def authenhandler(req):
    '''The request handler called by mod_python in the authentication phase.'''
    req.log_error("PYNTLM: Handling connection 0x%X for %s URI %s. %d entries in connection cache." % (
        req.connection.id, req.method,req.unparsed_uri,len(cache)), apache.APLOG_INFO)

    # Extract Authorization header, as a list (if present)
    auth_headers = req.headers_in.get('Authorization', [])
    if not isinstance(auth_headers, list):
        auth_headers = [ auth_headers ]

    # If this connection was authenticated with NTLM, quit immediately with an OK
    # (unless it comes from IE).
    user = req.connection.notes.get('NTLM_AUTHORIZED', None)
    if user:
        req.user = user
        # Internet Explorer sends a Type 1 authorization request with an empty
        # POST, even if the connection is already authenticated.
        # We don't de-authenticate the user (meaning that we don't remove the
        # NTLM_AUTHORIZED key from connection.notes), but we still let a new
        # challenge-response exchange take place.
        # For other methods, it is acceptable to return OK immediately.
        if  auth_headers:
            req.log_error('PYTNLM: Spurious authentication request on connection 0x%X. Method = %s. Content-Length = %d. Headers = %s' % (
            req.connection.id, req.method, req.clength, auth_headers), apache.APLOG_INFO)
            if req.method!='POST' or req.clength>0:
                return apache.OK
        else:
            return apache.OK
    
    # If there is no Authorization header it means it is the first request.
    # We reject it with a 401, indicating which authentication protocol we understand.
    if not auth_headers:
        return handle_unauthorized(req)

    # Extract authentication data from any of the Authorization headers
    try:
        for ah in auth_headers:
            ah_data = decode_http_authorization_header(ah)
            if ah_data:
                break
    except:
        ah_data = False
    
    if not ah_data:
        req.log_error('Error when parsing Authorization header for URI %s' % req.unparsed_uri, apache.APLOG_ERR)
        return apache.HTTP_BAD_REQUEST

    if ah_data[0]=='Basic':
        # If this connection was authenticated with Basic, verify that the
        # credentials match and return 200 (if they do) or 401 (if they
        # don't). We don't need to actually query the DC for that.
        userpwd = req.connection.notes.get('BASIC_AUTHORIZED', None)
        if userpwd:
            if userpwd != ah_data[1]+ah_data[2]:
                return handle_unauthorized(req)
            domain = req.get_options().get('Domain', req.auth_name())
            set_remote_user(req, ah_data[1], domain)
            return apache.OK
        # Connection was not authenticated before
        return handle_basic(req, ah_data[1], ah_data[2])

    # If we get here it means that there is an Authorization header, with an
    # NTLM message in it. Moreover, the connection needs to be (re)authenticated.
    # Most likely, the NTLM message is of:
    # - Type 1 (and there is nothing in the cache): the client wants to
    #   authenticate for the first time,
    # - Type 3 (and there is something in the cache): the client wants to finalize
    #   a pending authentication request.
    #
    # However, it could still be that there is a Type 3 and nothing in the
    # cache (the final client message was erroneously routed to a new connection),
    # or that there is a Type 1 with something in the cache (the client wants to
    # initiate an cancel a pending authentication).

    try:
        ntlm_version = ntlm_message_type(ah_data[1])
        if ntlm_version==1:
            return handle_type1(req, ah_data[1]) 
        if ntlm_version==3:
            if cache.has_key(req.connection.id):
                return handle_type3(req, ah_data[1])
            req.log_error('Unexpected NTLM message Type 3 in new connection for URI %s' %
                (req.unparsed_uri), apache.APLOG_INFO)
            return handle_unauthorized(req)
        error = 'Type 2 message in client request'
    except Exception, e:
        error = str(e)
    req.log_error('Incorrect NTLM message in Authorization header for URI %s: %s' %
            (req.unparsed_uri,error), apache.APLOG_ERR)
    return apache.HTTP_BAD_REQUEST
dataset/ETHPy150Open Legrandin/PyAuthenNTLM2/pyntlm.py/authenhandler/original