def check_authorization(req, username, proxy):
    '''Check if a user that was already authenticated by some previous steps
    is also authorized.

    Authorization is granted depending on the following Apache directives:

    Require valid-user must always be present
    Require user XYZ   authorizes any user named XYZ.
    Require group WER  authorizes any user which is member of the group WER.
                       Group membership is checked at the Active Directory
                       server.
    
    Multiple users and groups can be specified on the same Require line,
    provided they are separated by a comma.

    @req        The request for which authentication was successful.
    @username   Name of the user that has already successfully authenticated (it exists).
                It contains no domain parts.
    @proxy      The proxy that keeps membership data.
    @return     True if the user is authorized, False otherwise.
    '''
   
    rules = ''.join(req.requires()).strip()
    if rules=='valid-user' or cacheGroups.has(rules, username):
        return True
    groups = []
    for r in req.requires():
        if r.lower().startswith("user "):
            users = [ u.strip() for u in r[5:].split(",")]
            if username in users:
                req.log_error('PYNTLM: Authorization succeeded for user %s and URI %s.' %
                    (username,req.unparsed_uri), apache.APLOG_INFO)
                return True
        if r.lower().startswith("group "):
            groups += [ g.strip() for g in r[6:].split(",")]

    if groups:
        try:
            res = proxy.check_membership(username, groups)
        except Exception, e:
            req.log_error('PYNTLM: Unexpected error when checking membership of %s in groups %s for URI %s: %s' % (username,str(groups),req.unparsed_uri,str(e)))
        if res:
            #req.log_error('PYNTLM: Groups before %s' % str(cacheGroups._cache))
            cacheGroups.add(rules, username)
            #req.log_error('PYNTLM: Groups after %s' % str(cacheGroups._cache))
            req.log_error('PYNTLM: Membership check succeeded for %s in groups %s for URI %s.' %
                (username,str(groups),req.unparsed_uri), apache.APLOG_INFO)
            return True
        req.log_error('PYNTLM: Membership check failed of %s in groups %s for URI %s.' %
            (username,str(groups),req.unparsed_uri))
    else:
        req.log_error('PYNTLM: Authorization failed for %s and URI %s.' %
            (username,req.unparsed_uri))
    return False
dataset/ETHPy150Open Legrandin/PyAuthenNTLM2/pyntlm.py/check_authorization/original