_MODEL` (:class:`~django.contrib.auth.models.User` by default). .. attribute:: name *CharField*: A human-readable name to help the user identify their devices. .. attribute:: confirmed *BooleanField*: A boolean value that tells us whether this device has been confirmed as valid. It defaults to ``True``, but subclasses or individual deployments can force it to ``False`` if they wish to create a device and then ask the user for confirmation. As a rule, built-in APIs that enumerate devices will only include those that are confirmed. .. attribute:: objects A :class:`~django_otp.models.DeviceManager`. """ user = models.ForeignKey(getattr(settings, 'AUTH_USER_MODEL', 'auth.User'), help_text="The user that this device belongs to.", on_delete=models.CASCADE) name = models.CharField(max_length=64, help_text="The human-readable name of this device.") confirmed = models.BooleanField(default=True, help_text="Is this device ready for use?") objects = DeviceManager() class Meta(object): abstract = True def __str__(self): if six.PY3: return self.__unicode__() else: return self.__unicode__().encode('utf-8') def __unicode__(self): try: user = self.user except ObjectDoesNotExist: user = None return "{0} ({1})".format(self.name, user) @property def persistent_id(self): return '{0}/{1}'.format(self.import_path, self.id) @property def import_path(self): return '{0}.{1}'.format(self.__module__, self.__class__.__name__) @classmethod def from_persistent_id(cls, path): """ Loads a device from its persistent id:: device == Device.from_persistent_id(device.persistent_id) """ from . import import_class try: device_type, device_id = path.rsplit('/', 1) device_cls = import_class(device_type) device = device_cls.objects.get(id=device_id) except Exception: device = None return device def is_interactive(self): """ Returns ``True`` if this is an interactive device. The default implementation returns ``True`` if :meth:`~django_otp.models.Device.generate_challenge` has been overridden, but subclasses are welcome to provide smarter implementations. :rtype: bool """ return not hasattr(self.generate_challenge, 'stub') def generate_challenge(self): """ Generates a challenge value that the user will need to produce a token. This method is permitted to have side effects, such as transmitting information to the user through some other channel (email or SMS, perhaps). And, of course, some devices may need to commit the challenge to the databse. :returns: A message to the user. This should be a string that fits comfortably in the template ``'OTP Challenge: {0}'``. This may return ``None`` if this device is not interactive. :rtype: string or ``None`` :raises: Any :exc:`~exceptions.Exception` is permitted. Callers should trap ``Exception`` and report it to the user. """ return None generate_challenge.stub = True def verify_token(self, token): """ Verifies a token. As a rule, the token should no longer be valid if this returns ``True``. :param string token: The OTP token provided by the user. :rtype: bool """ return False django-otp-0.3.11/django_otp/oath.py0000644000076600000240000001315412771560463020076 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from hashlib import sha1 import hmac from struct import pack from time import time from django.utils import six if six.PY3: iterbytes = iter else: def iterbytes(buf): return (ord(b) for b in buf) def hotp(key, counter, digits=6): """ Implementation of the HOTP algorithm from `RFC 4226 `_. :param bytes key: The shared secret. A 20-byte string is recommended. :param int counter: The password counter. :param int digits: The number of decimal digits to generate. :returns: The HOTP token. :rtype: int >>> key = b'12345678901234567890' >>> for c in range(10): ... hotp(key, c) 755224 287082 359152 969429 338314 254676 287922 162583 399871 520489 """ msg = pack(b'>Q', counter) hs = hmac.new(key, msg, sha1).digest() hs = list(iterbytes(hs)) offset = hs[19] & 0x0f bin_code = (hs[offset] & 0x7f) << 24 | hs[offset + 1] << 16 | hs[offset + 2] << 8 | hs[offset + 3] hotp = bin_code % pow(10, digits) return hotp def totp(key, step=30, t0=0, digits=6, drift=0): """ Implementation of the TOTP algorithm from `RFC 6238 `_. :param bytes key: The shared secret. A 20-byte string is recommended. :param int step: The time step in seconds. The time-based code changes every ``step`` seconds. :param int t0: The Unix time at which to start counting time steps. :param int digits: The number of decimal digits to generate. :param int drift: The number of time steps to add or remove. Delays and clock differences might mean that you have to look back or forward a step or two in order to match a token. :returns: The TOTP token. :rtype: int >>> key = b'12345678901234567890' >>> now = int(time()) >>> for delta in range(0, 200, 20): ... totp(key, t0=(now-delta)) 755224 755224 287082 359152 359152 969429 338314 338314 254676 287922 """ return TOTP(key, step, t0, digits, drift).token() class TOTP(object): """ An alternate TOTP interface. This provides access to intermediate steps of the computation. This is a living object: the return values of ``t`` and ``token`` will change along with other properties and with the passage of time. :param bytes key: The shared secret. A 20-byte string is recommended. :param int step: The time step in seconds. The time-based code changes every ``step`` seconds. :param int t0: The Unix time at which to start counting time steps. :param int digits: The number of decimal digits to generate. :param int drift: The number of time steps to add or remove. Delays and clock differences might mean that you have to look back or forward a step or two in order to match a token. >>> key = b'12345678901234567890' >>> totp = TOTP(key) >>> totp.time = 0 >>> totp.t() 0 >>> totp.token() 755224 >>> totp.time = 30 >>> totp.t() 1 >>> totp.token() 287082 >>> totp.verify(287082) True >>> totp.verify(359152) False >>> totp.verify(359152, tolerance=1) True >>> totp.drift 1 >>> totp.drift = 0 >>> totp.verify(359152, tolerance=1, min_t=3) False >>> totp.drift 0 >>> del totp.time >>> totp.t0 = int(time()) - 60 >>> totp.t() 2 >>> totp.token() 359152 """ def __init__(self, key, step=30, t0=0, digits=6, drift=0): self.key = key self.step = step self.t0 = t0 self.digits = digits self.drift = drift self._time = None def token(self): """ The computed TOTP token. """ return hotp(self.key, self.t(), digits=self.digits) def t(self): """ The computed time step. """ return ((int(self.time) - self.t0) // self.step) + self.drift @property def time(self): """ The current time. By default, this returns time.time() each time it is accessed. If you want to generate a token at a specific time, you can set this property to a fixed value instead. Deleting the value returns it to its 'live' state. """ return self._time if (self._time is not None) else time() @time.setter def time(self, value): self._time = value @time.deleter def time(self): self._time = None def verify(self, token, tolerance=0, min_t=None): """ A high-level verification helper. :param int token: The provided token. :param int tolerance: The amount of clock drift you're willing to accommodate, in steps. We'll look for the token at t values in [t - tolerance, t + tolerance]. :param int min_t: The minimum t value we'll accept. As a rule, this should be one larger than the largest t value of any previously accepted token. :rtype: bool Iff this returns True, `self.drift` will be updated to reflect the drift value that was necessary to match the token. """ drift_orig = self.drift verified = False for offset in range(-tolerance, tolerance + 1): self.drift = drift_orig + offset if (min_t is not None) and (self.t() < min_t): continue elif self.token() == token: verified = True break else: self.drift = drift_orig return verified django-otp-0.3.11/django_otp/plugins/0000755000076600000240000000000013060076604020235 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/__init__.py0000644000076600000240000000000012566445563022352 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_email/0000755000076600000240000000000013060076604022206 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_email/__init__.py0000644000076600000240000000000012566445563024323 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_email/admin.py0000644000076600000240000000135112644301334023646 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from django.contrib import admin from django.contrib.admin.sites import AlreadyRegistered from .models import EmailDevice class EmailDeviceAdmin(admin.ModelAdmin): """ :class:`~django.contrib.admin.ModelAdmin` for :class:`~django_otp.plugins.otp_email.models.EmailDevice`. """ fieldsets = [ ('Identity', { 'fields': ['user', 'name', 'confirmed'], }), ('Configuration', { 'fields': ['key'], }), ] raw_id_fields = ['user'] # Somehow this is getting imported twice, triggering a useless exception. try: admin.site.register(EmailDevice) except AlreadyRegistered: pass django-otp-0.3.11/django_otp/plugins/otp_email/conf.py0000644000076600000240000000151612644303662023514 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals import django.conf from django.utils.six import iteritems class OTPEmailSettings(object): """ This is a simple class to take the place of the global settings object. An instance will contain all of our settings as attributes, with default values if they are not specified by the configuration. """ defaults = { 'OTP_EMAIL_SENDER': '', 'OTP_EMAIL_SUBJECT': 'OTP token' } def __init__(self): """ Loads our settings from django.conf.settings, applying defaults for any that are omitted. """ for name, default in iteritems(self.defaults): value = getattr(django.conf.settings, name, default) setattr(self, name, value) settings = OTPEmailSettings() django-otp-0.3.11/django_otp/plugins/otp_email/migrations/0000755000076600000240000000000013060076604024362 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_email/migrations/0001_initial.py0000644000076600000240000000240513016627574027037 0ustar psagersstaff00000000000000# -*- coding: utf-8 -*- from __future__ import unicode_literals from django.db import models, migrations from django.conf import settings import django_otp.plugins.otp_email.models class Migration(migrations.Migration): dependencies = [ migrations.swappable_dependency(settings.AUTH_USER_MODEL), ] operations = [ migrations.CreateModel( name='EmailDevice', fields=[ ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)), ('name', models.CharField(help_text='The human-readable name of this device.', max_length=64)), ('confirmed', models.BooleanField(default=True, help_text='Is this device ready for use?')), ('key', models.CharField(default=django_otp.plugins.otp_email.models.default_key, help_text='A hex-encoded secret key of up to 20 bytes.', max_length=80, validators=[django_otp.plugins.otp_email.models.key_validator])), ('user', models.ForeignKey(help_text='The user that this device belongs to.', to=settings.AUTH_USER_MODEL, on_delete=models.CASCADE)), ], options={ 'abstract': False, }, bases=(models.Model,), ), ] django-otp-0.3.11/django_otp/plugins/otp_email/migrations/__init__.py0000644000076600000240000000000012566445563026477 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_email/models.py0000644000076600000240000000351712644303665024060 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from binascii import unhexlify from django.core.mail import send_mail from django.db import models from django.template.loader import render_to_string from django_otp.models import Device from django_otp.oath import totp from django_otp.util import hex_validator, random_hex from .conf import settings def default_key(): return random_hex(20) def key_validator(value): return hex_validator()(value) class EmailDevice(Device): """ A :class:`~django_otp.models.Device` that delivers a token to the user's registered email address (``user.email``). This is intended for demonstration purposes; if you allow users to reset their passwords via email, then this provides no security benefits. .. attribute:: key *CharField*: A hex-encoded secret key of up to 40 bytes. (Default: 20 random bytes) """ key = models.CharField(max_length=80, validators=[key_validator], default=default_key, help_text='A hex-encoded secret key of up to 20 bytes.') @property def bin_key(self): return unhexlify(self.key.encode()) def generate_challenge(self): token = totp(self.bin_key) body = render_to_string('otp/email/token.txt', {'token': token}) send_mail(settings.OTP_EMAIL_SUBJECT, body, settings.OTP_EMAIL_SENDER, [self.user.email]) message = "sent by email" return message def verify_token(self, token): try: token = int(token) except Exception: verified = False else: verified = any(totp(self.bin_key, drift=drift) == token for drift in [0, -1]) return verified django-otp-0.3.11/django_otp/plugins/otp_email/south_migrations/0000755000076600000240000000000013060076604025604 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_email/south_migrations/0001_initial.py0000644000076600000240000001121312644533674030261 0ustar psagersstaff00000000000000# -*- coding: utf-8 -*- from south.utils import datetime_utils as datetime from south.db import db from south.v2 import SchemaMigration from django.db import models class Migration(SchemaMigration): def forwards(self, orm): # Adding model 'EmailDevice' db.create_table('otp_email_emaildevice', ( ('id', self.gf('django.db.models.fields.AutoField')(primary_key=True)), ('user', self.gf('django.db.models.fields.related.ForeignKey')(to=orm['auth.User'])), ('name', self.gf('django.db.models.fields.CharField')(max_length=64)), ('confirmed', self.gf('django.db.models.fields.BooleanField')(default=True)), ('key', self.gf('django.db.models.fields.CharField')(default='14ec9e8ed75e3796a267e835ade15653a34de87b', max_length=80)), )) db.send_create_signal('otp_email', ['EmailDevice']) def backwards(self, orm): # Deleting model 'EmailDevice' db.delete_table('otp_email_emaildevice') models = { 'auth.group': { 'Meta': {'object_name': 'Group'}, 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}), 'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}) }, 'auth.permission': { 'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'}, 'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '50'}) }, 'auth.user': { 'Meta': {'object_name': 'User'}, 'date_joined': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}), 'email': ('django.db.models.fields.EmailField', [], {'max_length': '75', 'blank': 'True'}), 'first_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}), 'groups': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Group']", 'symmetrical': 'False', 'blank': 'True'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}), 'is_staff': ('django.db.models.fields.BooleanField', [], {'default': 'False'}), 'is_superuser': ('django.db.models.fields.BooleanField', [], {'default': 'False'}), 'last_login': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}), 'last_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}), 'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}), 'user_permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}), 'username': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '30'}) }, 'contenttypes.contenttype': { 'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"}, 'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '100'}) }, 'otp_email.emaildevice': { 'Meta': {'object_name': 'EmailDevice'}, 'confirmed': ('django.db.models.fields.BooleanField', [], {'default': 'True'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'key': ('django.db.models.fields.CharField', [], {'default': "'67fe0bf8279a51ad9c3637462a81b16593caee99'", 'max_length': '80'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '64'}), 'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['auth.User']"}) } } complete_apps = ['otp_email'] django-otp-0.3.11/django_otp/plugins/otp_email/south_migrations/__init__.py0000644000076600000240000000000012566445563027721 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_email/templates/0000755000076600000240000000000013060076604024204 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_email/templates/otp/0000755000076600000240000000000013060076604025006 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_email/templates/otp/email/0000755000076600000240000000000013060076604026075 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_email/templates/otp/email/token.txt0000644000076600000240000000003712566445563027774 0ustar psagersstaff00000000000000{{ token|stringformat:".6d" }} django-otp-0.3.11/django_otp/plugins/otp_email/tests.py0000644000076600000240000000263712644303670023735 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from django.db import IntegrityError from django.core import mail from django_otp.forms import OTPAuthenticationForm from django_otp.tests import TestCase from .models import EmailDevice class AuthFormTest(TestCase): def setUp(self): try: alice = self.create_user('alice', 'password') except IntegrityError: self.skipTest("Failed to create user.") else: alice.emaildevice_set.create() if not hasattr(alice, 'email'): self.skipTest("User model has no email.") def test_email_interaction(self): data = { 'username': 'alice', 'password': 'password', 'otp_device': 'django_otp.plugins.otp_email.models.EmailDevice/1', 'otp_token': '', 'otp_challenge': '1', } form = OTPAuthenticationForm(None, data) self.assertTrue(not form.is_valid()) alice = form.get_user() self.assertTrue(alice.get_username() == 'alice') self.assertTrue(alice.otp_device is None) self.assertEqual(len(mail.outbox), 1) data['otp_token'] = mail.outbox[0].body del data['otp_challenge'] form = OTPAuthenticationForm(None, data) self.assertTrue(form.is_valid()) self.assertTrue(isinstance(form.get_user().otp_device, EmailDevice)) django-otp-0.3.11/django_otp/plugins/otp_hotp/0000755000076600000240000000000013060076604022071 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_hotp/__init__.py0000644000076600000240000000000012566445563024206 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_hotp/admin.py0000644000076600000240000000576213060075506023545 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from django.conf.urls import url from django.contrib import admin from django.contrib.admin.sites import AlreadyRegistered from django.core.urlresolvers import reverse from django.http import HttpResponse from django.template.response import TemplateResponse from django.utils.html import format_html from .models import HOTPDevice class HOTPDeviceAdmin(admin.ModelAdmin): """ :class:`~django.contrib.admin.ModelAdmin` for :class:`~django_otp.plugins.otp_hotp.models.HOTPDevice`. """ list_display = ['user', 'name', 'confirmed', 'qrcode_link'] fieldsets = [ ('Identity', { 'fields': ['user', 'name', 'confirmed'], }), ('Configuration', { 'fields': ['key', 'digits', 'tolerance'], }), ('State', { 'fields': ['counter'], }), (None, { 'fields': ['qrcode_link'], }), ] raw_id_fields = ['user'] readonly_fields = ['qrcode_link'] radio_fields = {'digits': admin.HORIZONTAL} def get_queryset(self, request): queryset = super(HOTPDeviceAdmin, self).get_queryset(request) queryset = queryset.select_related('user') return queryset # # Columns # def qrcode_link(self, device): try: href = reverse('admin:otp_hotp_hotpdevice_config', kwargs={'pk': device.pk}) link = format_html('qrcode', href) except Exception: link = '' return link qrcode_link.short_description = "QR Code" # # Custom views # def get_urls(self): urls = [ url(r'^(?P\d+)/config/$', self.admin_site.admin_view(self.config_view), name='otp_hotp_hotpdevice_config'), url(r'^(?P\d+)/qrcode/$', self.admin_site.admin_view(self.qrcode_view), name='otp_hotp_hotpdevice_qrcode'), ] + super(HOTPDeviceAdmin, self).get_urls() return urls def config_view(self, request, pk): device = HOTPDevice.objects.get(pk=pk) try: context = dict( self.admin_site.each_context(request), device=device, ) except AttributeError: # Older versions don't have each_context(). context = {'device': device} return TemplateResponse(request, 'otp_hotp/admin/config.html', context) def qrcode_view(self, request, pk): device = HOTPDevice.objects.get(pk=pk) try: import qrcode import qrcode.image.svg img = qrcode.make(device.config_url, image_factory=qrcode.image.svg.SvgImage) response = HttpResponse(content_type='image/svg+xml') img.save(response) except ImportError: response = HttpResponse('', status=503) return response try: admin.site.register(HOTPDevice, HOTPDeviceAdmin) except AlreadyRegistered: # A useless exception from a double import pass django-otp-0.3.11/django_otp/plugins/otp_hotp/migrations/0000755000076600000240000000000013060076604024245 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_hotp/migrations/0001_initial.py0000644000076600000240000000327413016627574026727 0ustar psagersstaff00000000000000# -*- coding: utf-8 -*- from __future__ import unicode_literals from django.db import models, migrations import django_otp.plugins.otp_hotp.models from django.conf import settings class Migration(migrations.Migration): dependencies = [ migrations.swappable_dependency(settings.AUTH_USER_MODEL), ] operations = [ migrations.CreateModel( name='HOTPDevice', fields=[ ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)), ('name', models.CharField(help_text='The human-readable name of this device.', max_length=64)), ('confirmed', models.BooleanField(default=True, help_text='Is this device ready for use?')), ('key', models.CharField(default=django_otp.plugins.otp_hotp.models.default_key, help_text='A hex-encoded secret key of up to 40 bytes.', max_length=80, validators=[django_otp.plugins.otp_hotp.models.key_validator])), ('digits', models.PositiveSmallIntegerField(default=6, help_text='The number of digits to expect in a token.', choices=[(6, 6), (8, 8)])), ('tolerance', models.PositiveSmallIntegerField(default=5, help_text='The number of missed tokens to tolerate.')), ('counter', models.BigIntegerField(default=0, help_text='The next counter value to expect.')), ('user', models.ForeignKey(help_text='The user that this device belongs to.', to=settings.AUTH_USER_MODEL, on_delete=models.CASCADE)), ], options={ 'abstract': False, 'verbose_name': 'HOTP device', }, bases=(models.Model,), ), ] django-otp-0.3.11/django_otp/plugins/otp_hotp/migrations/__init__.py0000644000076600000240000000000012566445563026362 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_hotp/models.py0000644000076600000240000000657113056365462023747 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from base64 import b32encode from binascii import unhexlify from django.conf import settings from django.db import models from django.utils.six import string_types from django.utils.six.moves.urllib.parse import quote, urlencode from django_otp.models import Device from django_otp.oath import hotp from django_otp.util import random_hex, hex_validator def default_key(): return random_hex(20) def key_validator(value): return hex_validator()(value) class HOTPDevice(Device): """ A generic HOTP :class:`~django_otp.models.Device`. The model fields mostly correspond to the arguments to :func:`django_otp.oath.hotp`. They all have sensible defaults, including the key, which is randomly generated. .. attribute:: key *CharField*: A hex-encoded secret key of up to 40 bytes. (Default: 20 random bytes) .. attribute:: digits *PositiveSmallIntegerField*: The number of digits to expect from the token generator (6 or 8). (Default: 6) .. attribute:: tolerance *PositiveSmallIntegerField*: The number of missed tokens to tolerate. (Default: 5) .. attribute:: counter *BigIntegerField*: The next counter value to expect. (Initial: 0) """ key = models.CharField(max_length=80, validators=[key_validator], default=default_key, help_text="A hex-encoded secret key of up to 40 bytes.") digits = models.PositiveSmallIntegerField(choices=[(6, 6), (8, 8)], default=6, help_text="The number of digits to expect in a token.") tolerance = models.PositiveSmallIntegerField(default=5, help_text="The number of missed tokens to tolerate.") counter = models.BigIntegerField(default=0, help_text="The next counter value to expect.") class Meta(Device.Meta): verbose_name = "HOTP device" @property def bin_key(self): """ The secret key as a binary string. """ return unhexlify(self.key.encode()) def verify_token(self, token): try: token = int(token) except Exception: verified = False else: key = self.bin_key for counter in range(self.counter, self.counter + self.tolerance + 1): if hotp(key, counter, self.digits) == token: verified = True self.counter = counter + 1 self.save() break else: verified = False return verified @property def config_url(self): """ A URL for configuring Google Authenticator or similar. See https://github.com/google/google-authenticator/wiki/Key-Uri-Format. The issuer is taken from :setting:`OTP_HOTP_ISSUER`, if available. """ label = self.user.get_username() params = { 'secret': b32encode(self.bin_key), 'algorithm': 'SHA1', 'digits': self.digits, 'counter': self.counter, } issuer = getattr(settings, 'OTP_HOTP_ISSUER', None) if isinstance(issuer, string_types) and (issuer != ''): issuer = issuer.replace(':', '') params['issuer'] = issuer label = '{}:{}'.format(issuer, label) url = 'otpauth://hotp/{}?{}'.format(quote(label), urlencode(params)) return url django-otp-0.3.11/django_otp/plugins/otp_hotp/south_migrations/0000755000076600000240000000000013060076604025467 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_hotp/south_migrations/0001_initial.py0000644000076600000240000001227612606547014030145 0ustar psagersstaff00000000000000# -*- coding: utf-8 -*- from south.utils import datetime_utils as datetime from south.db import db from south.v2 import SchemaMigration from django.db import models class Migration(SchemaMigration): def forwards(self, orm): # Adding model 'HOTPDevice' db.create_table('otp_hotp_hotpdevice', ( ('id', self.gf('django.db.models.fields.AutoField')(primary_key=True)), ('user', self.gf('django.db.models.fields.related.ForeignKey')(to=orm['auth.User'])), ('name', self.gf('django.db.models.fields.CharField')(max_length=64)), ('confirmed', self.gf('django.db.models.fields.BooleanField')(default=True)), ('key', self.gf('django.db.models.fields.CharField')(default='9a205c276225bce9c2801a0ab1eddadb05f5109b', max_length=80)), ('digits', self.gf('django.db.models.fields.PositiveSmallIntegerField')(default=6)), ('tolerance', self.gf('django.db.models.fields.PositiveSmallIntegerField')(default=5)), ('counter', self.gf('django.db.models.fields.BigIntegerField')(default=0)), )) db.send_create_signal('otp_hotp', ['HOTPDevice']) def backwards(self, orm): # Deleting model 'HOTPDevice' db.delete_table('otp_hotp_hotpdevice') models = { 'auth.group': { 'Meta': {'object_name': 'Group'}, 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}), 'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}) }, 'auth.permission': { 'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'}, 'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '50'}) }, 'auth.user': { 'Meta': {'object_name': 'User'}, 'date_joined': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}), 'email': ('django.db.models.fields.EmailField', [], {'max_length': '75', 'blank': 'True'}), 'first_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}), 'groups': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Group']", 'symmetrical': 'False', 'blank': 'True'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}), 'is_staff': ('django.db.models.fields.BooleanField', [], {'default': 'False'}), 'is_superuser': ('django.db.models.fields.BooleanField', [], {'default': 'False'}), 'last_login': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}), 'last_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}), 'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}), 'user_permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}), 'username': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '30'}) }, 'contenttypes.contenttype': { 'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"}, 'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '100'}) }, 'otp_hotp.hotpdevice': { 'Meta': {'object_name': 'HOTPDevice'}, 'confirmed': ('django.db.models.fields.BooleanField', [], {'default': 'True'}), 'counter': ('django.db.models.fields.BigIntegerField', [], {'default': '0'}), 'digits': ('django.db.models.fields.PositiveSmallIntegerField', [], {'default': '6'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'key': ('django.db.models.fields.CharField', [], {'default': "'6436c8a792dc6160b5a20d90d57e441762ef3a94'", 'max_length': '80'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '64'}), 'tolerance': ('django.db.models.fields.PositiveSmallIntegerField', [], {'default': '5'}), 'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['auth.User']"}) } } complete_apps = ['otp_hotp']django-otp-0.3.11/django_otp/plugins/otp_hotp/south_migrations/__init__.py0000644000076600000240000000000012566445563027604 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_hotp/templates/0000755000076600000240000000000013060076604024067 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_hotp/templates/otp_hotp/0000755000076600000240000000000013060076604025723 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_hotp/templates/otp_hotp/admin/0000755000076600000240000000000013060076604027013 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_hotp/templates/otp_hotp/admin/config.html0000644000076600000240000000106613056365172031157 0ustar psagersstaff00000000000000{% extends "admin/base_site.html" %} {% block content %}

{{ device.config_url }}

{% endblock %} django-otp-0.3.11/django_otp/plugins/otp_hotp/tests.py0000644000076600000240000000437513056366201023616 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from django.db import IntegrityError from django.test.utils import override_settings from django.utils.six.moves.urllib.parse import urlsplit, parse_qs from django_otp.tests import TestCase class HOTPTest(TestCase): # The next three tokens tokens = [782373, 313268, 307722] def setUp(self): try: alice = self.create_user('alice', 'password') except IntegrityError: self.skipTest("Unable to create test user.") else: self.device = alice.hotpdevice_set.create( key='d2e8a68036f68960b1c30532bb6c56da5934d879', digits=6, tolerance=1, counter=0 ) def test_normal(self): ok = self.device.verify_token(self.tokens[0]) self.assertTrue(ok) self.assertEqual(self.device.counter, 1) def test_normal_drift(self): ok = self.device.verify_token(self.tokens[1]) self.assertTrue(ok) self.assertEqual(self.device.counter, 2) def test_excessive_drift(self): ok = self.device.verify_token(self.tokens[2]) self.assertTrue(not ok) self.assertEqual(self.device.counter, 0) def test_bad_value(self): ok = self.device.verify_token(123456) self.assertTrue(not ok) self.assertEqual(self.device.counter, 0) def test_config_url_no_issuer(self): with override_settings(OTP_HOTP_ISSUER=None): url = self.device.config_url parsed = urlsplit(url) params = parse_qs(parsed.query) self.assertEqual(parsed.scheme, 'otpauth') self.assertEqual(parsed.netloc, 'hotp') self.assertEqual(parsed.path, '/alice') self.assertIn('secret', params) self.assertNotIn('issuer', params) def test_config_url_issuer(self): with override_settings(OTP_HOTP_ISSUER='example.com'): url = self.device.config_url parsed = urlsplit(url) params = parse_qs(parsed.query) self.assertEqual(parsed.scheme, 'otpauth') self.assertEqual(parsed.netloc, 'hotp') self.assertEqual(parsed.path, '/example.com%3Aalice') self.assertIn('secret', params) self.assertIn('issuer', params) django-otp-0.3.11/django_otp/plugins/otp_static/0000755000076600000240000000000013060076604022406 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_static/__init__.py0000644000076600000240000000000012566445563024523 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_static/admin.py0000644000076600000240000000151712644303726024061 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from django.contrib import admin from django.contrib.admin.sites import AlreadyRegistered from .models import StaticDevice, StaticToken class StaticTokenInline(admin.TabularInline): model = StaticToken extra = 0 class StaticDeviceAdmin(admin.ModelAdmin): """ :class:`~django.contrib.admin.ModelAdmin` for :class:`~django_otp.plugins.otp_static.models.StaticDevice`. """ fieldsets = [ ('Identity', { 'fields': ['user', 'name', 'confirmed'], }), ] raw_id_fields = ['user'] inlines = [ StaticTokenInline, ] # Somehow this is getting imported twice, triggering a useless exception. try: admin.site.register(StaticDevice, StaticDeviceAdmin) except AlreadyRegistered: pass django-otp-0.3.11/django_otp/plugins/otp_static/lib.py0000644000076600000240000000156412644303730023534 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals try: from django.contrib.auth import get_user_model except ImportError: from django.contrib.auth.models import User get_user_model = lambda: User from .models import StaticDevice, StaticToken def add_static_token(username, token=None): """ Adds a random static token to the identified user. This is the implementation for the management command of a similar name. Returns the StaticToken object created. """ user = get_user_model().objects.get_by_natural_key(username) device = next(StaticDevice.objects.filter(user=user).iterator(), None) if device is None: device = StaticDevice.objects.create(user=user, name='Backup Code') if token is None: token = StaticToken.random_token() return device.token_set.create(token=token) django-otp-0.3.11/django_otp/plugins/otp_static/management/0000755000076600000240000000000013060076604024522 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_static/management/__init__.py0000644000076600000240000000000012566445563026637 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_static/management/commands/0000755000076600000240000000000013060076604026323 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_static/management/commands/__init__.py0000644000076600000240000000000012566445563030440 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_static/management/commands/addstatictoken.py0000644000076600000240000000221412644303712031675 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from optparse import make_option from textwrap import fill from django.core.management.base import BaseCommand, CommandError from django_otp.plugins.otp_static.lib import get_user_model, add_static_token class Command(BaseCommand): option_list = BaseCommand.option_list + ( make_option('-t', '--token', dest='token', help='The token to add. If omitted, one will be randomly generated.'), ) args = '' help = fill('Adds a single static OTP token to the given user. ' 'The token will be added to an arbitrary static device ' 'attached to the user, creating one if necessary.', width=78) def handle(self, *args, **options): if len(args) != 1: raise CommandError('Please specify exactly one username.') username = args[0] try: statictoken = add_static_token(username, options.get('token')) except get_user_model().DoesNotExist: raise CommandError('User "{0}" does not exist.'.format(username)) self.stdout.write(statictoken.token) django-otp-0.3.11/django_otp/plugins/otp_static/migrations/0000755000076600000240000000000013060076604024562 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_static/migrations/0001_initial.py0000644000076600000240000000274513050737356027244 0ustar psagersstaff00000000000000# -*- coding: utf-8 -*- from __future__ import unicode_literals from django.db import models, migrations from django.conf import settings class Migration(migrations.Migration): dependencies = [ migrations.swappable_dependency(settings.AUTH_USER_MODEL), ] operations = [ migrations.CreateModel( name='StaticDevice', fields=[ ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)), ('name', models.CharField(help_text='The human-readable name of this device.', max_length=64)), ('confirmed', models.BooleanField(default=True, help_text='Is this device ready for use?')), ('user', models.ForeignKey(help_text='The user that this device belongs to.', to=settings.AUTH_USER_MODEL, on_delete=models.CASCADE)), ], options={ 'abstract': False, }, bases=(models.Model,), ), migrations.CreateModel( name='StaticToken', fields=[ ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)), ('token', models.CharField(max_length=16, db_index=True)), ('device', models.ForeignKey(related_name='token_set', to='otp_static.StaticDevice', on_delete=models.CASCADE)), ], options={ }, bases=(models.Model,), ), ] django-otp-0.3.11/django_otp/plugins/otp_static/migrations/__init__.py0000644000076600000240000000000012566445563026677 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_static/models.py0000644000076600000240000000316213050737356024254 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from base64 import b32encode from os import urandom from django.db import models from django_otp.models import Device class StaticDevice(Device): """ A static :class:`~django_otp.models.Device` simply consists of random tokens shared by the database and the user. These are frequently used as emergency tokens in case a user's normal device is lost or unavailable. They can be consumed in any order; each token will be removed from the database as soon as it is used. This model has no fields of its own, but serves as a container for :class:`StaticToken` objects. .. attribute:: token_set The RelatedManager for our tokens. """ def verify_token(self, token): try: match = next(self.token_set.filter(token=token).iterator()) match.delete() except StopIteration: match = None return (match is not None) class StaticToken(models.Model): """ A single token belonging to a :class:`StaticDevice`. .. attribute:: device *ForeignKey*: A foreign key to :class:`StaticDevice`. .. attribute:: token *CharField*: A random string up to 16 characters. """ device = models.ForeignKey(StaticDevice, related_name='token_set', on_delete=models.CASCADE) token = models.CharField(max_length=16, db_index=True) @staticmethod def random_token(): """ Returns a new random string that can be used as a static token. :rtype: str """ return b32encode(urandom(5)).lower() django-otp-0.3.11/django_otp/plugins/otp_static/south_migrations/0000755000076600000240000000000013060076604026004 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_static/south_migrations/0001_initial.py0000644000076600000240000001335212763061045030455 0ustar psagersstaff00000000000000# -*- coding: utf-8 -*- from south.utils import datetime_utils as datetime from south.db import db from south.v2 import SchemaMigration from django.db import models try: from django.contrib.auth import get_user_model except ImportError: from django.contrib.auth.models import User else: User = get_user_model() user_orm_label = '%s.%s' % (User._meta.app_label, User._meta.object_name) user_model_label = '%s.%s' % (User._meta.app_label, User._meta.module_name) class Migration(SchemaMigration): def forwards(self, orm): # Adding model 'StaticDevice' db.create_table('otp_static_staticdevice', ( ('id', self.gf('django.db.models.fields.AutoField')(primary_key=True)), ('user', self.gf('django.db.models.fields.related.ForeignKey')(to=orm[user_orm_label])), ('name', self.gf('django.db.models.fields.CharField')(max_length=64)), ('confirmed', self.gf('django.db.models.fields.BooleanField')(default=True)), )) db.send_create_signal('otp_static', ['StaticDevice']) # Adding model 'StaticToken' db.create_table('otp_static_statictoken', ( ('id', self.gf('django.db.models.fields.AutoField')(primary_key=True)), ('device', self.gf('django.db.models.fields.related.ForeignKey')(related_name='token_set', to=orm['otp_static.StaticDevice'])), ('token', self.gf('django.db.models.fields.CharField')(max_length=16, db_index=True)), )) db.send_create_signal('otp_static', ['StaticToken']) def backwards(self, orm): # Deleting model 'StaticDevice' db.delete_table('otp_static_staticdevice') # Deleting model 'StaticToken' db.delete_table('otp_static_statictoken') models = { 'auth.group': { 'Meta': {'object_name': 'Group'}, 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}), 'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}) }, 'auth.permission': { 'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'}, 'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '50'}) }, user_model_label: { 'Meta': {'object_name': User.__name__, 'db_table': "'%s'" % User._meta.db_table}, 'date_joined': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}), 'email': ('django.db.models.fields.EmailField', [], {'max_length': '75', 'blank': 'True'}), 'first_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}), 'groups': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Group']", 'symmetrical': 'False', 'blank': 'True'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}), 'is_staff': ('django.db.models.fields.BooleanField', [], {'default': 'False'}), 'is_superuser': ('django.db.models.fields.BooleanField', [], {'default': 'False'}), 'last_login': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}), 'last_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}), 'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}), 'user_permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}), 'username': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '30'}) }, 'contenttypes.contenttype': { 'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"}, 'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '100'}) }, 'otp_static.staticdevice': { 'Meta': {'object_name': 'StaticDevice'}, 'confirmed': ('django.db.models.fields.BooleanField', [], {'default': 'True'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '64'}), 'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm[user_orm_label]"}) }, 'otp_static.statictoken': { 'Meta': {'object_name': 'StaticToken'}, 'device': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'token_set'", 'to': "orm['otp_static.StaticDevice']"}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'token': ('django.db.models.fields.CharField', [], {'max_length': '16', 'db_index': 'True'}) } } complete_apps = ['otp_static']django-otp-0.3.11/django_otp/plugins/otp_static/south_migrations/__init__.py0000644000076600000240000000000012566445563030121 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_static/tests.py0000644000076600000240000001233212644303737024132 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from django.db import IntegrityError from django_otp.forms import OTPAuthenticationForm from django_otp.tests import TestCase from .lib import add_static_token from .models import StaticDevice class DeviceTest(TestCase): """ A few generic tests to get us started. """ def setUp(self): try: self.user = self.create_user('alice', 'password') except Exception: self.skipTest("Unable to create the test user.") def test_str(self): device = StaticDevice.objects.create(user=self.user, name="Device") str(device) def test_str_unpopulated(self): device = StaticDevice() str(device) class LibTest(TestCase): """ Test miscellaneous library functions. """ def setUp(self): try: self.user = self.create_user('alice', 'password') except Exception: self.skipTest("Unable to create the test user.") def test_add_static_token(self): statictoken = add_static_token('alice') self.assertEqual(statictoken.device.user, self.user) self.assertEqual(self.user.staticdevice_set.count(), 1) def test_add_static_token_existing_device(self): self.user.staticdevice_set.create(name='Test') statictoken = add_static_token('alice') self.assertEqual(statictoken.device.user, self.user) self.assertEqual(self.user.staticdevice_set.count(), 1) self.assertEqual(statictoken.device.name, 'Test') def test_add_static_token_no_user(self): with self.assertRaises(self.User.DoesNotExist): add_static_token('bogus') def test_add_static_token_specific(self): statictoken = add_static_token('alice', 'token') self.assertEqual(statictoken.token, 'token') class AuthFormTest(TestCase): """ Test the auth form with static tokens. We try to honor custom user models, but if we can't create users, we'll skip the tests. """ def setUp(self): for device_id, username in enumerate(['alice', 'bob']): try: user = self.create_user(username, 'password') except IntegrityError: self.skipTest("Unable to create a test user.") else: device = user.staticdevice_set.create(id=device_id + 1) device.token_set.create(token=username + '1') device.token_set.create(token=username + '1') device.token_set.create(token=username + '2') def test_empty(self): data = {} form = OTPAuthenticationForm(None, data) self.assertTrue(not form.is_valid()) self.assertEqual(form.get_user(), None) def test_bad_password(self): data = { 'username': 'alice', 'password': 'bogus', } form = OTPAuthenticationForm(None, data) self.assertTrue(not form.is_valid()) self.assertTrue(form.get_user() is None) self.assertEqual(list(form.errors.keys()), ['__all__']) def test_no_token(self): data = { 'username': 'alice', 'password': 'password', } form = OTPAuthenticationForm(None, data) self.assertTrue(not form.is_valid()) self.assertTrue(form.get_user().get_username() == 'alice') def test_passive_token(self): data = { 'username': 'alice', 'password': 'password', 'otp_token': 'alice1', } form = OTPAuthenticationForm(None, data) self.assertTrue(form.is_valid()) alice = form.get_user() self.assertTrue(alice.get_username() == 'alice') self.assertTrue(isinstance(alice.otp_device, StaticDevice)) self.assertEqual(alice.otp_device.token_set.count(), 2) def test_spoofed_device(self): data = { 'username': 'alice', 'password': 'password', 'otp_device': 'django_otp.plugins.otp_static.models.StaticDevice/2', 'otp_token': 'bob1', } form = OTPAuthenticationForm(None, data) self.assertTrue(not form.is_valid()) alice = form.get_user() self.assertTrue(alice.get_username() == 'alice') self.assertTrue(alice.otp_device is None) def test_specific_device_fail(self): data = { 'username': 'alice', 'password': 'password', 'otp_device': 'django_otp.plugins.otp_email.models.StaticDevice/1', 'otp_token': 'bogus', } form = OTPAuthenticationForm(None, data) self.assertTrue(not form.is_valid()) alice = form.get_user() self.assertTrue(alice.get_username() == 'alice') self.assertTrue(alice.otp_device is None) def test_specific_device(self): data = { 'username': 'alice', 'password': 'password', 'otp_device': 'django_otp.plugins.otp_static.models.StaticDevice/1', 'otp_token': 'alice1', } form = OTPAuthenticationForm(None, data) self.assertTrue(form.is_valid()) alice = form.get_user() self.assertTrue(alice.get_username() == 'alice') self.assertTrue(alice.otp_device is not None) django-otp-0.3.11/django_otp/plugins/otp_totp/0000755000076600000240000000000013060076604022105 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_totp/__init__.py0000644000076600000240000000000012566445563024222 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_totp/admin.py0000644000076600000240000000577613060075517023570 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from django.conf.urls import url from django.contrib import admin from django.contrib.admin.sites import AlreadyRegistered from django.core.urlresolvers import reverse from django.http import HttpResponse from django.template.response import TemplateResponse from django.utils.html import format_html from .models import TOTPDevice class TOTPDeviceAdmin(admin.ModelAdmin): """ :class:`~django.contrib.admin.ModelAdmin` for :class:`~django_otp.plugins.otp_totp.models.TOTPDevice`. """ list_display = ['user', 'name', 'confirmed', 'qrcode_link'] fieldsets = [ ('Identity', { 'fields': ['user', 'name', 'confirmed'], }), ('Configuration', { 'fields': ['key', 'step', 't0', 'digits', 'tolerance'], }), ('State', { 'fields': ['drift'], }), (None, { 'fields': ['qrcode_link'], }), ] raw_id_fields = ['user'] readonly_fields = ['qrcode_link'] radio_fields = {'digits': admin.HORIZONTAL} def get_queryset(self, request): queryset = super(TOTPDeviceAdmin, self).get_queryset(request) queryset = queryset.select_related('user') return queryset # # Columns # def qrcode_link(self, device): try: href = reverse('admin:otp_totp_totpdevice_config', kwargs={'pk': device.pk}) link = format_html('qrcode', href) except Exception: link = '' return link qrcode_link.short_description = "QR Code" # # Custom views # def get_urls(self): urls = [ url(r'^(?P\d+)/config/$', self.admin_site.admin_view(self.config_view), name='otp_totp_totpdevice_config'), url(r'^(?P\d+)/qrcode/$', self.admin_site.admin_view(self.qrcode_view), name='otp_totp_totpdevice_qrcode'), ] + super(TOTPDeviceAdmin, self).get_urls() return urls def config_view(self, request, pk): device = TOTPDevice.objects.get(pk=pk) try: context = dict( self.admin_site.each_context(request), device=device, ) except AttributeError: # Older versions don't have each_context(). context = {'device': device} return TemplateResponse(request, 'otp_totp/admin/config.html', context) def qrcode_view(self, request, pk): device = TOTPDevice.objects.get(pk=pk) try: import qrcode import qrcode.image.svg img = qrcode.make(device.config_url, image_factory=qrcode.image.svg.SvgImage) response = HttpResponse(content_type='image/svg+xml') img.save(response) except ImportError: response = HttpResponse('', status=503) return response try: admin.site.register(TOTPDevice, TOTPDeviceAdmin) except AlreadyRegistered: # A useless exception from a double import pass django-otp-0.3.11/django_otp/plugins/otp_totp/migrations/0000755000076600000240000000000013060076604024261 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_totp/migrations/0001_initial.py0000644000076600000240000000417613016627574026745 0ustar psagersstaff00000000000000# -*- coding: utf-8 -*- from __future__ import unicode_literals from django.db import models, migrations import django_otp.plugins.otp_totp.models from django.conf import settings class Migration(migrations.Migration): dependencies = [ migrations.swappable_dependency(settings.AUTH_USER_MODEL), ] operations = [ migrations.CreateModel( name='TOTPDevice', fields=[ ('id', models.AutoField(verbose_name='ID', serialize=False, auto_created=True, primary_key=True)), ('name', models.CharField(help_text='The human-readable name of this device.', max_length=64)), ('confirmed', models.BooleanField(default=True, help_text='Is this device ready for use?')), ('key', models.CharField(default=django_otp.plugins.otp_totp.models.default_key, help_text='A hex-encoded secret key of up to 40 bytes.', max_length=80, validators=[django_otp.plugins.otp_totp.models.key_validator])), ('step', models.PositiveSmallIntegerField(default=30, help_text='The time step in seconds.')), ('t0', models.BigIntegerField(default=0, help_text='The Unix time at which to begin counting steps.')), ('digits', models.PositiveSmallIntegerField(default=6, help_text='The number of digits to expect in a token.', choices=[(6, 6), (8, 8)])), ('tolerance', models.PositiveSmallIntegerField(default=1, help_text='The number of time steps in the past or future to allow.')), ('drift', models.SmallIntegerField(default=0, help_text='The number of time steps the prover is known to deviate from our clock.')), ('last_t', models.BigIntegerField(default=-1, help_text='The t value of the latest verified token. The next token must be at a higher time step.')), ('user', models.ForeignKey(help_text='The user that this device belongs to.', to=settings.AUTH_USER_MODEL, on_delete=models.CASCADE)), ], options={ 'abstract': False, 'verbose_name': 'TOTP device', }, bases=(models.Model,), ), ] django-otp-0.3.11/django_otp/plugins/otp_totp/migrations/__init__.py0000644000076600000240000000000012566445563026376 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_totp/models.py0000644000076600000240000001133613056356226023754 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from base64 import b32encode from binascii import unhexlify import time from django.conf import settings from django.db import models from django.utils.encoding import force_text from django.utils.six import string_types from django.utils.six.moves.urllib.parse import quote, urlencode from django_otp.models import Device from django_otp.oath import TOTP from django_otp.util import random_hex, hex_validator def default_key(): return force_text(random_hex(20)) def key_validator(value): return hex_validator()(value) class TOTPDevice(Device): """ A generic TOTP :class:`~django_otp.models.Device`. The model fields mostly correspond to the arguments to :func:`django_otp.oath.totp`. They all have sensible defaults, including the key, which is randomly generated. .. attribute:: key *CharField*: A hex-encoded secret key of up to 40 bytes. (Default: 20 random bytes) .. attribute:: step *PositiveSmallIntegerField*: The time step in seconds. (Default: 30) .. attribute:: t0 *BigIntegerField*: The Unix time at which to begin counting steps. (Default: 0) .. attribute:: digits *PositiveSmallIntegerField*: The number of digits to expect in a token (6 or 8). (Default: 6) .. attribute:: tolerance *PositiveSmallIntegerField*: The number of time steps in the past or future to allow. For example, if this is 1, we'll accept any of three tokens: the current one, the previous one, and the next one. (Default: 1) .. attribute:: drift *SmallIntegerField*: The number of time steps the prover is known to deviate from our clock. If :setting:`OTP_TOTP_SYNC` is ``True``, we'll update this any time we match a token that is not the current one. (Default: 0) .. attribute:: last_t *BigIntegerField*: The time step of the last verified token. To avoid verifying the same token twice, this will be updated on each successful verification. Only tokens at a higher time step will be verified subsequently. (Default: -1) """ key = models.CharField(max_length=80, validators=[key_validator], default=default_key, help_text="A hex-encoded secret key of up to 40 bytes.") step = models.PositiveSmallIntegerField(default=30, help_text="The time step in seconds.") t0 = models.BigIntegerField(default=0, help_text="The Unix time at which to begin counting steps.") digits = models.PositiveSmallIntegerField(choices=[(6, 6), (8, 8)], default=6, help_text="The number of digits to expect in a token.") tolerance = models.PositiveSmallIntegerField(default=1, help_text="The number of time steps in the past or future to allow.") drift = models.SmallIntegerField(default=0, help_text="The number of time steps the prover is known to deviate from our clock.") last_t = models.BigIntegerField(default=-1, help_text="The t value of the latest verified token. The next token must be at a higher time step.") class Meta(Device.Meta): verbose_name = "TOTP device" @property def bin_key(self): """ The secret key as a binary string. """ return unhexlify(self.key.encode()) def verify_token(self, token): OTP_TOTP_SYNC = getattr(settings, 'OTP_TOTP_SYNC', True) try: token = int(token) except Exception: verified = False else: key = self.bin_key totp = TOTP(key, self.step, self.t0, self.digits, self.drift) totp.time = time.time() verified = totp.verify(token, self.tolerance, self.last_t + 1) if verified: self.last_t = totp.t() if OTP_TOTP_SYNC: self.drift = totp.drift self.save() return verified @property def config_url(self): """ A URL for configuring Google Authenticator or similar. See https://github.com/google/google-authenticator/wiki/Key-Uri-Format. The issuer is taken from :setting:`OTP_TOTP_ISSUER`, if available. """ label = self.user.get_username() params = { 'secret': b32encode(self.bin_key), 'algorithm': 'SHA1', 'digits': self.digits, 'period': self.step, } issuer = getattr(settings, 'OTP_TOTP_ISSUER', None) if isinstance(issuer, string_types) and (issuer != ''): issuer = issuer.replace(':', '') params['issuer'] = issuer label = '{}:{}'.format(issuer, label) url = 'otpauth://totp/{}?{}'.format(quote(label), urlencode(params)) return url django-otp-0.3.11/django_otp/plugins/otp_totp/south_migrations/0000755000076600000240000000000013060076604025503 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_totp/south_migrations/0001_initial.py0000644000076600000240000001364212606546043030160 0ustar psagersstaff00000000000000# -*- coding: utf-8 -*- from south.db import db from south.v2 import SchemaMigration from django.db import models try: from django.contrib.auth import get_user_model except ImportError: from django.contrib.auth.models import User else: User = get_user_model() user_orm_label = '%s.%s' % (User._meta.app_label, User._meta.object_name) user_model_label = '%s.%s' % (User._meta.app_label, User._meta.module_name) class Migration(SchemaMigration): def forwards(self, orm): # Adding model 'TOTPDevice' db.create_table('otp_totp_totpdevice', ( ('id', self.gf('django.db.models.fields.AutoField')(primary_key=True)), ('user', self.gf('django.db.models.fields.related.ForeignKey')(to=orm[user_orm_label])), ('name', self.gf('django.db.models.fields.CharField')(max_length=64)), ('confirmed', self.gf('django.db.models.fields.BooleanField')(default=True)), ('key', self.gf('django.db.models.fields.CharField')(default='31ca700ecf99ed44834f088dca5c933e361eb126', max_length=80)), ('step', self.gf('django.db.models.fields.PositiveSmallIntegerField')(default=30)), ('t0', self.gf('django.db.models.fields.BigIntegerField')(default=0)), ('digits', self.gf('django.db.models.fields.PositiveSmallIntegerField')(default=6)), ('tolerance', self.gf('django.db.models.fields.PositiveSmallIntegerField')(default=1)), ('drift', self.gf('django.db.models.fields.SmallIntegerField')(default=0)), )) db.send_create_signal('otp_totp', ['TOTPDevice']) def backwards(self, orm): # Deleting model 'TOTPDevice' db.delete_table('otp_totp_totpdevice') models = { 'auth.group': { 'Meta': {'object_name': 'Group'}, 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}), 'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}) }, 'auth.permission': { 'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'}, 'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '50'}) }, user_model_label: { 'Meta': {'object_name': User.__name__, 'db_table': "'%s'" % User._meta.db_table}, 'date_joined': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}), 'email': ('django.db.models.fields.EmailField', [], {'max_length': '75', 'blank': 'True'}), 'first_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}), 'groups': ('django.db.models.fields.related.ManyToManyField', [], {'symmetrical': 'False', 'related_name': "'user_set'", 'blank': 'True', 'to': "orm['auth.Group']"}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}), 'is_staff': ('django.db.models.fields.BooleanField', [], {'default': 'False'}), 'is_superuser': ('django.db.models.fields.BooleanField', [], {'default': 'False'}), 'last_login': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}), 'last_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}), 'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}), 'user_permissions': ('django.db.models.fields.related.ManyToManyField', [], {'symmetrical': 'False', 'related_name': "'user_set'", 'blank': 'True', 'to': "orm['auth.Permission']"}), 'username': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '30'}) }, 'contenttypes.contenttype': { 'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"}, 'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '100'}) }, 'otp_totp.totpdevice': { 'Meta': {'object_name': 'TOTPDevice'}, 'confirmed': ('django.db.models.fields.BooleanField', [], {'default': 'True'}), 'digits': ('django.db.models.fields.PositiveSmallIntegerField', [], {'default': '6'}), 'drift': ('django.db.models.fields.SmallIntegerField', [], {'default': '0'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'key': ('django.db.models.fields.CharField', [], {'default': "'b60739965a1f4b2a6636036f03da754a2ad2375d'", 'max_length': '80'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '64'}), 'step': ('django.db.models.fields.PositiveSmallIntegerField', [], {'default': '30'}), 't0': ('django.db.models.fields.BigIntegerField', [], {'default': '0'}), 'tolerance': ('django.db.models.fields.PositiveSmallIntegerField', [], {'default': '1'}), 'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm[user_orm_label]"}) } } complete_apps = ['otp_totp'] django-otp-0.3.11/django_otp/plugins/otp_totp/south_migrations/0002_last_t.py0000644000076600000240000001223212566445563030022 0ustar psagersstaff00000000000000# -*- coding: utf-8 -*- from south.db import db from south.v2 import SchemaMigration from django.db import models try: from django.contrib.auth import get_user_model except ImportError: from django.contrib.auth.models import User else: User = get_user_model() user_orm_label = '%s.%s' % (User._meta.app_label, User._meta.object_name) user_model_label = '%s.%s' % (User._meta.app_label, User._meta.module_name) class Migration(SchemaMigration): def forwards(self, orm): # Adding field 'TOTPDevice.last_t' db.add_column('otp_totp_totpdevice', 'last_t', self.gf('django.db.models.fields.BigIntegerField')(default=-1), keep_default=False) def backwards(self, orm): # Deleting field 'TOTPDevice.last_t' db.delete_column('otp_totp_totpdevice', 'last_t') models = { 'auth.group': { 'Meta': {'object_name': 'Group'}, 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}), 'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}) }, 'auth.permission': { 'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'}, 'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '50'}) }, user_model_label: { 'Meta': {'object_name': User.__name__, 'db_table': "'%s'" % User._meta.db_table}, 'date_joined': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}), 'email': ('django.db.models.fields.EmailField', [], {'max_length': '75', 'blank': 'True'}), 'first_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}), 'groups': ('django.db.models.fields.related.ManyToManyField', [], {'symmetrical': 'False', 'related_name': "'user_set'", 'blank': 'True', 'to': "orm['auth.Group']"}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}), 'is_staff': ('django.db.models.fields.BooleanField', [], {'default': 'False'}), 'is_superuser': ('django.db.models.fields.BooleanField', [], {'default': 'False'}), 'last_login': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}), 'last_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}), 'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}), 'user_permissions': ('django.db.models.fields.related.ManyToManyField', [], {'symmetrical': 'False', 'related_name': "'user_set'", 'blank': 'True', 'to': "orm['auth.Permission']"}), 'username': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '30'}) }, 'contenttypes.contenttype': { 'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"}, 'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '100'}) }, 'otp_totp.totpdevice': { 'Meta': {'object_name': 'TOTPDevice'}, 'confirmed': ('django.db.models.fields.BooleanField', [], {'default': 'True'}), 'digits': ('django.db.models.fields.PositiveSmallIntegerField', [], {'default': '6'}), 'drift': ('django.db.models.fields.SmallIntegerField', [], {'default': '0'}), 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}), 'key': ('django.db.models.fields.CharField', [], {'default': "'75f9de9f45165c34419e00a46ca41762c1fe4583'", 'max_length': '80'}), 'last_t': ('django.db.models.fields.BigIntegerField', [], {'default': '-1'}), 'name': ('django.db.models.fields.CharField', [], {'max_length': '64'}), 'step': ('django.db.models.fields.PositiveSmallIntegerField', [], {'default': '30'}), 't0': ('django.db.models.fields.BigIntegerField', [], {'default': '0'}), 'tolerance': ('django.db.models.fields.PositiveSmallIntegerField', [], {'default': '1'}), 'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm[user_orm_label]"}) } } complete_apps = ['otp_totp'] django-otp-0.3.11/django_otp/plugins/otp_totp/south_migrations/__init__.py0000644000076600000240000000000012566445563027620 0ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_totp/templates/0000755000076600000240000000000013060076604024103 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_totp/templates/otp_totp/0000755000076600000240000000000013060076604025753 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_totp/templates/otp_totp/admin/0000755000076600000240000000000013060076604027043 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/plugins/otp_totp/templates/otp_totp/admin/config.html0000644000076600000240000000106613056364616031211 0ustar psagersstaff00000000000000{% extends "admin/base_site.html" %} {% block content %}

{{ device.config_url }}

{% endblock %} django-otp-0.3.11/django_otp/plugins/otp_totp/tests.py0000644000076600000240000000621013056366151023624 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from time import time from django.db import IntegrityError from django.test.utils import override_settings from django.utils.six.moves.urllib.parse import urlsplit, parse_qs from django_otp.tests import TestCase @override_settings(OTP_TOTP_SYNC=False) class TOTPTest(TestCase): # The next ten tokens tokens = [179225, 656163, 839400, 154567, 346912, 471576, 45675, 101397, 491039, 784503] def setUp(self): """ Create a device at the fourth time step. The current token is 154567. """ try: self.alice = self.create_user('alice', 'password') except IntegrityError: self.skipTest("Unable to create the test user.") else: self.device = self.alice.totpdevice_set.create( key='2a2bbba1092ffdd25a328ad1a0a5f5d61d7aacc4', step=30, t0=int(time() - (30 * 3)), digits=6, tolerance=0, drift=0 ) def test_default_key(self): device = self.alice.totpdevice_set.create() # Make sure we can decode the key. device.bin_key def test_single(self): results = [self.device.verify_token(token) for token in self.tokens] self.assertEqual(results, [False] * 3 + [True] + [False] * 6) def test_tolerance(self): self.device.tolerance = 1 results = [self.device.verify_token(token) for token in self.tokens] self.assertEqual(results, [False] * 2 + [True] * 3 + [False] * 5) def test_drift(self): self.device.tolerance = 1 self.device.drift = -1 results = [self.device.verify_token(token) for token in self.tokens] self.assertEqual(results, [False] * 1 + [True] * 3 + [False] * 6) def test_sync_drift(self): self.device.tolerance = 2 with self.settings(OTP_TOTP_SYNC=True): ok = self.device.verify_token(self.tokens[5]) self.assertTrue(ok) self.assertEqual(self.device.drift, 2) def test_no_reuse(self): verified1 = self.device.verify_token(self.tokens[3]) verified2 = self.device.verify_token(self.tokens[3]) self.assertEqual(self.device.last_t, 3) self.assertTrue(verified1) self.assertFalse(verified2) def test_config_url(self): with override_settings(OTP_TOTP_ISSUER=None): url = self.device.config_url parsed = urlsplit(url) params = parse_qs(parsed.query) self.assertEqual(parsed.scheme, 'otpauth') self.assertEqual(parsed.netloc, 'totp') self.assertEqual(parsed.path, '/alice') self.assertIn('secret', params) self.assertNotIn('issuer', params) def test_config_url_issuer(self): with override_settings(OTP_TOTP_ISSUER='example.com'): url = self.device.config_url parsed = urlsplit(url) params = parse_qs(parsed.query) self.assertEqual(parsed.scheme, 'otpauth') self.assertEqual(parsed.netloc, 'totp') self.assertEqual(parsed.path, '/example.com%3Aalice') self.assertIn('secret', params) self.assertIn('issuer', params) django-otp-0.3.11/django_otp/templates/0000755000076600000240000000000013060076604020552 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/templates/otp/0000755000076600000240000000000013060076604021354 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/templates/otp/admin14/0000755000076600000240000000000013060076604022611 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/templates/otp/admin14/login.html0000644000076600000240000000504412606537704024622 0ustar psagersstaff00000000000000{% extends "admin/base_site.html" %} {% load i18n admin_static %} {% load url from future %} {% block extrastyle %}{{ block.super }}{% endblock %} {% block bodyclass %}login{% endblock %} {% block nav-global %}{% endblock %} {% block content_title %}{% endblock %} {% block breadcrumbs %}{% endblock %} {% block content %} {% if form.errors and not form.non_field_errors and not form.this_is_the_login_form.errors %}

{% blocktrans count counter=form.errors.items|length %}Please correct the error below.{% plural %}Please correct the errors below.{% endblocktrans %}

{% endif %} {% if form.non_field_errors or form.this_is_the_login_form.errors %} {% for error in form.non_field_errors|add:form.this_is_the_login_form.errors %}

{{ error }}

{% endfor %} {% endif %}
{% csrf_token %}
{% if not form.this_is_the_login_form.errors %}{{ form.username.errors }}{% endif %} {{ form.username }}
{% if not form.this_is_the_login_form.errors %}{{ form.password.errors }}{% endif %} {{ form.password }}
{% if form.get_user %}
{{ form.otp_device }}
{% endif %}
{% if not form.this_is_the_login_form.errors %}{{ form.otp_token.errors }}{% endif %} {{ form.otp_token }}
{% url 'admin_password_reset' as password_reset_url %} {% if password_reset_url %}
{% trans 'Forgotten your password or username?' %}
{% endif %}
{% if form.get_user %} {% endif %}
{% endblock %} django-otp-0.3.11/django_otp/templates/otp/admin15/0000755000076600000240000000000013060076604022612 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/templates/otp/admin15/login.html0000644000076600000240000000501412566445563024626 0ustar psagersstaff00000000000000{% extends "admin/base_site.html" %} {% load i18n admin_static %} {% block extrastyle %}{{ block.super }}{% endblock %} {% block bodyclass %}login{% endblock %} {% block nav-global %}{% endblock %} {% block content_title %}{% endblock %} {% block breadcrumbs %}{% endblock %} {% block content %} {% if form.errors and not form.non_field_errors and not form.this_is_the_login_form.errors %}

{% blocktrans count counter=form.errors.items|length %}Please correct the error below.{% plural %}Please correct the errors below.{% endblocktrans %}

{% endif %} {% if form.non_field_errors or form.this_is_the_login_form.errors %} {% for error in form.non_field_errors|add:form.this_is_the_login_form.errors %}

{{ error }}

{% endfor %} {% endif %}
{% csrf_token %}
{% if not form.this_is_the_login_form.errors %}{{ form.username.errors }}{% endif %} {{ form.username }}
{% if not form.this_is_the_login_form.errors %}{{ form.password.errors }}{% endif %} {{ form.password }}
{% if form.get_user %}
{{ form.otp_device }}
{% endif %}
{% if not form.this_is_the_login_form.errors %}{{ form.otp_token.errors }}{% endif %} {{ form.otp_token }}
{% url 'admin_password_reset' as password_reset_url %} {% if password_reset_url %}
{% trans 'Forgotten your password or username?' %}
{% endif %}
{% if form.get_user %} {% endif %}
{% endblock %} django-otp-0.3.11/django_otp/templates/otp/admin16/0000755000076600000240000000000013060076604022613 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/templates/otp/admin16/login.html0000644000076600000240000000553412566445563024636 0ustar psagersstaff00000000000000{% extends "admin/base_site.html" %} {% load i18n admin_static %} {% block extrastyle %} {{ block.super }} {% endblock %} {% block bodyclass %}login{% endblock %} {% block nav-global %}{% endblock %} {% block content_title %}{% endblock %} {% block breadcrumbs %}{% endblock %} {% block content %} {% if form.errors and not form.non_field_errors and not form.this_is_the_login_form.errors %}

{% if form.errors.items|length == 1 %}{% trans "Please correct the error below." %}{% else %}{% trans "Please correct the errors below." %}{% endif %}

{% endif %} {% if form.non_field_errors or form.this_is_the_login_form.errors %} {% for error in form.non_field_errors|add:form.this_is_the_login_form.errors %}

{{ error }}

{% endfor %} {% endif %}
{% csrf_token %}
{% if not form.this_is_the_login_form.errors %}{{ form.username.errors }}{% endif %} {{ form.username }}
{% if not form.this_is_the_login_form.errors %}{{ form.password.errors }}{% endif %} {{ form.password }}
{% if form.get_user %}
{{ form.otp_device }}
{% endif %}
{% if not form.this_is_the_login_form.errors %}{{ form.otp_token.errors }}{% endif %} {{ form.otp_token }}
{% url 'admin_password_reset' as password_reset_url %} {% if password_reset_url %}
{% trans 'Forgotten your password or username?' %}
{% endif %}
{% if form.get_user %} {% endif %}
{% endblock %} django-otp-0.3.11/django_otp/templates/otp/admin17/0000755000076600000240000000000013060076604022614 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/templates/otp/admin17/login.html0000644000076600000240000000507612606544007024624 0ustar psagersstaff00000000000000{% extends "admin/base_site.html" %} {% load i18n admin_static %} {% block extrastyle %} {{ block.super }} {% endblock %} {% block bodyclass %}{{ block.super }} login{% endblock %} {% block nav-global %}{% endblock %} {% block content_title %}{% endblock %} {% block breadcrumbs %}{% endblock %} {% block content %} {% if form.errors and not form.non_field_errors %}

{% if form.errors.items|length == 1 %}{% trans "Please correct the error below." %}{% else %}{% trans "Please correct the errors below." %}{% endif %}

{% endif %} {% if form.non_field_errors %} {% for error in form.non_field_errors %}

{{ error }}

{% endfor %} {% endif %}
{% csrf_token %}
{{ form.username.errors }} {{ form.username }}
{{ form.password.errors }} {{ form.password }}
{% if form.get_user %}
{{ form.otp_device }}
{% endif %}
{% if not form.this_is_the_login_form.errors %}{{ form.otp_token.errors }}{% endif %} {{ form.otp_token }}
{% url 'admin_password_reset' as password_reset_url %} {% if password_reset_url %}
{% trans 'Forgotten your password or username?' %}
{% endif %}
{% if form.get_user %} {% endif %}
{% endblock %} django-otp-0.3.11/django_otp/templates/otp/admin18/0000755000076600000240000000000013060076604022615 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/templates/otp/admin18/login.html0000644000076600000240000000501012606542766024623 0ustar psagersstaff00000000000000{% extends "admin/base_site.html" %} {% load i18n admin_static %} {% block extrastyle %} {{ block.super }} {% endblock %} {% block bodyclass %}{{ block.super }} login{% endblock %} {% block usertools %}{% endblock %} {% block nav-global %}{% endblock %} {% block content_title %}{% endblock %} {% block breadcrumbs %}{% endblock %} {% block content %} {% if form.errors and not form.non_field_errors %}

{% if form.errors.items|length == 1 %}{% trans "Please correct the error below." %}{% else %}{% trans "Please correct the errors below." %}{% endif %}

{% endif %} {% if form.non_field_errors %} {% for error in form.non_field_errors %}

{{ error }}

{% endfor %} {% endif %}
{% csrf_token %}
{{ form.username.errors }} {{ form.username.label_tag }} {{ form.username }}
{{ form.password.errors }} {{ form.password.label_tag }} {{ form.password }}
{% if form.get_user %}
{{ form.otp_device }}
{% endif %}
{% if not form.this_is_the_login_form.errors %}{{ form.otp_token.errors }}{% endif %} {{ form.otp_token }}
{% url 'admin_password_reset' as password_reset_url %} {% if password_reset_url %}
{% trans 'Forgotten your password or username?' %}
{% endif %}
{% if form.get_user %} {% endif %}
{% endblock %} django-otp-0.3.11/django_otp/templates/otp/admin19/0000755000076600000240000000000013060076604022616 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp/templates/otp/admin19/login.html0000644000076600000240000000550312606544023024617 0ustar psagersstaff00000000000000{% extends "admin/base_site.html" %} {% load i18n admin_static %} {% block extrastyle %} {{ block.super }} {{ form.media }} {% endblock %} {% block bodyclass %}{{ block.super }} login{% endblock %} {% block usertools %}{% endblock %} {% block nav-global %}{% endblock %} {% block content_title %}{% endblock %} {% block breadcrumbs %}{% endblock %} {% block content %} {% if form.errors and not form.non_field_errors %}

{% if form.errors.items|length == 1 %}{% trans "Please correct the error below." %}{% else %}{% trans "Please correct the errors below." %}{% endif %}

{% endif %} {% if form.non_field_errors %} {% for error in form.non_field_errors %}

{{ error }}

{% endfor %} {% endif %}
{% if user.is_authenticated %}

{% blocktrans with username=request.user.username trimmed %} You are authenticated as {{ username }}, but are not authorized to access this page. Would you like to login to a different account? {% endblocktrans %}

{% endif %}
{% csrf_token %}
{{ form.username.errors }} {{ form.username.label_tag }} {{ form.username }}
{{ form.password.errors }} {{ form.password.label_tag }} {{ form.password }}
{% if form.get_user %}
{{ form.otp_device }}
{% endif %}
{% if not form.this_is_the_login_form.errors %}{{ form.otp_token.errors }}{% endif %} {{ form.otp_token }}
{% url 'admin_password_reset' as password_reset_url %} {% if password_reset_url %}
{% trans 'Forgotten your password or username?' %}
{% endif %}
{% if form.get_user %} {% endif %}
{% endblock %} django-otp-0.3.11/django_otp/tests.py0000644000076600000240000000306412644533120020271 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from doctest import DocTestSuite import django import django.test from django_otp import oath from django_otp import util if django.VERSION < (1, 7): from django.utils import unittest else: import unittest def load_tests(loader, tests, pattern): suite = unittest.TestSuite() suite.addTests(tests) suite.addTest(DocTestSuite(util)) suite.addTest(DocTestSuite(oath)) return suite class TestCase(django.test.TestCase): """ Utilities for dealing with custom user models. """ @classmethod def setUpClass(cls): super(TestCase, cls).setUpClass() try: from django.contrib.auth import get_user_model except ImportError: from django.contrib.auth.models import User cls.User = User cls.User.get_username = lambda self: self.username cls.USERNAME_FIELD = 'username' else: cls.User = get_user_model() cls.USERNAME_FIELD = cls.User.USERNAME_FIELD def create_user(self, username, password): """ Try to create a user, honoring the custom user model, if any. This may raise an exception if the user model is too exotic for our purposes. """ try: user = self.User.objects.create_user(username, password=password) except TypeError: # Django < 1.4 user = self.User.objects.create_user(username, email='user@example.com', password=password) return user django-otp-0.3.11/django_otp/util.py0000644000076600000240000000403012644304004020073 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from binascii import hexlify, unhexlify from os import urandom from django.core.exceptions import ValidationError from django.utils import six def hex_validator(length=0): """ Returns a function to be used as a model validator for a hex-encoded CharField. This is useful for secret keys of all kinds:: def key_validator(value): return hex_validator(20)(value) key = models.CharField(max_length=40, validators=[key_validator], help_text=u'A hex-encoded 20-byte secret key') :param int length: If greater than 0, validation will fail unless the decoded value is exactly this number of bytes. :rtype: function >>> hex_validator()('0123456789abcdef') >>> hex_validator(8)(b'0123456789abcdef') >>> hex_validator()('phlebotinum') # doctest: +IGNORE_EXCEPTION_DETAIL Traceback (most recent call last): ... ValidationError: ['phlebotinum is not valid hex-encoded data.'] >>> hex_validator(9)('0123456789abcdef') # doctest: +IGNORE_EXCEPTION_DETAIL Traceback (most recent call last): ... ValidationError: ['0123456789abcdef does not represent exactly 9 bytes.'] """ def _validator(value): try: if isinstance(value, six.text_type): value = value.encode() unhexlify(value) except Exception: raise ValidationError('{0} is not valid hex-encoded data.'.format(value)) if (length > 0) and (len(value) != length * 2): raise ValidationError('{0} does not represent exactly {1} bytes.'.format(value, length)) return _validator def random_hex(length=20): """ Returns a string of random bytes encoded as hex. This uses :func:`os.urandom`, so it should be suitable for generating cryptographic keys. :param int length: The number of (decoded) bytes to return. :returns: A string of hex digits. :rtype: str """ return hexlify(urandom(length)) django-otp-0.3.11/django_otp/views.py0000644000076600000240000000274213016631012020257 0ustar psagersstaff00000000000000from __future__ import absolute_import, division, print_function, unicode_literals from functools import partial from django.contrib.auth import BACKEND_SESSION_KEY from django.contrib.auth.views import login as auth_login from django_otp import _user_is_anonymous from django_otp.forms import OTPAuthenticationForm, OTPTokenForm def login(request, **kwargs): """ This is a replacement for :func:`django.contrib.auth.views.login` that requires two-factor authentication. It's slightly clever: if the user is already authenticated but not verified, it will only ask the user for their OTP token. If the user is anonymous or is already verified by an OTP device, it will use the full username/password/token form. In order to use this, you must supply a template that is compatible with both :class:`~django_otp.forms.OTPAuthenticationForm` and :class:`~django_otp.forms.OTPTokenForm`. This is a good view for :setting:`OTP_LOGIN_URL`. Parameters are the same as :func:`~django.contrib.auth.views.login` except that this view always overrides ``authentication_form``. """ user = request.user if _user_is_anonymous(user) or user.is_verified(): form = OTPAuthenticationForm else: form = partial(OTPTokenForm, user) # A minor hack to make django.contrib.auth.login happy user.backend = request.session[BACKEND_SESSION_KEY] kwargs['authentication_form'] = form return auth_login(request, **kwargs) django-otp-0.3.11/django_otp.egg-info/0000755000076600000240000000000013060076604020246 5ustar psagersstaff00000000000000django-otp-0.3.11/django_otp.egg-info/dependency_links.txt0000644000076600000240000000000113060076604024314 0ustar psagersstaff00000000000000 django-otp-0.3.11/django_otp.egg-info/not-zip-safe0000644000076600000240000000000113060076604022474 0ustar psagersstaff00000000000000 django-otp-0.3.11/django_otp.egg-info/PKG-INFO0000644000076600000240000000435413060076604021351 0ustar psagersstaff00000000000000Metadata-Version: 1.1 Name: django-otp Version: 0.3.11 Summary: A pluggable framework for adding two-factor authentication to Django using one-time passwords. Home-page: https://bitbucket.org/psagers/django-otp Author: Peter Sagerson Author-email: psagers@ignorare.net License: BSD Description: This project makes it easy to add support for `one-time passwords `_ (OTPs) to Django. It can be integrated at various levels, depending on how much customization is required. It integrates with ``django.contrib.auth``, although it is not a Django authentication backend. The primary target is developers wishing to incorporate OTPs into their Django projects as a form of `two-factor authentication `_. This project includes several simple OTP plugins and more are available separately. This package also includes an implementation of OATH `HOTP `_ and `TOTP `_ for convenience, as these are standard OTP algorithms used by multiple plugins. This version is supported on Python 2.6, 2.7, and 3.3+; and Django >= 1.4.2. .. warning:: All plugins now contain both South and Django migrations. If you're using South or upgrading to Django 1.7, please see the `upgrade notes`_ in the documentation first. .. _upgrade notes: https://pythonhosted.org/django-otp/overview.html#upgrading .. vim:ft=rst Platform: UNKNOWN Classifier: Development Status :: 5 - Production/Stable Classifier: Framework :: Django Classifier: Intended Audience :: Developers Classifier: License :: OSI Approved :: BSD License Classifier: Programming Language :: Python :: 2 Classifier: Programming Language :: Python :: 2.7 Classifier: Programming Language :: Python :: 3 Classifier: Programming Language :: Python :: 3.3 Classifier: Programming Language :: Python :: 3.4 Classifier: Programming Language :: Python :: 3.5 Classifier: Topic :: Security Classifier: Topic :: Software Development :: Libraries :: Python Modules django-otp-0.3.11/django_otp.egg-info/requires.txt0000644000076600000240000000004213060076604022642 0ustar psagersstaff00000000000000django >= 1.5.12 [qrcode] qrcode django-otp-0.3.11/django_otp.egg-info/SOURCES.txt0000644000076600000240000000565413060076604022144 0ustar psagersstaff00000000000000CHANGES LICENSE MANIFEST.in README.rst setup.cfg setup.py django_otp/__init__.py django_otp/admin.py django_otp/conf.py django_otp/decorators.py django_otp/forms.py django_otp/middleware.py django_otp/models.py django_otp/oath.py django_otp/tests.py django_otp/util.py django_otp/views.py django_otp.egg-info/PKG-INFO django_otp.egg-info/SOURCES.txt django_otp.egg-info/dependency_links.txt django_otp.egg-info/not-zip-safe django_otp.egg-info/requires.txt django_otp.egg-info/top_level.txt django_otp/plugins/__init__.py django_otp/plugins/otp_email/__init__.py django_otp/plugins/otp_email/admin.py django_otp/plugins/otp_email/conf.py django_otp/plugins/otp_email/models.py django_otp/plugins/otp_email/tests.py django_otp/plugins/otp_email/migrations/0001_initial.py django_otp/plugins/otp_email/migrations/__init__.py django_otp/plugins/otp_email/south_migrations/0001_initial.py django_otp/plugins/otp_email/south_migrations/__init__.py django_otp/plugins/otp_email/templates/otp/email/token.txt django_otp/plugins/otp_hotp/__init__.py django_otp/plugins/otp_hotp/admin.py django_otp/plugins/otp_hotp/models.py django_otp/plugins/otp_hotp/tests.py django_otp/plugins/otp_hotp/migrations/0001_initial.py django_otp/plugins/otp_hotp/migrations/__init__.py django_otp/plugins/otp_hotp/south_migrations/0001_initial.py django_otp/plugins/otp_hotp/south_migrations/__init__.py django_otp/plugins/otp_hotp/templates/otp_hotp/admin/config.html django_otp/plugins/otp_static/__init__.py django_otp/plugins/otp_static/admin.py django_otp/plugins/otp_static/lib.py django_otp/plugins/otp_static/models.py django_otp/plugins/otp_static/tests.py django_otp/plugins/otp_static/management/__init__.py django_otp/plugins/otp_static/management/commands/__init__.py django_otp/plugins/otp_static/management/commands/addstatictoken.py django_otp/plugins/otp_static/migrations/0001_initial.py django_otp/plugins/otp_static/migrations/__init__.py django_otp/plugins/otp_static/south_migrations/0001_initial.py django_otp/plugins/otp_static/south_migrations/__init__.py django_otp/plugins/otp_totp/__init__.py django_otp/plugins/otp_totp/admin.py django_otp/plugins/otp_totp/models.py django_otp/plugins/otp_totp/tests.py django_otp/plugins/otp_totp/migrations/0001_initial.py django_otp/plugins/otp_totp/migrations/__init__.py django_otp/plugins/otp_totp/south_migrations/0001_initial.py django_otp/plugins/otp_totp/south_migrations/0002_last_t.py django_otp/plugins/otp_totp/south_migrations/__init__.py django_otp/plugins/otp_totp/templates/otp_totp/admin/config.html django_otp/templates/otp/admin14/login.html django_otp/templates/otp/admin15/login.html django_otp/templates/otp/admin16/login.html django_otp/templates/otp/admin17/login.html django_otp/templates/otp/admin18/login.html django_otp/templates/otp/admin19/login.html docs/Makefile docs/ext/otpdocs.py docs/source/auth.rst docs/source/changes.rst docs/source/conf.py docs/source/extend.rst docs/source/index.rst docs/source/overview.rstdjango-otp-0.3.11/django_otp.egg-info/top_level.txt0000644000076600000240000000001313060076604022772 0ustar psagersstaff00000000000000django_otp django-otp-0.3.11/docs/0000755000076600000240000000000013060076604015360 5ustar psagersstaff00000000000000django-otp-0.3.11/docs/ext/0000755000076600000240000000000013060076604016160 5ustar psagersstaff00000000000000django-otp-0.3.11/docs/ext/otpdocs.py0000644000076600000240000000033112002047604020173 0ustar psagersstaff00000000000000""" Extra stuff for the django-otp Sphinx docs. """ def setup(app): app.add_crossref_type( directivename = "setting", rolename = "setting", indextemplate = "pair: %s; setting", ) django-otp-0.3.11/docs/Makefile0000644000076600000240000001307512000050632017010 0ustar psagersstaff00000000000000# Makefile for Sphinx documentation # # You can set these variables from the command line. SPHINXOPTS = SPHINXBUILD = sphinx-build PAPER = BUILDDIR = build # Internal variables. PAPEROPT_a4 = -D latex_paper_size=a4 PAPEROPT_letter = -D latex_paper_size=letter ALLSPHINXOPTS = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source # the i18n builder cannot share the environment and doctrees with the others I18NSPHINXOPTS = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source .PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext help: @echo "Please use \`make ' where is one of" @echo " html to make standalone HTML files" @echo " dirhtml to make HTML files named index.html in directories" @echo " singlehtml to make a single large HTML file" @echo " pickle to make pickle files" @echo " json to make JSON files" @echo " htmlhelp to make HTML files and a HTML help project" @echo " qthelp to make HTML files and a qthelp project" @echo " devhelp to make HTML files and a Devhelp project" @echo " epub to make an epub" @echo " latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter" @echo " latexpdf to make LaTeX files and run them through pdflatex" @echo " text to make text files" @echo " man to make manual pages" @echo " texinfo to make Texinfo files" @echo " info to make Texinfo files and run them through makeinfo" @echo " gettext to make PO message catalogs" @echo " changes to make an overview of all changed/added/deprecated items" @echo " linkcheck to check all external links for integrity" @echo " doctest to run all doctests embedded in the documentation (if enabled)" clean: -rm -rf $(BUILDDIR)/* html: $(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html @echo @echo "Build finished. The HTML pages are in $(BUILDDIR)/html." dirhtml: $(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml @echo @echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml." singlehtml: $(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml @echo @echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml." pickle: $(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle @echo @echo "Build finished; now you can process the pickle files." json: $(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json @echo @echo "Build finished; now you can process the JSON files." htmlhelp: $(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp @echo @echo "Build finished; now you can run HTML Help Workshop with the" \ ".hhp project file in $(BUILDDIR)/htmlhelp." qthelp: $(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp @echo @echo "Build finished; now you can run "qcollectiongenerator" with the" \ ".qhcp project file in $(BUILDDIR)/qthelp, like this:" @echo "# qcollectiongenerator $(BUILDDIR)/qthelp/django-otp.qhcp" @echo "To view the help file:" @echo "# assistant -collectionFile $(BUILDDIR)/qthelp/django-otp.qhc" devhelp: $(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp @echo @echo "Build finished." @echo "To view the help file:" @echo "# mkdir -p $$HOME/.local/share/devhelp/django-otp" @echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/django-otp" @echo "# devhelp" epub: $(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub @echo @echo "Build finished. The epub file is in $(BUILDDIR)/epub." latex: $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex @echo @echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex." @echo "Run \`make' in that directory to run these through (pdf)latex" \ "(use \`make latexpdf' here to do that automatically)." latexpdf: $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex @echo "Running LaTeX files through pdflatex..." $(MAKE) -C $(BUILDDIR)/latex all-pdf @echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex." text: $(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text @echo @echo "Build finished. The text files are in $(BUILDDIR)/text." man: $(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man @echo @echo "Build finished. The manual pages are in $(BUILDDIR)/man." texinfo: $(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo @echo @echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo." @echo "Run \`make' in that directory to run these through makeinfo" \ "(use \`make info' here to do that automatically)." info: $(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo @echo "Running Texinfo files through makeinfo..." make -C $(BUILDDIR)/texinfo info @echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo." gettext: $(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale @echo @echo "Build finished. The message catalogs are in $(BUILDDIR)/locale." changes: $(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes @echo @echo "The overview file is in $(BUILDDIR)/changes." linkcheck: $(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck @echo @echo "Link check complete; look for any errors in the above output " \ "or in $(BUILDDIR)/linkcheck/output.txt." doctest: $(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest @echo "Testing of doctests in the sources finished, look at the " \ "results in $(BUILDDIR)/doctest/output.txt." zip: rm build/html.zip || true cd build/html && zip -R ../html.zip '*' -x .buildinfo -x '_sources/*' django-otp-0.3.11/docs/source/0000755000076600000240000000000013060076604016660 5ustar psagersstaff00000000000000django-otp-0.3.11/docs/source/auth.rst0000644000076600000240000001663712375233104020366 0ustar psagersstaff00000000000000Authentication and Authorization ================================ This section describes the process for verifying users against their registered OTP devices as well as limiting access based on this verification. Authenticating Users -------------------- Soliciting an OTP token from a user is more complicated than soliciting a password. For one thing, each user may have any number of OTP devices registered to their account and the token itself won't tell us which one is intended. And, of course, we won't even know which devices we should check until after we've identified the user based on their username and password. Complicating this further is the fact some plugins are interactive, in which case verifying the user is at least a two-step process. Verifying a user can happen in one or two stages. One option is to require an OTP up front along with a password. Alternatively, we can accept single-factor authentication initially, but allow (or require) the user to provide a second factor later on. The following sections begin with the simpler strategies and proceed to the lower-level APIs that will allow you to implement more complex policies. The Easy Way ~~~~~~~~~~~~ .. autofunction:: django_otp.views.login The Authentication Form ~~~~~~~~~~~~~~~~~~~~~~~ Django provides some high-level APIs to make it easy to authenticate users. If you're accustomed to using Django's built-in login view, this section will show you how to turn it into a two-factor login view. In Django, user authentication actually takes place not in a view, but in an :class:`~django.contrib.auth.forms.AuthenticationForm` or a subclass. If you're using Django's :func:`built-in login view `, you're already using the default AuthenticationForm. This form performs authentication as part of its validation; validation only succeeds if the supplied credentials pass :func:`django.contrib.auth.authenticate`. If you want to require two-factor authentication in the default login view, the easiest way is to use :class:`django_otp.forms.OTPAuthenticationForm` instead. This form includes additional fields and behavior to solicit an OTP token from the user and verify it against their registered devices. This form's validation only succeeds if it is able to both authenticate the user with the username and password and also verify them with an OTP token. The form can be used with :func:`django.contrib.auth.views.login` simply by passing it in the ``authentication_form`` keyword parameter:: from django_otp.forms import OTPAuthenticationForm urlpatterns = patterns('django.contrib.auth.views', url(r'^accounts/login/$', 'login', kwargs={'authentication_form': OTPAuthenticationForm}), ) .. autoclass:: django_otp.forms.OTPAuthenticationForm Following is a sample template snippet that's designed for :class:`~django_otp.forms.OTPAuthenticationForm`: .. code-block:: html
{{ form.username.errors }}{{ form.username.label_tag }}{{ form.username }}
{{ form.password.errors }}{{ form.password.label_tag }}{{ form.password }}
{% if form.get_user %}
{{ form.otp_device.errors }}{{ form.otp_device.label_tag }}{{ form.otp_device }}
{% endif %}
{{ form.otp_token.errors }}{{ form.otp_token.label_tag }}{{ form.otp_token }}
{% if form.get_user %}{% endif %}
The Admin Site ~~~~~~~~~~~~~~ In addition to providing :class:`~django_otp.forms.OTPAuthenticationForm` for your normal login views, django-otp includes an :class:`~django.contrib.admin.AdminSite` subclass for admin integration. .. autoclass:: django_otp.admin.OTPAdminSite :members: name, login_form, login_template, has_permission .. autoclass:: django_otp.admin.OTPAdminAuthenticationForm See the Django :class:`~django.contrib.admin.AdminSite` documentation for more on installing custom admin sites. If you want to copy the default admin site into an :class:`~django_otp.admin.OTPAdminSite`, we find that the following works well. Note that it relies on a private property, so use this at your own risk:: otp_admin_site = OTPAdminSite(OTPAdminSite.name) for model_cls, model_admin in admin.site._registry.iteritems(): otp_admin_site.register(model_cls, model_admin.__class__) The Token Form ~~~~~~~~~~~~~~ If you already have an authenticated user and you just want to ask for an OTP token to verify, you can use :class:`django_otp.forms.OTPTokenForm`. .. autoclass:: django_otp.forms.OTPTokenForm .. _Low-Level API: The Low-Level API ~~~~~~~~~~~~~~~~~ .. autofunction:: django_otp.devices_for_user .. autofunction:: django_otp.user_has_device .. autofunction:: django_otp.match_token .. autofunction:: django_otp.login .. autoclass:: django_otp.models.Device :members: is_interactive, generate_challenge, verify_token .. autoclass:: django_otp.models.DeviceManager :members: devices_for_user Authorizing Users ----------------- If you design your site to always require OTP verification in order to log in, then your authorization policies don't need to change. ``request.user.is_authenticated()`` will be effectively synonymous with ``request.user.is_verified()``. If, on the other hand, you anticipate having both verified and unverified users on your site, you're probably intending to limit access to some resources to verified users only. The primary tool for this is otp_required: .. decorator:: django_otp.decorators.otp_required([redirect_field_name='next', login_url=None, if_configured=False]) Similar to :func:`~django.contrib.auth.decorators.login_required`, but requires the user to be :term:`verified`. By default, this redirects users to :setting:`OTP_LOGIN_URL`. :param if_configured: If ``True``, an authenticated user with no confirmed OTP devices will be allowed. Default is ``False``. :type if_configured: bool If you need more fine-grained control over authorization decisions, you can use ``request.user.is_verified()`` to determine whether the user has been verified by an OTP device. if ``is_verified()`` is true, then ``request.user.otp_device`` will be set to the :class:`~django_otp.models.Device` object that verified the user. This can be useful if you want to include the name of the verifying device in the UI. If you want to use OTPs to establish trusted user agents (e.g. a browser that the user claims is on a private and secure computer), look at `django-agent-trust `_ and `django-otp-agents `_. .. _Managing Devices: Managing Devices ---------------- django-otp does not include any standard mechanism for managing a user's devices outside of the admin interface. All plugins are expected to include admin integration, which should be sufficient for many sites. Some sites may want to provide users a self-service API to manage devices, but this will be very site-specific. Fortunately, managing a user's devices is just a matter of managing :class:`~django_otp.models.Device`-derived model objects, so it will be easy to implement. Be sure to note the :ref:`warning ` about unsaved :class:`~django_otp.models.Device` objects. django-otp-0.3.11/docs/source/changes.rst0000644000076600000240000000006212204723511021013 0ustar psagersstaff00000000000000Change Log ========== .. include:: ../../CHANGES django-otp-0.3.11/docs/source/conf.py0000644000076600000240000002024713060076255020166 0ustar psagersstaff00000000000000# -*- coding: utf-8 -*- # # django-otp documentation build configuration file, created by # sphinx-quickstart on Fri Jul 13 09:48:33 2012. # # This file is execfile()d with the current directory set to its containing dir. # # Note that not all possible configuration values are present in this # autogenerated file. # # All configuration values have a default; values that are commented out # serve to show the default. import sys import os.path # If extensions (or modules to document with autodoc) are in another directory, # add these directories to sys.path here. If the directory is relative to the # documentation root, use os.path.abspath to make it absolute, like shown here. sys.path.insert(0, os.path.abspath('../ext')) # -- General configuration ----------------------------------------------------- # If your documentation needs a minimal Sphinx version, state it here. #needs_sphinx = '1.0' # Add any Sphinx extension module names here, as strings. They can be extensions # coming with Sphinx (named 'sphinx.ext.*') or your custom ones. extensions = [ 'sphinx.ext.autodoc', 'sphinx.ext.viewcode', 'sphinx.ext.intersphinx', 'otpdocs', ] # autodoc and viewcode need valid settings in order to process Django modules. import django.conf django.conf.settings.configure( DATABASES={ 'default': { 'ENGINE': 'django.db.backends.sqlite3', 'NAME': '/tmp/django_otp.sqlite', } } ) intersphinx_mapping = { 'python': ('http://docs.python.org/2/', None), 'django': ('https://docs.djangoproject.com/en/1.10/', 'https://docs.djangoproject.com/en/1.10/_objects/'), } # Add any paths that contain templates here, relative to this directory. templates_path = ['_templates'] # The suffix of source filenames. source_suffix = '.rst' # The encoding of source files. #source_encoding = 'utf-8-sig' # The master toctree document. master_doc = 'index' # General information about the project. project = u'django-otp' copyright = u'2012, Peter Sagerson' # The version info for the project you're documenting, acts as replacement for # |version| and |release|, also used in various other places throughout the # built documents. # # The short X.Y version. version = '0.3' # The full version, including alpha/beta/rc tags. release = '0.3.11' # The language for content autogenerated by Sphinx. Refer to documentation # for a list of supported languages. #language = None # There are two options for replacing |today|: either, you set today to some # non-false value, then it is used: #today = '' # Else, today_fmt is used as the format for a strftime call. #today_fmt = '%B %d, %Y' # List of patterns, relative to source directory, that match files and # directories to ignore when looking for source files. exclude_patterns = [] # The reST default role (used for this markup: `text`) to use for all documents. #default_role = None # If true, '()' will be appended to :func: etc. cross-reference text. #add_function_parentheses = True # If true, the current module name will be prepended to all description # unit titles (such as .. function::). #add_module_names = True # If true, sectionauthor and moduleauthor directives will be shown in the # output. They are ignored by default. #show_authors = False # The name of the Pygments (syntax highlighting) style to use. pygments_style = 'sphinx' # A list of ignored prefixes for module index sorting. #modindex_common_prefix = [] # -- Options for HTML output --------------------------------------------------- # The theme to use for HTML and HTML Help pages. See the documentation for # a list of builtin themes. html_theme = 'default' # Theme options are theme-specific and customize the look and feel of a theme # further. For a list of options available for each theme, see the # documentation. #html_theme_options = {} # Add any paths that contain custom themes here, relative to this directory. #html_theme_path = [] # The name for this set of Sphinx documents. If None, it defaults to # " v documentation". #html_title = None # A shorter title for the navigation bar. Default is the same as html_title. #html_short_title = None # The name of an image file (relative to this directory) to place at the top # of the sidebar. #html_logo = None # The name of an image file (within the static path) to use as favicon of the # docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32 # pixels large. #html_favicon = None # Add any paths that contain custom static files (such as style sheets) here, # relative to this directory. They are copied after the builtin static files, # so a file named "default.css" will overwrite the builtin "default.css". html_static_path = ['_static'] # If not '', a 'Last updated on:' timestamp is inserted at every page bottom, # using the given strftime format. #html_last_updated_fmt = '%b %d, %Y' # If true, SmartyPants will be used to convert quotes and dashes to # typographically correct entities. #html_use_smartypants = True # Custom sidebar templates, maps document names to template names. #html_sidebars = {} # Additional templates that should be rendered to pages, maps page names to # template names. #html_additional_pages = {} # If false, no module index is generated. #html_domain_indices = True # If false, no index is generated. #html_use_index = True # If true, the index is split into individual pages for each letter. #html_split_index = False # If true, links to the reST sources are added to the pages. #html_show_sourcelink = True # If true, "Created using Sphinx" is shown in the HTML footer. Default is True. #html_show_sphinx = True # If true, "(C) Copyright ..." is shown in the HTML footer. Default is True. #html_show_copyright = True # If true, an OpenSearch description file will be output, and all pages will # contain a tag referring to it. The value of this option must be the # base URL from which the finished HTML is served. #html_use_opensearch = '' # This is the file name suffix for HTML files (e.g. ".xhtml"). #html_file_suffix = None # Output file base name for HTML help builder. htmlhelp_basename = 'django-otpdoc' # -- Options for LaTeX output -------------------------------------------------- latex_elements = { # The paper size ('letterpaper' or 'a4paper'). #'papersize': 'letterpaper', # The font size ('10pt', '11pt' or '12pt'). #'pointsize': '10pt', # Additional stuff for the LaTeX preamble. #'preamble': '', } # Grouping the document tree into LaTeX files. List of tuples # (source start file, target name, title, author, documentclass [howto/manual]). latex_documents = [ ('index', 'django-otp.tex', u'django-otp Documentation', u'Peter Sagerson', 'manual'), ] # The name of an image file (relative to this directory) to place at the top of # the title page. #latex_logo = None # For "manual" documents, if this is true, then toplevel headings are parts, # not chapters. #latex_use_parts = False # If true, show page references after internal links. #latex_show_pagerefs = False # If true, show URL addresses after external links. #latex_show_urls = False # Documents to append as an appendix to all manuals. #latex_appendices = [] # If false, no module index is generated. #latex_domain_indices = True # -- Options for manual page output -------------------------------------------- # One entry per manual page. List of tuples # (source start file, name, description, authors, manual section). man_pages = [ ('index', 'django-otp', u'django-otp Documentation', [u'Peter Sagerson'], 1) ] # If true, show URL addresses after external links. #man_show_urls = False # -- Options for Texinfo output ------------------------------------------------ # Grouping the document tree into Texinfo files. List of tuples # (source start file, target name, title, author, # dir menu entry, description, category) texinfo_documents = [ ('index', 'django-otp', u'django-otp Documentation', u'Peter Sagerson', 'django-otp', 'One line description of project.', 'Miscellaneous'), ] # Documents to append as an appendix to all manuals. #texinfo_appendices = [] # If false, no module index is generated. #texinfo_domain_indices = True # How to display URL addresses: 'footnote', 'no', or 'inline'. #texinfo_show_urls = 'footnote' django-otp-0.3.11/docs/source/extend.rst0000644000076600000240000000441412323344020020673 0ustar psagersstaff00000000000000Extending Django-OTP ==================== A django-otp plugin is defined as a Django app that includes at least one model derived from :class:`django_otp.models.Device`. All Device-derived model objects will be detected by the framework and included in the standard forms and APIs. Writing a Device ---------------- A :class:`~django_otp.models.Device` subclass is only required to implement one method: .. automethod:: django_otp.models.Device.verify_token :noindex: Most devices will also need to define one or more model fields to do anything interesting. Here's a simple implementation of a generic TOTP device:: from binascii import unhexlify from django.db import models from django_otp.models import Device from django_otp.oath import totp from django_otp.util import random_hex, hex_validator class TOTPDevice(Device): key = models.CharField(max_length=80, validators=[hex_validator()], default=lambda: random_hex(20), help_text=u'A hex-encoded secret key of up to 40 bytes.') @property def bin_key(self): return unhexlify(self.key) def verify_token(self, token): """ Try to verify ``token`` against the current and previous TOTP value. """ try: token = int(token) except ValueError: verified = False else: verified = any(totp(self.bin_key, drift=drift) == token for drift in [0, -1]) return verified This example also shows some of the :ref:`low-level utilities ` django_otp provides for OATH and hex-encoded values. If a device uses a challenge-response algorithm or requires some other kind of user interaction, it should implement an additional method: .. automethod:: django_otp.models.Device.generate_challenge :noindex: .. _utilities: Utilities --------- django_otp provides several low-level utilities as a convenience to plugin implementors. django_otp.oath ~~~~~~~~~~~~~~~ .. module:: django_otp.oath .. autofunction:: hotp .. autofunction:: totp .. autoclass:: TOTP :members: django_otp.util ~~~~~~~~~~~~~~~ .. automodule:: django_otp.util :members: django-otp-0.3.11/docs/source/index.rst0000644000076600000240000000264612332731724020533 0ustar psagersstaff00000000000000django-otp ========== .. include:: ../../README.rst .. toctree:: :maxdepth: 3 overview auth extend changes License ------- Copyright (c) 2012, Peter Sagerson All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. django-otp-0.3.11/docs/source/overview.rst0000644000076600000240000003337513056563315021300 0ustar psagersstaff00000000000000Overview and Key Concepts ========================= The django_otp package contains a framework for processing one-time passwords as well as support for :ref:`several types ` of OTP devices. Support for additional devices is handled by plugins, :ref:`distributed separately `. Adding two-factor authentication to your Django site involves four main tasks: #. Installing the django-otp plugins you want to use. #. Adding one or more OTP-enabled login views. #. Restricting access to all or portions of your site based on whether users have been verified by a registered OTP device. #. Providing mechanisms to register OTP devices to user accounts (or relying on the Django admin interface). .. _installation: Installation ------------ Basic installation has only two steps: #. Install :mod:`django_otp` and any :ref:`plugins ` that you'd like to use. These are simply Django apps to be installed in the usual way. #. Add :class:`django_otp.middleware.OTPMiddleware` to :setting:`MIDDLEWARE` or :setting:`MIDDLEWARE_CLASSES`. It must be installed *after* :class:`~django.contrib.auth.middleware.AuthenticationMiddleware`. For example:: INSTALLED_APPS = [ 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.sites', 'django.contrib.messages', 'django.contrib.staticfiles', 'django.contrib.admin', 'django.contrib.admindocs', 'django_otp', 'django_otp.plugins.otp_totp', 'django_otp.plugins.otp_hotp', 'django_otp.plugins.otp_static', ] MIDDLEWARE = [ 'django.middleware.common.CommonMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django_otp.middleware.OTPMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', ] The plugins contain models that must be migrated. .. _upgrading: Upgrading --------- Version 0.2.4 of django-otp introduced a South migration to the otp_totp plugin. Version 0.3.0 added Django 1.7 and South migrations to all apps. Care must be taken when upgrading in certain cases. The recommended procedure is: 1. Upgrade django-otp to 0.2.7, as described below. 2. Upgrade Django to 1.7 or later. 3. Upgrade django-otp to the latest version. django-otp 0.4 will drop support for Django < 1.7. Upgrading from 0.2.3 or Earlier ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If you're using django-otp <= 0.2.3, you need to convert otp_totp to South before going any further:: pip install 'django-otp==0.2.7' python manage.py migrate otp_totp 0001 --fake python manage.py migrate otp_totp If you're not using South, you can run ``python manage.py sql otp_totp`` to see the definition of the new ``last_t`` field and then construct a suitable ``ALTER TABLE`` SQL statement for your database. Upgrading to Django 1.7+ ~~~~~~~~~~~~~~~~~~~~~~~~ Once you've upgraded django-otp to version 0.2.4 or later (up to 0.2.7), it's safe to switch to Django 1.7 or later. You should not have South installed at this point, so any old migrations will simply be ignored. Once on Django 1.7+, it's safe to upgrade django-otp to 0.3 or later. All plugins with models have Django migrations, which will be ignored if the tables have already been created. If you're already on django-otp 0.3 or later when you move to Django 1.7+ (see below), you'll want to make sure Django knows that all migrations have already been run:: python manage.py migrate --fake ... Upgrading to 0.3.x with South ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If you want to upgrade django-otp to 0.3.x under South, you'll need to convert all of the remaining plugins. First make sure you're running South 1.0, as earlier versions will not find the migrations. Then convert any plugin that you have installed:: pip install 'django-otp>=0.3' python manage.py migrate otp_hotp 0001 --fake python manage.py migrate otp_static 0001 --fake python manage.py migrate otp_yubikey 0001 --fake python manage.py migrate otp_twilio 0001 --fake Authentication and Verification ------------------------------- In a normal Django deployment, the user associated with a request is either authenticated or not. With the introduction of two-factor authentication, the situation becomes a little more complicated: while it is certainly possible to design a site such that two factors are required for any authentication, that's only one option. It's entirely reasonable to allow users to log in with either one or two factors and grant then access accordingly. In this documentation, a user that has passed Django's authentication API is called :term:`authenticated`. A user that has additionally been accepted by a registered OTP device is called :term:`verified`. On an OTP-enabled Django site, there are thus three levels of authentication: - anonymous - authenticated - authenticated + verified When planning your site, you'll want to consider whether different views will require different levels of authentication. As a convenience, we provide the decorator :func:`django_otp.decorators.otp_required`, which is analogous to :func:`~django.contrib.auth.decorators.login_required`, but requires the user to be both authenticated and verified. :class:`~django_otp.middleware.OTPMiddleware` populates ``request.user.otp_device`` to the OTP device object that verified the current user (if any). As a convenience, it also adds ``user.is_verified()`` as a counterpart to ``user.is_authenticated()``. It is not possible for a user to be verified without also being authenticated. [#agents]_ Plugins and Devices ------------------- A django-otp plugin is simply a Django app that contains one or more models that are subclassed from :class:`django_otp.models.Device`. Each model class supports a single type of OTP device. Remember that when we use the term :term:`device` in this context, we're not necessarily referring to a physical device. At the code level, a device is a model object that can verify a particular type of OTP. For example, you might have a `YubiKey`_ that supports both the Yubico OTP algorithm and the HOTP standard: these would be represented as different devices and likely served by different plugins. A device that delivered HOTP values to a user by SMS would be a third device defined by another plugin. OTP plugins are distributed as Django apps; to install a plugin, just add it to :setting:`INSTALLED_APPS` like any other. The order can be significant: any time we enumerate a user's devices, such as when we ask the user which device they would like to authenticate with, we will present them according to the order in which the apps are installed. OTP devices come in two general flavors: passive and interactive. A passive device is one that can accept a token from the user and verify it with no preparation. Examples include devices corresponding to dedicated hardware or smartphone apps that generate sequenced or time-based tokens. An interactive device needs to communicate something to the user before it can accept a token. Two common types are devices that use a challenge-response OTP algorithm and devices that deliver a token to the user through an independent channel, such as SMS. Internally, device instances can be flagged as confirmed or unconfirmed. By default, devices are confirmed as soon as they are created, but a plugin or deployment that wishes to include a confirmation step can mark a device unconfirmed initially. Unconfirmed devices will be ignored by the high-level OTP APIs. .. _YubiKey: http://www.yubico.com/yubikey .. _built-in-plugins: Built-in Plugins ~~~~~~~~~~~~~~~~ django-otp includes support for several standard device types. :class:`~django_otp.plugins.otp_hotp.models.HOTPDevice` and :class:`~django_otp.plugins.otp_totp.models.TOTPDevice` handle standard OTP algorithms, which can be used with a variety of OTP generators. For example, it's easy to pair these devices with `Google Authenticator`_ using the `otpauth URL scheme`_. If you have the `qrcode`_ package installed, the admin interface will generate QR Codes for you. .. _Google Authenticator: https://github.com/google/google-authenticator .. _otpauth URL scheme: https://github.com/google/google-authenticator/wiki/Key-Uri-Format .. _qrcode: https://pypi.python.org/pypi/qrcode/ HOTP Devices ++++++++++++ `HOTP`_ is an algorithm that generates a pseudo-random sequence of codes based on an incrementing counter. Every time a prover generates a new code or a verifier verifies one, they increment their respective counters. This algorithm will fail if the prover generates too many codes without a successful verification. .. module:: django_otp.plugins.otp_hotp .. automodule:: django_otp.plugins.otp_hotp.models :members: .. autoclass:: django_otp.plugins.otp_hotp.admin.HOTPDeviceAdmin .. _HOTP: http://tools.ietf.org/html/rfc4226#section-5 HOTP Settings ''''''''''''' **OTP_HOTP_ISSUER** .. setting:: OTP_HOTP_ISSUER Default: ``None`` The ``issuer`` parameter for the otpauth URL generated by :attr:`~django_otp.plugins.otp_hotp.models.HOTPDevice.config_url`. TOTP Devices ++++++++++++ `TOTP`_ is an algorithm that generates a pseudo-random sequence of codes based on the current time. A typical implementation will change codes every 30 seconds, although this is configurable. This algorithm will fail if the prover and verifier have clocks that drift too far apart. .. module:: django_otp.plugins.otp_totp .. automodule:: django_otp.plugins.otp_totp.models :members: .. autoclass:: django_otp.plugins.otp_totp.admin.TOTPDeviceAdmin .. _TOTP: http://tools.ietf.org/html/rfc6238#section-4 TOTP Settings ''''''''''''' **OTP_TOTP_ISSUER** .. setting:: OTP_TOTP_ISSUER Default: ``None`` The ``issuer`` parameter for the otpauth URL generated by :attr:`~django_otp.plugins.otp_totp.models.TOTPDevice.config_url`. **OTP_TOTP_SYNC** .. setting:: OTP_TOTP_SYNC Default: ``True`` If true, then TOTP devices will keep track of the difference between the prover's clock and our own. Any time a :class:`~django_otp.plugins.otp_totp.models.TOTPDevice` matches a token in the past or future, it will update :attr:`~django_otp.plugins.otp_totp.models.TOTPDevice.drift` to the number of time steps that the two sides are out of sync. For subsequent tokens, we'll slide the window of acceptable tokens by this number. Static Devices ++++++++++++++ .. module:: django_otp.plugins.otp_static .. automodule:: django_otp.plugins.otp_static.models :members: StaticDevice, StaticToken .. autoclass:: django_otp.plugins.otp_static.admin.StaticDeviceAdmin The static plugin also includes a management command called ``addstatictoken``, which will add a single static token to any account. This is useful for bootstrapping and emergency access. Run ``manage.py addstatictoken -h`` for details. Email Devices +++++++++++++ .. module:: django_otp.plugins.otp_email .. automodule:: django_otp.plugins.otp_email.models :members: EmailDevice .. autoclass:: django_otp.plugins.otp_email.admin.EmailDeviceAdmin .. _other-plugins: Other Plugins ~~~~~~~~~~~~~~ The framework author also maintains a couple of other plugins for less common devices. Third-party plugins are not listed here. - `django-otp-yubikey`_ supports YubiKey USB devices. - `django-otp-twilio`_ supports delivering OTPs via Twilio's SMS service. Settings -------- .. setting:: OTP_LOGIN_URL **OTP_LOGIN_URL** Default: alias for :setting:`LOGIN_URL` The URL where requests are redirected for two-factor authentication, especially when using the :func:`~django_otp.decorators.otp_required` decorator. Glossary -------- .. glossary:: authenticated A user whose credentials have been accepted by Django's authentication API is considered authenticated. device A mechanism by which a user can acquire an OTP. This might correspond to a physical device dedicated to such a purpose, a virtual device such as a smart phone app, or even a set of stored single-use tokens. OTP A one-time password. This is a generated value that a user can present as evidence of their identity. OTPs are only valid for a single use or, in some cases, for a strictly limited period of time. prover An entity that is using an OTP to prove its identity. For example, a user who is providing an OTP token. token An encoded OTP. Some OTPs consist of structured data, in which case they will be encoded into a printable string for transport. two-factor authentication An authentication policy that requires a user to present two proofs of identity. The first is typically a password and the second is frequently tied to some physical device in the user's possession. verified A user whose credentials have been accepted by Django's authentication API and also by a registered OTP device is considered verified. verifier An entity that verifies tokens generated by a prover. For example, a web service that accepts OTPs as proof of identity. ---- .. rubric:: Footnotes .. [#agents] If you'd like the second factor to persist across sessions, see `django-agent-trust`_ and `django-otp-agents`_. The former deals with assigning trust to user agents (i.e. browsers) across sessions and the latter includes tools to use OTPs to establish that trust. .. _django-agent-trust: http://pypi.python.org/pypi/django-agent-trust .. _django-otp-agents: http://pypi.python.org/pypi/django-otp-agents .. _django-otp-yubikey: http://pypi.python.org/pypi/django-otp-yubikey .. _django-otp-twilio: http://pypi.python.org/pypi/django-otp-twilio django-otp-0.3.11/LICENSE0000644000076600000240000000242112002351767015435 0ustar psagersstaff00000000000000Copyright (c) 2012, Peter Sagerson All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. django-otp-0.3.11/MANIFEST.in0000644000076600000240000000052313057304773016175 0ustar psagersstaff00000000000000include README.rst CHANGES LICENSE recursive-include docs *.rst *.py Makefile prune docs/build recursive-include django_otp/plugins/otp_email/templates * recursive-include django_otp/plugins/otp_hotp/templates * recursive-include django_otp/plugins/otp_totp/templates * recursive-include django_otp/templates * global-exclude .DS_Store django-otp-0.3.11/PKG-INFO0000644000076600000240000000435413060076604015533 0ustar psagersstaff00000000000000Metadata-Version: 1.1 Name: django-otp Version: 0.3.11 Summary: A pluggable framework for adding two-factor authentication to Django using one-time passwords. Home-page: https://bitbucket.org/psagers/django-otp Author: Peter Sagerson Author-email: psagers@ignorare.net License: BSD Description: This project makes it easy to add support for `one-time passwords `_ (OTPs) to Django. It can be integrated at various levels, depending on how much customization is required. It integrates with ``django.contrib.auth``, although it is not a Django authentication backend. The primary target is developers wishing to incorporate OTPs into their Django projects as a form of `two-factor authentication `_. This project includes several simple OTP plugins and more are available separately. This package also includes an implementation of OATH `HOTP `_ and `TOTP `_ for convenience, as these are standard OTP algorithms used by multiple plugins. This version is supported on Python 2.6, 2.7, and 3.3+; and Django >= 1.4.2. .. warning:: All plugins now contain both South and Django migrations. If you're using South or upgrading to Django 1.7, please see the `upgrade notes`_ in the documentation first. .. _upgrade notes: https://pythonhosted.org/django-otp/overview.html#upgrading .. vim:ft=rst Platform: UNKNOWN Classifier: Development Status :: 5 - Production/Stable Classifier: Framework :: Django Classifier: Intended Audience :: Developers Classifier: License :: OSI Approved :: BSD License Classifier: Programming Language :: Python :: 2 Classifier: Programming Language :: Python :: 2.7 Classifier: Programming Language :: Python :: 3 Classifier: Programming Language :: Python :: 3.3 Classifier: Programming Language :: Python :: 3.4 Classifier: Programming Language :: Python :: 3.5 Classifier: Topic :: Security Classifier: Topic :: Software Development :: Libraries :: Python Modules django-otp-0.3.11/README.rst0000644000076600000240000000224412465526265016134 0ustar psagersstaff00000000000000This project makes it easy to add support for `one-time passwords `_ (OTPs) to Django. It can be integrated at various levels, depending on how much customization is required. It integrates with ``django.contrib.auth``, although it is not a Django authentication backend. The primary target is developers wishing to incorporate OTPs into their Django projects as a form of `two-factor authentication `_. This project includes several simple OTP plugins and more are available separately. This package also includes an implementation of OATH `HOTP `_ and `TOTP `_ for convenience, as these are standard OTP algorithms used by multiple plugins. This version is supported on Python 2.6, 2.7, and 3.3+; and Django >= 1.4.2. .. warning:: All plugins now contain both South and Django migrations. If you're using South or upgrading to Django 1.7, please see the `upgrade notes`_ in the documentation first. .. _upgrade notes: https://pythonhosted.org/django-otp/overview.html#upgrading .. vim:ft=rst django-otp-0.3.11/setup.cfg0000644000076600000240000000015613060076604016253 0ustar psagersstaff00000000000000[pep8] ignore = E501 [bdist_wheel] universal = 1 [egg_info] tag_build = tag_date = 0 tag_svn_revision = 0 django-otp-0.3.11/setup.py0000755000076600000240000000230113060076202016133 0ustar psagersstaff00000000000000#!/usr/bin/env python from setuptools import setup, find_packages setup( name='django-otp', version='0.3.11', description='A pluggable framework for adding two-factor authentication to Django using one-time passwords.', long_description=open('README.rst').read(), author='Peter Sagerson', author_email='psagers@ignorare.net', packages=find_packages(), include_package_data=True, zip_safe=False, url='https://bitbucket.org/psagers/django-otp', license='BSD', install_requires=[ 'django >= 1.5.12' ], extras_require={ 'qrcode': ['qrcode'], }, classifiers=[ "Development Status :: 5 - Production/Stable", "Framework :: Django", "Intended Audience :: Developers", "License :: OSI Approved :: BSD License", "Programming Language :: Python :: 2", "Programming Language :: Python :: 2.7", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3.3", "Programming Language :: Python :: 3.4", "Programming Language :: Python :: 3.5", "Topic :: Security", "Topic :: Software Development :: Libraries :: Python Modules", ], )