@LoginRequired()

    @HasPermissionAllDecorator('hg.admin')

    def __before__(self):

        c.admin_user = session.get('admin_user')

        c.admin_username = session.get('admin_username')

        super(PermissionsController, self).__before__()

        self.perms_choices = [('repository.none', _('None'),),

                              ('repository.read', _('Read'),),

                              ('repository.write', _('Write'),),

                              ('repository.admin', _('Admin'),)]

        self.register_choices = [

            ('hg.register.none',

                _('disabled')),

            ('hg.register.manual_activate',

                _('allowed with manual account activation')),

            ('hg.register.auto_activate',

                _('allowed with automatic account activation')), ]

        self.create_choices = [('hg.create.none', _('Disabled')),

                               ('hg.create.repository', _('Enabled'))]

    def index(self, format='html'):

        """GET /permissions: All items in the collection"""

        # url('permissions')

    def create(self):

        """POST /permissions: Create a new item"""

        # url('permissions')

    def new(self, format='html'):

        """GET /permissions/new: Form to create a new item"""

        # url('new_permission')

    def update(self, id):

        """PUT /permissions/id: Update an existing item"""

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="PUT" />

        # Or using helpers:

        #    h.form(url('permission', id=ID),

        #           method='put')

        # url('permission', id=ID)

        permission_model = PermissionModel()

        _form = DefaultPermissionsForm([x[0] for x in self.perms_choices],

                                       [x[0] for x in self.register_choices],

                                       [x[0] for x in self.create_choices])()

        try:

            form_result = _form.to_python(dict(request.POST))

            form_result.update({'perm_user_name': id})

            permission_model.update(form_result)

            h.flash(_('Default permissions updated successfully'),

                    category='success')

        except formencode.Invalid, errors:

            c.perms_choices = self.perms_choices

            c.register_choices = self.register_choices

            c.create_choices = self.create_choices

            defaults = errors.value

            return htmlfill.render(

                render('admin/permissions/permissions.html'),

                defaults=defaults,

                errors=errors.error_dict or {},

                prefix_error=False,

                encoding="UTF-8")

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('error occurred during update of permissions'),

                    category='error')

        return redirect(url('edit_permission', id=id))

    def delete(self, id):

        """DELETE /permissions/id: Delete an existing item"""

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="DELETE" />

        # Or using helpers:

        #    h.form(url('permission', id=ID),

        #           method='delete')

        # url('permission', id=ID)

    def show(self, id, format='html'):

        """GET /permissions/id: Show a specific item"""

        # url('permission', id=ID)

    def edit(self, id, format='html'):

        """GET /permissions/id/edit: Form to edit an existing item"""

        #url('edit_permission', id=ID)

        c.perms_choices = self.perms_choices

        c.register_choices = self.register_choices

        c.create_choices = self.create_choices

        if id == 'default':

            defaults = {'_method': 'put',

                        'anonymous': default_user.active}

            for p in default_user.user_perms:

                if p.permission.permission_name.startswith('repository.'):

                    defaults['default_perm'] = p.permission.permission_name

                if p.permission.permission_name.startswith('hg.register.'):

                    defaults['default_register'] = p.permission.permission_name

                if p.permission.permission_name.startswith('hg.create.'):

                    defaults['default_create'] = p.permission.permission_name

            return htmlfill.render(

                        render('admin/permissions/permissions.html'),

                        defaults=defaults,

                        encoding="UTF-8",

                        force_defaults=True,)

        else:

            return redirect(url('admin_home'))

# -*- coding: utf-8 -*-

"""

    rhodecode.controllers.admin.repos

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Admin controller for RhodeCode

    :created_on: Apr 7, 2010

    :author: marcink

    :copyright: (C) 2009-2011 Marcin Kuzminski <marcin@python-works.com>

    :license: GPLv3, see COPYING for more details.

"""

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import logging

import traceback

import formencode

from operator import itemgetter

from formencode import htmlfill

from paste.httpexceptions import HTTPInternalServerError

from pylons import request, response, session, tmpl_context as c, url

from pylons.controllers.util import abort, redirect

from pylons.i18n.translation import _

from rhodecode.lib import helpers as h

from rhodecode.lib.auth import LoginRequired, HasPermissionAllDecorator, \

    HasPermissionAnyDecorator

from rhodecode.lib.base import BaseController, render

from rhodecode.lib.utils import invalidate_cache, action_logger, repo_name_slug

from rhodecode.lib.helpers import get_token

from rhodecode.model.db import User, Repository, UserFollowing, Group

from rhodecode.model.forms import RepoForm

from rhodecode.model.scm import ScmModel

from rhodecode.model.repo import RepoModel

from sqlalchemy.exc import IntegrityError

log = logging.getLogger(__name__)

class ReposController(BaseController):

    """

    REST Controller styled on the Atom Publishing Protocol"""

    # To properly map this controller, ensure your config/routing.py

    # file has a resource setup:

    #     map.resource('repo', 'repos')

    @LoginRequired()

    @HasPermissionAnyDecorator('hg.admin', 'hg.create.repository')

    def __before__(self):

        c.admin_user = session.get('admin_user')

        c.admin_username = session.get('admin_username')

        super(ReposController, self).__before__()

    def __load_defaults(self):

        repo_model = RepoModel()

        c.repo_groups = [('', '')]

        parents_link = lambda k: h.literal('»'.join(

                                    map(lambda k: k.group_name,

                                        k.parents + [k])

                                    )

                                )

        c.repo_groups.extend([(x.group_id, parents_link(x)) for \

                                            x in self.sa.query(Group).all()])

        c.repo_groups = sorted(c.repo_groups,

                               key=lambda t: t[1].split('»')[0])

        c.repo_groups_choices = map(lambda k: unicode(k[0]), c.repo_groups)

        c.users_array = repo_model.get_users_js()

        c.users_groups_array = repo_model.get_users_groups_js()

    def __load_data(self, repo_name=None):

        """

        Load defaults settings for edit, and update

        :param repo_name:

        """

        self.__load_defaults()

        repo = scm_repo = db_repo.scm_instance

        if c.repo_info is None:

            h.flash(_('%s repository is not mapped to db perhaps'

                      ' it was created or renamed from the filesystem'

                      ' please run the application again'

                      ' in order to rescan repositories') % repo_name,

                      category='error')

            return redirect(url('repos'))

        c.in_public_journal = self.sa.query(UserFollowing)\

            .filter(UserFollowing.user_id == c.default_user_id)\

            .filter(UserFollowing.follows_repository == c.repo_info).scalar()

        if c.repo_info.stats:

            last_rev = c.repo_info.stats.stat_on_revision

        else:

            last_rev = 0

        c.stats_revision = last_rev

        c.repo_last_rev = repo.count() - 1 if repo.revisions else 0

        if last_rev == 0 or c.repo_last_rev == 0:

            c.stats_percentage = 0

        else:

            c.stats_percentage = '%.2f' % ((float((last_rev)) /

                                            c.repo_last_rev) * 100)

        defaults = c.repo_info.get_dict()

        group, repo_name = c.repo_info.groups_and_repo

        defaults['repo_name'] = repo_name

        defaults['repo_group'] = getattr(group[-1] if group else None,

                                         'group_id', None)

        #fill owner

        if c.repo_info.user:

            defaults.update({'user': c.repo_info.user.username})

        else:

            replacement_user = self.sa.query(User)\

            .filter(User.admin == True).first().username

            defaults.update({'user': replacement_user})

        #fill repository users

        for p in c.repo_info.repo_to_perm:

            defaults.update({'u_perm_%s' % p.user.username:

                             p.permission.permission_name})

        #fill repository groups

        for p in c.repo_info.users_group_to_perm:

            defaults.update({'g_perm_%s' % p.users_group.users_group_name:

                             p.permission.permission_name})

        return defaults

    @HasPermissionAllDecorator('hg.admin')

    def index(self, format='html'):

        """GET /repos: All items in the collection"""

        # url('repos')

        c.repos_list = ScmModel().get_repos(Repository.query()

                                            .order_by(Repository.repo_name)

                                            .all(), sort_key='name_sort')

        return render('admin/repos/repos.html')

    @HasPermissionAnyDecorator('hg.admin', 'hg.create.repository')

    def create(self):

        """

        POST /repos: Create a new item"""

        # url('repos')

        repo_model = RepoModel()

        self.__load_defaults()

        form_result = {}

        try:

            form_result = RepoForm(repo_groups=c.repo_groups_choices)()\

                            .to_python(dict(request.POST))

            repo_model.create(form_result, self.rhodecode_user)

            if form_result['clone_uri']:

                h.flash(_('created repository %s from %s') \

                    % (form_result['repo_name'], form_result['clone_uri']),

                    category='success')

            else:

                h.flash(_('created repository %s') % form_result['repo_name'],

                    category='success')

            if request.POST.get('user_created'):

                #created by regular non admin user

                action_logger(self.rhodecode_user, 'user_created_repo',

                              form_result['repo_name_full'], '', self.sa)

            else:

                action_logger(self.rhodecode_user, 'admin_created_repo',

                              form_result['repo_name_full'], '', self.sa)

        except formencode.Invalid, errors:

            c.new_repo = errors.value['repo_name']

            if request.POST.get('user_created'):

                r = render('admin/repos/repo_add_create_repository.html')

            else:

                r = render('admin/repos/repo_add.html')

            return htmlfill.render(

                r,

                defaults=errors.value,

                errors=errors.error_dict or {},

                prefix_error=False,

        except IntegrityError, e:

            if e.message.find('repositories_fork_id_fkey'):

                log.error(traceback.format_exc())

                h.flash(_('Cannot delete %s it still contains attached '

                          'forks') % repo_name,

                        category='warning')

            else:

                log.error(traceback.format_exc())

                h.flash(_('An error occurred during '

                          'deletion of %s') % repo_name,

                        category='error')

        except Exception, e:

            log.error(traceback.format_exc())

            h.flash(_('An error occurred during deletion of %s') % repo_name,

                    category='error')

        return redirect(url('repos'))

    @HasPermissionAllDecorator('hg.admin')

    def delete_perm_user(self, repo_name):

        """

        DELETE an existing repository permission user

        :param repo_name:

        """

        try:

            repo_model = RepoModel()

            repo_model.delete_perm_user(request.POST, repo_name)

        except Exception, e:

            h.flash(_('An error occurred during deletion of repository user'),

                    category='error')

            raise HTTPInternalServerError()

    @HasPermissionAllDecorator('hg.admin')

    def delete_perm_users_group(self, repo_name):

        """

        DELETE an existing repository permission users group

        :param repo_name:

        """

        try:

            repo_model = RepoModel()

            repo_model.delete_perm_users_group(request.POST, repo_name)

        except Exception, e:

            h.flash(_('An error occurred during deletion of repository'

                      ' users groups'),

                    category='error')

            raise HTTPInternalServerError()

    @HasPermissionAllDecorator('hg.admin')

    def repo_stats(self, repo_name):

        """

        DELETE an existing repository statistics

        :param repo_name:

        """

        try:

            repo_model = RepoModel()

            repo_model.delete_stats(repo_name)

        except Exception, e:

            h.flash(_('An error occurred during deletion of repository stats'),

                    category='error')

        return redirect(url('edit_repo', repo_name=repo_name))

    @HasPermissionAllDecorator('hg.admin')

    def repo_cache(self, repo_name):

        """

        INVALIDATE existing repository cache

        :param repo_name:

        """

        try:

            ScmModel().mark_for_invalidation(repo_name)

        except Exception, e:

            h.flash(_('An error occurred during cache invalidation'),

                    category='error')

        return redirect(url('edit_repo', repo_name=repo_name))

    @HasPermissionAllDecorator('hg.admin')

    def repo_public_journal(self, repo_name):

        """

        Set's this repository to be visible in public journal,

        in other words assing default user to follow this repo

        :param repo_name:

        """

        cur_token = request.POST.get('auth_token')

        token = get_token()

        if cur_token == token:

            try:

                self.scm_model.toggle_following_repo(repo_id, user_id)

                h.flash(_('Updated repository visibility in public journal'),

                        category='success')

            except:

                h.flash(_('An error occurred during setting this'

                          ' repository in public journal'),

                        category='error')

        else:

            h.flash(_('Token mismatch'), category='error')

        return redirect(url('edit_repo', repo_name=repo_name))

    @HasPermissionAllDecorator('hg.admin')

    def repo_pull(self, repo_name):

        """

        Runs task to update given repository with remote changes,

        ie. make pull on remote location

        :param repo_name:

        """

        try:

            ScmModel().pull_changes(repo_name, self.rhodecode_user.username)

            h.flash(_('Pulled from remote location'), category='success')

        except Exception, e:

            h.flash(_('An error occurred during pull from remote location'),

                    category='error')

        return redirect(url('edit_repo', repo_name=repo_name))

    @HasPermissionAllDecorator('hg.admin')

    def show(self, repo_name, format='html'):

        """GET /repos/repo_name: Show a specific item"""

        # url('repo', repo_name=ID)

    @HasPermissionAllDecorator('hg.admin')

    def edit(self, repo_name, format='html'):

        """GET /repos/repo_name/edit: Form to edit an existing item"""

        # url('edit_repo', repo_name=ID)

        defaults = self.__load_data(repo_name)

        return htmlfill.render(

            render('admin/repos/repo_edit.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False

        )

# -*- coding: utf-8 -*-

"""

    rhodecode.controllers.login

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Login controller for rhodeocode

    :created_on: Apr 22, 2010

    :author: marcink

    :copyright: (C) 2009-2011 Marcin Kuzminski <marcin@python-works.com>

    :license: GPLv3, see COPYING for more details.

"""

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import logging

import formencode

from formencode import htmlfill

from pylons.i18n.translation import _

from pylons.controllers.util import abort, redirect

from pylons import request, response, session, tmpl_context as c, url

import rhodecode.lib.helpers as h

from rhodecode.lib.auth import AuthUser, HasPermissionAnyDecorator

from rhodecode.lib.base import BaseController, render

from rhodecode.model.db import User

from rhodecode.model.forms import LoginForm, RegisterForm, PasswordResetForm

from rhodecode.model.user import UserModel

log = logging.getLogger(__name__)

class LoginController(BaseController):

    def __before__(self):

        super(LoginController, self).__before__()

    def index(self):

        #redirect if already logged in

        c.came_from = request.GET.get('came_from', None)

        if self.rhodecode_user.is_authenticated \

                            and self.rhodecode_user.username != 'default':

            return redirect(url('home'))

        if request.POST:

            #import Login Form validator class

            login_form = LoginForm()

            try:

                c.form_result = login_form.to_python(dict(request.POST))

                #form checks for username/password, now we're authenticated

                username = c.form_result['username']

                auth_user = AuthUser(user.user_id)

                auth_user.set_authenticated()

                session['rhodecode_user'] = auth_user

                session.save()

                log.info('user %s is now authenticated and stored in session',

                         username)

                user.update_lastlogin()

                if c.came_from:

                    return redirect(c.came_from)

                else:

                    return redirect(url('home'))

            except formencode.Invalid, errors:

                return htmlfill.render(

                    render('/login.html'),

                    defaults=errors.value,

                    errors=errors.error_dict or {},

                    prefix_error=False,

                    encoding="UTF-8")

        return render('/login.html')

    @HasPermissionAnyDecorator('hg.admin', 'hg.register.auto_activate',

                               'hg.register.manual_activate')

    def register(self):

        user_model = UserModel()

        c.auto_active = False

            if perm.permission.permission_name == 'hg.register.auto_activate':

                c.auto_active = True

                break

        if request.POST:

            register_form = RegisterForm()()

            try:

                form_result = register_form.to_python(dict(request.POST))

                form_result['active'] = c.auto_active

                user_model.create_registration(form_result)

                h.flash(_('You have successfully registered into rhodecode'),

                            category='success')

                return redirect(url('login_home'))

            except formencode.Invalid, errors:

                return htmlfill.render(

                    render('/register.html'),

                    defaults=errors.value,

                    errors=errors.error_dict or {},

                    prefix_error=False,

                    encoding="UTF-8")

        return render('/register.html')

    def password_reset(self):

        user_model = UserModel()

        if request.POST:

            password_reset_form = PasswordResetForm()()

            try:

                form_result = password_reset_form.to_python(dict(request.POST))

                user_model.reset_password_link(form_result)

                h.flash(_('Your password reset link was sent'),

                            category='success')

                return redirect(url('login_home'))

            except formencode.Invalid, errors:

                return htmlfill.render(

                    render('/password_reset.html'),

                    defaults=errors.value,

                    errors=errors.error_dict or {},

                    prefix_error=False,

                    encoding="UTF-8")

        return render('/password_reset.html')

    def password_reset_confirmation(self):

        if request.GET and request.GET.get('key'):

            try:

                user_model = UserModel()

                user = User.get_by_api_key(request.GET.get('key'))

                data = dict(email=user.email)

                user_model.reset_password(data)

                h.flash(_('Your password reset was successful, '

                          'new password has been sent to your email'),

                            category='success')

            except Exception, e:

                log.error(e)

                return redirect(url('reset_password'))

        return redirect(url('login_home'))

    def logout(self):

        del session['rhodecode_user']

        session.save()

        log.info('Logging out and setting user as Empty')

        redirect(url('home'))

# -*- coding: utf-8 -*-

"""

    rhodecode.lib.auth

    ~~~~~~~~~~~~~~~~~~

    authentication and permission libraries

    :created_on: Apr 4, 2010

    :copyright: (c) 2010 by marcink.

    :license: LICENSE_NAME, see LICENSE_FILE for more details.

"""

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import random

import logging

import traceback

import hashlib

from tempfile import _RandomNameSequence

from decorator import decorator

from pylons import config, session, url, request

from pylons.controllers.util import abort, redirect

from pylons.i18n.translation import _

from rhodecode import __platform__, PLATFORM_WIN, PLATFORM_OTHERS

if __platform__ in PLATFORM_WIN:

    from hashlib import sha256

if __platform__ in PLATFORM_OTHERS:

    import bcrypt

from rhodecode.lib import str2bool, safe_unicode

from rhodecode.lib.exceptions import LdapPasswordError, LdapUsernameError

from rhodecode.lib.utils import get_repo_slug

from rhodecode.lib.auth_ldap import AuthLdap

from rhodecode.model import meta

from rhodecode.model.user import UserModel

log = logging.getLogger(__name__)

class PasswordGenerator(object):

    """This is a simple class for generating password from

        different sets of characters

        usage:

        passwd_gen = PasswordGenerator()

        #print 8-letter password containing only big and small letters

            of alphabet

        print passwd_gen.gen_password(8, passwd_gen.ALPHABETS_BIG_SMALL)

    """

    ALPHABETS_NUM = r'''1234567890'''

    ALPHABETS_SMALL = r'''qwertyuiopasdfghjklzxcvbnm'''

    ALPHABETS_BIG = r'''QWERTYUIOPASDFGHJKLZXCVBNM'''

    ALPHABETS_SPECIAL = r'''`-=[]\;',./~!@#$%^&*()_+{}|:"<>?'''

    ALPHABETS_FULL = ALPHABETS_BIG + ALPHABETS_SMALL \

        + ALPHABETS_NUM + ALPHABETS_SPECIAL

    ALPHABETS_ALPHANUM = ALPHABETS_BIG + ALPHABETS_SMALL + ALPHABETS_NUM

    ALPHABETS_BIG_SMALL = ALPHABETS_BIG + ALPHABETS_SMALL

    ALPHABETS_ALPHANUM_BIG = ALPHABETS_BIG + ALPHABETS_NUM

    ALPHABETS_ALPHANUM_SMALL = ALPHABETS_SMALL + ALPHABETS_NUM

    def __init__(self, passwd=''):

        self.passwd = passwd

    def gen_password(self, len, type):

        self.passwd = ''.join([random.choice(type) for _ in xrange(len)])

        return self.passwd

class RhodeCodeCrypto(object):

    @classmethod

    def hash_string(cls, str_):

        """

        Cryptographic function used for password hashing based on pybcrypt

        or pycrypto in windows

        :param password: password to hash

        """

        if __platform__ in PLATFORM_WIN:

            return sha256(str_).hexdigest()

        elif __platform__ in PLATFORM_OTHERS:

            return bcrypt.hashpw(str_, bcrypt.gensalt(10))

        else:

            raise Exception('Unknown or unsupported platform %s' \

                            % __platform__)

    @classmethod

    def hash_check(cls, password, hashed):

        """

        Checks matching password with it's hashed value, runs different

        implementation based on platform it runs on

        :param password: password

        :param hashed: password in hashed form

        """

        if __platform__ in PLATFORM_WIN:

            return sha256(password).hexdigest() == hashed

        elif __platform__ in PLATFORM_OTHERS:

            return bcrypt.hashpw(password, hashed) == hashed

        else:

            raise Exception('Unknown or unsupported platform %s' \

                            % __platform__)

def get_crypt_password(password):

    return RhodeCodeCrypto.hash_string(password)

def check_password(password, hashed):

    return RhodeCodeCrypto.hash_check(password, hashed)

def generate_api_key(username, salt=None):

    if salt is None:

        salt = _RandomNameSequence().next()

    return hashlib.sha1(username + salt).hexdigest()

def authfunc(environ, username, password):

    """Dummy authentication function used in Mercurial/Git/ and access control,

    :param environ: needed only for using in Basic auth

    """

    return authenticate(username, password)

def authenticate(username, password):

    """Authentication function used for access control,

    firstly checks for db authentication then if ldap is enabled for ldap

    authentication, also creates ldap user if not in database

    :param username: username

    :param password: password

    """

    user_model = UserModel()

    log.debug('Authenticating user using RhodeCode account')

    if user is not None and not user.ldap_dn:

        if user.active:

            if user.username == 'default' and user.active:

                log.info('user %s authenticated correctly as anonymous user',

                         username)

                return True

            elif user.username == username and check_password(password,

                                                              user.password):

                log.info('user %s authenticated correctly', username)

                return True

        else:

            log.warning('user %s is disabled', username)

    else:

        log.debug('Regular authentication failed')

        if user_obj is not None and not user_obj.ldap_dn:

            log.debug('this user already exists as non ldap')

            return False

        ldap_settings = RhodeCodeSettings.get_ldap_settings()

        #======================================================================

        # FALLBACK TO LDAP AUTH IF ENABLE

        #======================================================================

        if str2bool(ldap_settings.get('ldap_active')):

            log.debug("Authenticating user using ldap")

            kwargs = {

                  'server': ldap_settings.get('ldap_host', ''),

                  'base_dn': ldap_settings.get('ldap_base_dn', ''),

                  'port': ldap_settings.get('ldap_port'),

                  'bind_dn': ldap_settings.get('ldap_dn_user'),

                  'bind_pass': ldap_settings.get('ldap_dn_pass'),

                  'tls_kind': ldap_settings.get('ldap_tls_kind'),

                  'tls_reqcert': ldap_settings.get('ldap_tls_reqcert'),

                  'ldap_filter': ldap_settings.get('ldap_filter'),

                  'search_scope': ldap_settings.get('ldap_search_scope'),

                  'attr_login': ldap_settings.get('ldap_attr_login'),

                  'ldap_version': 3,

                  }

            log.debug('Checking for ldap authentication')

            try:

                aldap = AuthLdap(**kwargs)

                (user_dn, ldap_attrs) = aldap.authenticate_ldap(username,

                                                                password)

                log.debug('Got ldap DN response %s', user_dn)

                get_ldap_attr = lambda k: ldap_attrs.get(ldap_settings\

                                                           .get(k), [''])[0]

                user_attrs = {

                 'name': safe_unicode(get_ldap_attr('ldap_attr_firstname')),

                 'lastname': safe_unicode(get_ldap_attr('ldap_attr_lastname')),

                 'email': get_ldap_attr('ldap_attr_email'),

                }