aker 3.0.0.pre

data/lib/aker/cas/user_ext.rb

@@ -0,0 +1,64 @@
+require 'aker/cas'
+
+require 'castanet'
+
+module Aker::Cas
+  ##
+  # Extensions for {Aker::User} instances that come from CAS
+  # credentials.
+  module UserExt
+    include Castanet::Client
+
+    ##
+    # The base URL of the CAS server.
+    #
+    # This is typically set by {Authority#valid_credentials?}.
+    #
+    # @see Aker::Cas::ConfigurationHelper#cas_url
+    # @return [String]
+    attr_accessor :cas_url
+
+    ##
+    # The proxy callback URL used by the CAS server.
+    #
+    # This is typically set by {Authority#valid_credentials?}.
+    #
+    # @see Aker::Cas::ConfigurationHelper#proxy_callback_url
+    # @return [String, nil]
+    attr_accessor :proxy_callback_url
+
+    ##
+    # The proxy retrieval URL from which Aker will retrieve PGTs.
+    #
+    # This is typically set by {Authority#valid_credentials?}.
+    #
+    # @see Aker::Cas::ConfigurationHelper#proxy_retrieval_url
+    # @return [String, nil]
+    attr_accessor :proxy_retrieval_url
+
+    ##
+    # The proxy granting ticket associated with the {Aker::User}, or nil if no
+    # PGT exists.
+    #
+    # @return [String, nil]
+    attr_accessor :pgt
+
+    ##
+    # Returns a proxy ticket so that an application may authenticate
+    # to another CAS-using service on behalf of this user.  Each
+    # invocation will request and return a fresh ticket.
+    #
+    # @param [String] service_base_url the URL by which CAS knows the
+    #   service that this proxy will be used for.  For aker-protected
+    #   applications, this will always be the base URL for the whole
+    #   application — i.e., the URL for the server plus the mount
+    #   point for the application, if any.
+    #
+    # @see ProxyMode#service_url
+    #
+    # @return [String] a new ticket
+    def cas_proxy_ticket(service_base_url)
+      issue_proxy_ticket(pgt, service_base_url).ticket
+    end
+  end
+end

data/lib/aker/cas.rb

@@ -0,0 +1,31 @@
+require 'aker'
+
+module Aker
+  ##
+  # Common code for dealing with CAS servers.
+  module Cas
+    autoload :Authority,           'aker/cas/authority'
+    autoload :ConfigurationHelper, 'aker/cas/configuration_helper'
+    autoload :Middleware,          'aker/cas/middleware'
+    autoload :ProxyMode,           'aker/cas/proxy_mode'
+    autoload :RackProxyCallback,   'aker/cas/rack_proxy_callback'
+    autoload :ServiceMode,         'aker/cas/service_mode'
+    autoload :ServiceUrl,          'aker/cas/service_url'
+    autoload :UserExt,             'aker/cas/user_ext'
+
+    ##
+    # @private
+    class Slice < Aker::Configuration::Slice
+      def initialize
+        super do
+          alias_authority :cas, Authority
+
+          register_mode ProxyMode
+          register_mode ServiceMode
+        end
+      end
+    end
+  end
+end
+
+Aker::Configuration.add_default_slice(Aker::Cas::Slice.new)

data/lib/aker/central_parameters.rb

@@ -0,0 +1,101 @@
+require 'aker'
+require 'yaml'
+
+module Aker
+  ##
+  # Provides consistent access to server-based defaults for
+  # configuration parameters. These defaults are stored in a YAML file
+  # on the server and updated separately from application
+  # deployments. E.g., you might have the following in
+  # /etc/nubic/aker-prod.yml:
+  #
+  #     ldap:
+  #       server: ldap.example.org
+  #       user: cn=foo
+  #       password: 13635;nefvqerg35245gk
+  #     policy:
+  #       session_timeout_seconds: 1500
+  #
+  # The top level keys in this file correspond to parameter groups in
+  # a {Aker::Configuration}. If this file were loaded like so,
+  #
+  #     Aker.configure {
+  #       central '/etc/nubic/aker-prod.yml'
+  #     }
+  #
+  # it would be equivalent to the following:
+  #
+  #     Aker.configure {
+  #       ldap_parameters :server => 'ldap.example.org',
+  #                       :user => 'cn=foo',
+  #                       :password => '13635;nefvqerg35245gk'
+  #       policy_parameters :session_timeout_seconds => 1500
+  #     }
+  #
+  # The `central` approach has several benefits:
+  #
+  # * It is simultaneously updateable for all applications on a
+  #   server.
+  # * It separates system administration tasks from application
+  #   developer concerns.
+  # * It provides an easy alternative to checking sensitive
+  #   information (in this example, the LDAP password) into the VCS.
+  # * No flexibility is lost — individual applications may still
+  #   override parameter values if necessary.
+  #
+  # @see https://github.com/NUBIC/bcdatabase
+  #      Bcdatabase: a tool which provides similar capabilities for
+  #      database and service configurations.
+  class CentralParameters < Hash
+    ##
+    # Creates a new instance with the given overrides.
+    #
+    # @param [String, Hash] values if a hash, it is used as a set of
+    #   overrides directly.  Otherwise it is interpreted as the filename
+    #   for the system central parameters YAML file.
+    def initialize(values = {})
+      super
+
+      unless values.is_a? Hash
+        values = YAML::load( File.open(values) )
+      end
+
+      values = nested_symbolize_keys!(deep_clone(values))
+      update(values)
+    end
+
+    ##
+    # Returns the value or (more likely) hash of values corresponding
+    # to the given top-level configuration section.
+    #
+    # Note that, no matter the structure of the values hash provided
+    # on construction, all keys in any hashes returned by this method
+    # will be symbols.
+    #
+    # @param [Symbol] key the configuration section to access
+    def [](key)
+      super
+    end
+
+    #######
+    private
+
+    def deep_clone(src)
+      clone = { }
+      src.each_pair do |k, v|
+        clone[k] = v.is_a?(Hash) ? deep_clone(v) : v
+      end
+      clone
+    end
+
+    def nested_symbolize_keys!(target)
+      target.keys.each do |k|
+        v = target[k]
+        nested_symbolize_keys!(v) if v.respond_to?(:keys)
+        target.delete(k)
+        target[k.to_sym] = v
+      end
+      target
+    end
+  end
+end