[Feature] ORCID login [#OSF-5162, 6881, 6885]

framework/auth/__init__.py

@@ -19,6 +19,7 @@
     'get_user',
     'check_password',
     'authenticate',
+    'external_first_login_authenticate',
     'logout',
     'register_unconfirmed',
 ]
@@ -51,6 +52,19 @@ def authenticate(user, access_token, response):
     return response
 
 
+def external_first_login_authenticate(user, response):
+    data = session.data if session._get_current_object() else {}
+    data.update({
+        'auth_user_fullname': user['fullname'],
+        'auth_user_external_id_provider': user['external_id_provider'],
+        'auth_user_external_id': user['external_id'],
+        'auth_user_external_first_login': True,
+        'auth_user_access_token': user['access_token']
+    })
+    response = create_session(response, data=data)
+    return response
+
+
 def logout():
     """Clear users' session(s) and log them out of OSF."""
 

framework/auth/cas.py

@@ -9,7 +9,8 @@
 import requests
 
 from framework.auth import User
-from framework.auth import authenticate
+from framework.auth import authenticate, external_first_login_authenticate
+from framework.auth.core import get_user
 from framework.flask import redirect
 from framework.exceptions import HTTPError
 from website import settings
@@ -235,7 +236,7 @@ def make_response_from_ticket(ticket, service_url):
 
     :param str ticket: CAS service ticket
     :param str service_url: Service URL from which the authentication request originates
-    :return:
+    :return: redirect response
     """
 
     service_furl = furl.furl(service_url)
@@ -244,11 +245,59 @@ def make_response_from_ticket(ticket, service_url):
     client = get_client()
     cas_resp = client.service_validate(ticket, service_furl.url)
     if cas_resp.authenticated:
-        user = User.load(cas_resp.user)
-        # if we successfully authenticate and a verification key is present, invalidate it
-        if user.verification_key:
-            user.verification_key = None
-            user.save()
-        return authenticate(user, access_token=cas_resp.attributes['accessToken'], response=redirect(service_furl.url))
-    # Ticket could not be validated, unauthorized.
+        user, action = get_user_from_cas_resp(cas_resp)
+        # user found and authenticated
+        if user and action == 'authenticate':
+            # if we successfully authenticate and a verification key is present, invalidate it
+            if user.verification_key:
+                user.verification_key = None
+                user.save()
+            return authenticate(
+                user,
+                cas_resp.attributes['accessToken'],
+                redirect(service_furl.url)
+            )
+        # first time login from remote oauth provider, user does not exist or is not linked
+        if not user and action == 'external_first_login':
+            from website.util import web_url_for
+            # TODO: when cas part is ready, change the attribute names accordingly
+            user = {
+                'fullname': cas_resp.attributes['fullname'],
+                'external_id_provider': cas_resp.attributes['oauthProvider'],
+                'external_id': cas_resp.attributes['oauthId'],
+                'access_token': cas_resp.attributes['accessToken'],
+            }
+            return external_first_login_authenticate(
+                user,
+                redirect(web_url_for('external_login_email_get'))
+            )
+    # Unauthorized: ticket could not be validated, or user does not exist.
     return redirect(service_furl.url)
+
+
+def get_user_from_cas_resp(cas_resp):
+    """
+    Given a CAS service validation response, attempt to retrieve user information and next action.
+
+    :param cas_resp: the cas service validation response
+    :return: the user and the next action
+    """
+
+    # cas returns the OSF user id
+    if cas_resp.user:
+        user = User.load(cas_resp.user)
+        if user:
+            return user, 'authenticate'
+
+    # cas returns the external credential
+    if cas_resp.attributes['oauthProvider'] and cas_resp.attributes['oauthId']:
+        user = get_user(external_id_provider=cas_resp.attributes['oauthProvider'], external_id=cas_resp.attributes['oauthId'])
+        # user found
+        if user:
+            # TODO: check if external identity is verified
+            return user, 'authenticate'
+        # user first time login through oauth
+        else:
+            return None, 'external_first_login'
+
+    return None, None

framework/auth/core.py

@@ -106,21 +106,32 @@ def _get_current_user():
 
 
 # TODO: This should be a class method of User?
-def get_user(email=None, password=None, verification_key=None):
-    """Get an instance of User matching the provided params.
-
-    :return: The instance of User requested
-    :rtype: User or None
+def get_user(email=None, password=None, verification_key=None, external_id_provider=None, external_id=None):
+    """
+    Get an instance of User matching the provided params.
+
+    1. email
+    2. email and password
+    3. verification_key
+    4. oauth_provider and oauth_id
+
+    :param email: user's email
+    :param password: user's password
+    :param verification_key: the verification key
+    :param external_id_provider: the oauth provider
+    :param external_id: the oauth id
+    :rtype bool
     """
-    # tag: database
+
     if password and not email:
-        raise AssertionError('If a password is provided, an email must also '
-                             'be provided.')
+        raise AssertionError('If a password is provided, an email must also be provided.')
 
     query_list = []
+
     if email:
         email = email.strip().lower()
         query_list.append(Q('emails', 'eq', email) | Q('username', 'eq', email))
+
     if password:
         password = password.strip()
         try:
@@ -134,8 +145,14 @@ def get_user(email=None, password=None, verification_key=None):
         if user and not user.check_password(password):
             return False
         return user
+
     if verification_key:
         query_list.append(Q('verification_key', 'eq', verification_key))
+
+    if external_id_provider and external_id:
+        query_list.append(Q('external_identity.{}.id'.format(external_id_provider), 'eq', external_id))
+        query_list.append(Q('external_identity.{}.status'.format(external_id_provider), 'eq', 'VERIFIED'))
+
     try:
         query = query_list[0]
         for query_part in query_list[1:]:
@@ -350,6 +367,16 @@ class User(GuidStoredObject, AddonModelMixin):
     family_name = fields.StringField()
     suffix = fields.StringField()
 
+    # identity for user logged in through external idp
+    external_identity = fields.DictionaryField()
+    # Format: {
+    #   <external_id_provider>: {
+    #       'id': <external_id>,
+    #       'status': 'VERIFIED, 'CREATE', 'LINK'
+    #   },
+    #   ...
+    # }
+
     # Employment history
     jobs = fields.DictionaryField(list=True, validate=validate_history_item)
     # Format: {
@@ -481,16 +508,18 @@ def create(cls, username, password, fullname):
         return user
 
     @classmethod
-    def create_unconfirmed(cls, username, password, fullname, do_confirm=True,
-                           campaign=None):
+    def create_unconfirmed(cls, username, password, fullname, external_identity=None,
+                           external_id_provider=None, do_confirm=True, campaign=None):
         """Create a new user who has begun registration but needs to verify
         their primary email address (username).
         """
         user = cls.create(username, password, fullname)
-        user.add_unconfirmed_email(username)
+        user.add_unconfirmed_email(username, external_id_provider=external_id_provider)
         user.is_registered = False
+        if external_identity:
+            user.external_identity.update(external_identity)
         if campaign:
-            # needed to prevent cirular import
+            # needed to prevent circular import
             from framework.auth.campaigns import system_tag_for_campaign  # skipci
             user.system_tags.append(system_tag_for_campaign(campaign))
         return user
@@ -751,7 +780,7 @@ def _set_email_token_expiration(self, token, expiration=None):
         self.email_verifications[token]['expiration'] = expiration
         return expiration
 
-    def add_unconfirmed_email(self, email, expiration=None):
+    def add_unconfirmed_email(self, email, expiration=None, external_id_provider=None):
         """Add an email verification token for a given email."""
 
         # TODO: This is technically not compliant with RFC 822, which requires
@@ -761,7 +790,7 @@ def add_unconfirmed_email(self, email, expiration=None):
         #       ref: https://tools.ietf.org/html/rfc822#section-6
         email = email.lower().strip()
 
-        if email in self.emails:
+        if not external_id_provider and email in self.emails:
             raise ValueError('Email already confirmed to this user.')
 
         utils.validate_email(email)
@@ -777,8 +806,11 @@ def add_unconfirmed_email(self, email, expiration=None):
             self.email_verifications = {}
 
         # confirmed used to check if link has been clicked
-        self.email_verifications[token] = {'email': email,
-                                           'confirmed': False}
+        self.email_verifications[token] = {
+            'email': email,
+            'confirmed': False,
+            'external_id_provider': external_id_provider
+        }
         self._set_email_token_expiration(token, expiration=expiration)
         return token
 
@@ -838,15 +870,19 @@ def get_confirmation_token(self, email, force=False):
                 return token
         raise KeyError('No confirmation token for email "{0}"'.format(email))
 
-    def get_confirmation_url(self, email, external=True, force=False):
+    def get_confirmation_url(self, email, external=True, force=False, external_id_provider=None):
         """Return the confirmation url for a given email.
 
         :raises: ExpiredTokenError if trying to access a token that is expired.
         :raises: KeyError if there is no token for the email.
         """
         base = settings.DOMAIN if external else '/'
         token = self.get_confirmation_token(email, force=force)
-        return '{0}confirm/{1}/{2}/'.format(base, self._primary_key, token)
+
+        if external_id_provider:
+            return '{0}confirm/external/{1}/{2}/'.format(base, self._primary_key, token)
+        else:
+            return '{0}confirm/{1}/{2}/'.format(base, self._primary_key, token)
 
     def get_unconfirmed_email_for_token(self, token):
         """Return email if valid.

framework/auth/forms.py

@@ -145,6 +145,7 @@ class ResetPasswordForm(Form):
 class SetEmailAndPasswordForm(ResetPasswordForm):
     token = HiddenField()
 
+
 class SignInForm(Form):
     username = email_field
     password = password_field