class BaseController(WSGIController):
    controller_require_perm = "admin"   # Default to the strictest permission.

    def __call__(self, environ, start_response):
        ...

    def __before__(self):
        """Do authentication and authorization according to controller
        class attributes.

        The login controller MUST set controller_require_perm = None,
        or the login redirect will cause an infinite redirect!
        """
        is_auth = config["use_auth"]
        user = session.get("user")
        is_admin_bypass = isinstance(user, AdminBypassUser)
        if not config["use_auth"]:
            if not is_admin_bypass:  # Switch to bypass user.
                session["user"] = user = AdminBypassUser()
            return
        if is_admin_bypass:   # Log bypass user out.
            session["user"] = user = None
        if user:   # Set the HTTP variable for the current user.
            request.environ["REMOTE_USER"] = user.username
        if self.controller_require_perm:
            if not user:   # Require login.
                referer = current_url()
                session["after_login"] = referer
                log.debug("setting session['after_login'] to %r", referer)
                session.save()
                redirect_to("login")
            self._REQUIRE_PERM(self.controller_require_perm)

    def _has_perm(self, perm, **perm_kw):
        """This method recognizes two additional ``perm`` values besides those
        handled by the User object:
        ``None``: no permission required.
        ``"authenticated"``: user must be logged in, but no additional
            permission required.
        """
        if perm is None:
            return True
        user = session.get("user")
        if not user:
            return False
        if perm == "authenticated":
            return True
        return session["user"].has_perm(perm, **perm_kw)

    def _REQUIRE_PERM(self, perm, **perm_kw):
        """Raise a Forbidden error if the user doesn't have the permission.

        The method name is capitalized to make it easier to find and audit in
        code.
        """
        if not self._has_perm(perm, **perm_kw):
            reason = "'%s' permission required for the requested operation."
            abort(403, reason % perm.upper())

def current_url():
    # Temporary kludge until pylons.url.current() stabilizes and returns
    # the query string.
    if request.query_string:
        return "%s?%s" % (request.path_info, request.query_string)
    else:
       return request.path_info

class AuthenticationError(DeclarativeException):  
    pass
class UsernameError(AuthenticationError):
    message = "no such user"
class GenericUsernameError(AuthenticationError):
    message = "no such generic user"
class PasswordError(AuthenticationError):
    message = "incorrect password"
class AccountExpiredError(UsernameError):
    message = (
        "This account has expired; "
        "please contact <CUSTOMER SERVICE ADDRESS>.")

class DeclarativeException(Exception):
    """A simpler way to define an exception with a fixed message.
    """
    message=""

    def __init__(self, message=None):
        Exception.__init__(self, message or self.message)

def authenticate(username, password):
    """Authenticate a user via LDAP or database, and return a ``User`` object.

    Raises ``AuthenticationError`` or subclass if the user is rejected.
    Raises ``EnvironmentError`` if the LDAP server could not be reached.

    If authentication is disabled in the config file, return the
    "Admin Bypass" user, who can do anything.
    """
    # If authentication is disabled, use Admin Bypass.
    if not config["use_auth"]:
        return AdminBypassUser()
    # Here we assume a SQLAlchemy Session object, and an ORM class ``User``.
    # The ``.get`` method returns a User instance, or None if no such user.
    db_user = meta.Session.query(User).get(username)
    role = ""
    division = ""
    if username.startswith("%$"):
        generic_login_password = config.get("generic_login_password")
        if generic_login_password:
            if password != generic_login_password:
                raise PasswordError()
        else:
            raise UsernameError()
        role = username[2:]
        if role not in get_roles():
            raise GenericUsernameError()
    elif username.endswith("@example.com"):
        log.debug("authenticating user '%s' via LDAP", username)
        properties = authenticate_ldap(username, password)
        role, division = process_ldap_properties(properties)
        if db_user:
            role = db_user.role
    elif not db_user:
        log.debug("database has no user '%s'", username)
        raise UsernameError()
    elif not db_user.password:
        log.error("user record '%s' in db has invalid password; pretending user doesn't exist")
        raise UsernameError()
    elif password != db_user.password:
        log.debug("database password for user '%s' does not match", username)
        raise PasswordError()
    else:
        role = db_user.role
    today = datetime.date.today()
    if db_user and db_user.expire and db_user.expire < today:
        raise AccountExpiredError()
    perms = get_permissions()[role]  # Raises KeyError.
    incident_rules = get_incident_rules(username)
    user = User(username, perms, incident_rules, division)
    log.info("authenticated user %s", user)
    return user

def authenticate_ldap(username, password):
    """Authenticate a user via LDAP and return his/her LDAP properties.

    Raises AuthenticationError if the credentials are rejected, or
    EnvironmentError if the LDAP server can't be reached.
    """
    import ldap
    uid = webhelpers.text.chop_at(username, "@example.com")
    dn = "uid=%s,ou=People,o=example.com" % uid
    log.debug("Authenticating %r at %s", dn, LDAP_SERVER)
    if "," in username:
        raise UsernameError("invalid character in username: ,")
    try:
        ldap.set_option(ldap.OPT_X_TLS_CACERTFILE,
            config["ldap.server_certificates"])
        server = ldap.initialize(LDAP_SERVER)
        server.protocol = ldap.VERSION3
        server.simple_bind_s(dn, password)
        properties = server.search_s(dn, ldap.SCOPE_SUBTREE)
        if not properties:
            raise ldap.NO_SUCH_OBJECT()
    except ldap.NO_SUCH_OBJECT, e:
        log.debug("LDAP says no such user '%s' (%s)", uid, username)
        raise UsernameError()
    except ldap.INVALID_CREDENTIALS, e:
        log.debug("LDAP rejected password for user '%s' (%s)", uid, username)
        raise PasswordError()
    except ldap.SERVER_DOWN, e:
        raise EnvironmentError("can't access authentication server")
    return properties

def process_ldap_properties(properties):
    ou = properties[0][1].get('ou', [])
    ou1 = properties[0][1].get('ou1', [])
    if "N/FOO" in ou1:
        return FOO_ROLE, FOO_DIVISION
    elif "N/BAR" in ou:
        try:
            division = DIVISIONS_MAP.get(ou1[0], DEFAULT_DIVISION)
        except IndexError:
            division = DEFAULT_DIVISION
        return SENIOR_PEON, division
    else:
        return PEON, ""

class AuthController(BaseController):
    controller_require_perm = None   # This controller allows public access.
    # Leave this as None to prevent an infinite redirect to the login page!

    def login(self):
        return self._login_form(None, None)

    @restrict("POST")
    @validate(schema=AuthenticateSchema(), form="login")
    def enter(self):
        username = self.form_result["username"]
        password = self.form_result["password"]
        errors = {}
        try:
            user = auth.authenticate(username, password)
        except auth.UsernameError, e:
            errors["username"] = str(e)
        except auth.PasswordError, e:
            errors["password"] = str(e)
        if errors:
            return self._login_form(self.form_result, errors)
        session["user"] = user
        session.save()
        request.environ["REMOTE_USER"] = user.username
        model_User.register_login(user.username)
        referer = session.pop("after_login", None)
        session.save()
        if not referer:
            log.debug("no referer found for login")
        #log.debug("redirecting to %s", referer)
        redirect_to(referer or "home")

    def logout(self):
        session["user"] = None
        session.delete()
        request.environ["REMOTE_USER"] = ""
        h.flash("You have been logged out.")
        redirect_to("login")


    #### Private methods
    def _login_form(self, defaults, errors):
        c.ht_title = "MyApplication Login"
        c.title = None
        c.crumbs = None
        c.action = url_for("enter")
        c.method = "post"
        html = render("/login.html")
        return htmlfill.render(html, defaults, errors)

class User(meta.ORMClass):
    _id_attribute = "username"

    @classmethod
    def register_login(class_, username):
        user = meta.Session(User).get(username)
        if user:
            user.last_login = datetime.date.today()
            meta.Session.commit()

import formencode
from formencode import validators as v


class Username(v.Regex):
    """Usernames may contain only alphanumeric characters, "_", "-", and ".".
    An optional "@" may appear anywhere except first and last position to
    form an email address.  An undocumented "%$" is allowed in first
    position only.
    """
    regex = R"^(%\$)?[\w.-]+(@[\w.-]+)?$"
    strip = True
    accept_python = True

    messages = {
        "invalid": """\
Only alphanumeric characters, "_", "-", "." and "@" are allowed."""
        }


class AuthenticateSchema(formencode.Schema):
    allow_extra_fields = True
    #filter_extra_fields = True
    strip = True

    username = Username(not_empty=True)
    password = v.String(not_empty=True)

<div id="userinfo"><span id="userinfo-inner">
<%    user = session.get("user")    %>
% if user:
You are user <strong>${user.username}</strong> 
with <strong>${user.perms["name"]}${"+" if user.incident_rules else ""}</strong>
permissions.
[<a href="${h.url_for('logout')}">Logout</a>]
% else:
You are not logged in.  Your permissions are <strong>None</strong>.
% endif   user 
</span></div>