Fix subrequest auth via request caching

docs/CHANGES.txt

@@ -1,6 +1,11 @@
 2.3.2 (unreleased)
 ------------------
 
+- Fix support for subrequest authentication. The credentials must be
+  cached on the parent request because the authorization ticket is
+  only valid during a limited time window.
+  [malthe]
+
 - Allow PAS plugin loading to continue in debug mode (development) with an error warning if the kerberos library cannot be loaded on unix.
   [fredvd]
 

netsight/windowsauthplugin/plugin.py

@@ -11,6 +11,7 @@
 
 from zExceptions import Forbidden
 from zLOG import LOG, ERROR, DEBUG, INFO
+from zope.annotation.interfaces import IAnnotations
 
 import sys
 import urlparse
@@ -34,6 +35,9 @@
 
 import interface
 
+KEY = "netsight.windowsauthplugin.credentials"
+
+
 class WindowsauthpluginHelper( BasePlugin ):
     """Multi-plugin to do Kerberos based SSO
 
@@ -94,14 +98,18 @@ def authenticateCredentials( self, credentials ):
             return None
 
         request = self.REQUEST
-        response = request.RESPONSE
-        remote_host = request.getClientAddr()
 
-        # We are actually already authenticated... maybe we are in a subrequest
-        if request.get('AUTHENTICATED_USER', None) is not None:
-            username = request.AUTHENTICATED_USER.getName()
-            return username, username
+        # This request may be a subrequest which is supposed to
+        # leverage the same authentication information as the parent
+        # request.
+        request = request.get('PARENT_REQUEST', request)
+        cache = IAnnotations(request)
+        value = cache.get(KEY)
+        if value is not None:
+            return value
 
+        response = request.RESPONSE
+        remote_host = request.getClientAddr()
         ticket = credentials['ticket']
 
         if WINDOWS:
@@ -155,7 +163,8 @@ def authenticateCredentials( self, credentials ):
             response = request.RESPONSE
             pas_instance.updateCredentials(request, response, username, '')
 
-        return username, username
+        value = cache[KEY] = username, username
+        return value
 
 
     security.declarePrivate( 'extractCredentials' )