Make 'splitAtSign' more consistent

privacyidea/api/auth.py

@@ -58,7 +58,7 @@
                                   db_admin_exist)
 from privacyidea.lib.user import User, split_user, log_used_user
 from privacyidea.lib.policy import PolicyClass
-from privacyidea.lib.realm import get_default_realm
+from privacyidea.lib.realm import get_default_realm, realm_is_defined
 from privacyidea.api.lib.postpolicy import (postpolicy, get_webui_settings, add_user_detail_to_response, check_tokentype, 
                                             check_tokeninfo, check_serial, no_detail_on_fail, no_detail_on_success,
                                             get_webui_settings)
@@ -121,6 +121,7 @@ def get_auth_token():
         the API.
     :jsonparam password: The password/credentials of the user who wants to
         authenticate to the API.
+    :jsonparam realm: The realm where the user will be searched.
 
     :return: A json response with an authentication token, that needs to be
         used in any further request.
@@ -187,15 +188,30 @@ def get_auth_token():
     validity = timedelta(hours=1)
     username = getParam(request.all_data, "username")
     password = getParam(request.all_data, "password")
-    realm = getParam(request.all_data, "realm")
+    realm_param = getParam(request.all_data, "realm")
     details = {}
+    realm = ''
+
+    # the realm parameter has precedence! Check if it exists
+    if realm_param and not realm_is_defined(realm_param):
+        raise AuthError(_("Authentication failure. Unknown realm: {0!s}.".format(realm_param)),
+                        id=ERROR.AUTHENTICATE_WRONG_CREDENTIALS)
 
     if username is None:
         raise AuthError(_("Authentication failure. Missing Username"),
                         id=ERROR.AUTHENTICATE_MISSING_USERNAME)
 
-    if realm:
-        username = username + "@" + realm
+    loginname = username
+    split_at_sign = get_from_config(SYSCONF.SPLITATSIGN, return_bool=True)
+    if split_at_sign:
+        (loginname, realm) = split_user(username)
+
+    # overwrite the splitted realm if we have a realm parameter
+    if realm_param:
+        realm = realm_param
+
+    # and finaly check if there is a realm
+    realm = realm or get_default_realm()
 
     # Failsafe to have the user attempt in the log, whatever happens
     # This can be overwritten later
@@ -216,9 +232,6 @@ def get_auth_token():
     admin_auth = False
     user_auth = False
 
-    loginname, realm = split_user(username)
-    realm = realm or get_default_realm()
-
     user_obj = User()
 
     # Check if the remote user is allowed
@@ -280,7 +293,7 @@ def get_auth_token():
                                 "resolver": user_obj.resolver,
                                 "serial": details.get('serial', None),
                                 "info": u"{0!s}|loginmode={1!s}".format(log_used_user(user_obj),
-                                        details.get("loginmode"))})
+                                                                        details.get("loginmode"))})
         else:
             g.audit_object.log({"user": user_obj.login,
                                 "realm": user_obj.realm,

privacyidea/api/lib/postpolicy.py

@@ -54,9 +54,9 @@
 import re
 import netaddr
 from privacyidea.lib.crypto import Sign
-from privacyidea.api.lib.utils import get_all_params, getParam
+from privacyidea.api.lib.utils import get_all_params
 from privacyidea.lib.auth import ROLE
-from privacyidea.lib.user import (split_user, User)
+from privacyidea.lib.user import User
 from privacyidea.lib.realm import get_default_realm
 from privacyidea.lib.subscriptions import subscription_status
 

privacyidea/lib/user.py

@@ -59,7 +59,7 @@
 from .realm import (get_realms,
                     get_default_realm,
                     get_realm)
-from .config import get_from_config
+from .config import get_from_config, SYSCONF
 from .usercache import (user_cache, cache_username, user_init, delete_user_cache)
 
 log = logging.getLogger(__name__)
@@ -519,7 +519,7 @@ def split_user(username):
     """
     Split the username of the form user@realm into the username and the realm
     splitting myemail@emailprovider.com@realm is also possible and will
-    return (myemail@emailprovider, realm).
+    return (myemail@emailprovider.com, realm).
 
     If for a user@domain the "domain" does not exist as realm, the name is
     not split, since it might be the user@domain in the default realm
@@ -568,8 +568,7 @@ def get_user_from_param(param, optionalOrRequired=optional):
     if username is None:
         username = ""
     else:
-        splitAtSign = get_from_config("splitAtSign", default=False,
-                                      return_bool=True)
+        splitAtSign = get_from_config(SYSCONF.SPLITATSIGN, return_bool=True)
         if splitAtSign:
             (username, realm) = split_user(username)