balrog 0.1.0 → 2.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.circleci/config.yml +56 -0
- data/.gitignore +2 -0
- data/CHANGELOG.md +27 -0
- data/Gemfile.lock +136 -13
- data/README.md +193 -23
- data/app/assets/stylesheets/balrog/gate.css +15 -4
- data/app/views/balrog/gate.html.erb +17 -26
- data/app/views/layouts/balrog.html.erb +22 -0
- data/balrog.gemspec +1 -0
- data/bin/console +1 -1
- data/lib/balrog.rb +4 -1
- data/lib/balrog/engine.rb +23 -4
- data/lib/balrog/generators.rb +1 -1
- data/lib/balrog/generators/install_generator.rb +3 -2
- data/lib/balrog/generators/view_generator.rb +25 -0
- data/lib/balrog/guard.rb +24 -0
- data/lib/balrog/helpers.rb +6 -2
- data/lib/balrog/middleware.rb +47 -33
- data/lib/balrog/middleware/controller.rb +106 -0
- data/lib/balrog/routes_middleware.rb +30 -0
- data/lib/balrog/version.rb +1 -1
- data/lib/balrog/view_helpers.rb +24 -0
- metadata +28 -6
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: c908a9916866b576a2914041573fed0ae64555a1956b3a94a3c36e37476e7cf6
|
|
4
|
+
data.tar.gz: 814d65c1b25cfe3e3a561daed8091643694ce81a70eb543eaa40c09939689183
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 58872926e04fd6bafd1bdb12915d5a3e0aad33a7e79a82ac074cad45bd8da011cd1f760aae6cb6a8035fd2f1beb2d4a6f16cc2b2c4e3a1ec78718eef4f61b732
|
|
7
|
+
data.tar.gz: b1c7fd33821672a9f59818fe5a543fca3c5d14221d1fac6ff23b5566ec53e63cc2d8f07323057793094edbb7bf5673c72f64bd802cc97febda0973eb5169e7d3
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
version: 2.1
|
|
2
|
+
|
|
3
|
+
jobs:
|
|
4
|
+
build:
|
|
5
|
+
docker:
|
|
6
|
+
- image: circleci/ruby:2.6.2-node-browsers
|
|
7
|
+
- image: circleci/redis:5.0.4
|
|
8
|
+
|
|
9
|
+
working_directory: ~/repo/spec/dummy-rails-app
|
|
10
|
+
|
|
11
|
+
steps:
|
|
12
|
+
- checkout:
|
|
13
|
+
path: ~/repo
|
|
14
|
+
|
|
15
|
+
# Download and cache dependencies
|
|
16
|
+
- restore_cache:
|
|
17
|
+
name: Restore Rubygems cache
|
|
18
|
+
keys:
|
|
19
|
+
- v1-rubygems-{{ checksum "Gemfile.lock" }}
|
|
20
|
+
# fallback to using the latest cache if no exact match is found
|
|
21
|
+
- v1-rubygems-
|
|
22
|
+
|
|
23
|
+
- run:
|
|
24
|
+
name: Install bundler
|
|
25
|
+
command: |
|
|
26
|
+
gem install bundler:2.0.1
|
|
27
|
+
- run:
|
|
28
|
+
name: Install Ruby dependencies
|
|
29
|
+
command: |
|
|
30
|
+
bundle install --jobs=4 --retry=3 --path vendor/bundle
|
|
31
|
+
|
|
32
|
+
- save_cache:
|
|
33
|
+
name: Save Rubygems cache
|
|
34
|
+
paths:
|
|
35
|
+
- ./vendor/bundle
|
|
36
|
+
key: v1-rubygems-{{ checksum "Gemfile.lock" }}
|
|
37
|
+
|
|
38
|
+
# run tests!
|
|
39
|
+
- run:
|
|
40
|
+
name: run tests
|
|
41
|
+
command: |
|
|
42
|
+
mkdir /tmp/test-results
|
|
43
|
+
TEST_FILES="$(circleci tests glob "spec/**/*_spec.rb" | circleci tests split --split-by=timings)"
|
|
44
|
+
|
|
45
|
+
bundle exec rspec --format progress \
|
|
46
|
+
--format RspecJunitFormatter \
|
|
47
|
+
--out /tmp/test-results/rspec.xml \
|
|
48
|
+
--format progress \
|
|
49
|
+
$TEST_FILES
|
|
50
|
+
|
|
51
|
+
# collect reports
|
|
52
|
+
- store_test_results:
|
|
53
|
+
path: /tmp/test-results
|
|
54
|
+
- store_artifacts:
|
|
55
|
+
path: /tmp/test-results
|
|
56
|
+
destination: test-results
|
data/.gitignore
CHANGED
data/CHANGELOG.md
ADDED
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
# 2.0.0
|
|
2
|
+
|
|
3
|
+
- Enhancements
|
|
4
|
+
- added support for single sign-on.
|
|
5
|
+
|
|
6
|
+
- BREAKING
|
|
7
|
+
- Balrog can no longer be initialized via `Rails.application.config.middleware.use Balrog::Middleware`. Instead, you need to configure Balrog with `Balrog::Middleware.setup`. See the [README](https://github.com/pixielabs/balrog#Upgrading-from-1.1-to-2.0) for more info.
|
|
8
|
+
- The instance method `Balrog::Middleware#password_hash` has been converted into a class method `Balrog::Middleware.set_password_hash`. See the [README](https://github.com/pixielabs/balrog#Upgrading-from-1.1-to-2.0) for more info.
|
|
9
|
+
- The instance method `Balrog::Middleware#set_session_expiry` has been converted into a class method `Balrog::Middleware.set_session_expiry`. See the [README](https://github.com/pixielabs/balrog#Upgrading-from-1.1-to-2.0) for more info.
|
|
10
|
+
|
|
11
|
+
# 1.1.0
|
|
12
|
+
|
|
13
|
+
- added `Balrog::Middleware#set_session_expiry`, which would force end users to login again after a certain period of time.
|
|
14
|
+
- added `balrog:view` generator, enabling users to modify their Balrog gate view.
|
|
15
|
+
|
|
16
|
+
# 1.0.0
|
|
17
|
+
|
|
18
|
+
- added `Balrog::RoutesMiddleware` module, which can be used to protect mounted Rack applications.
|
|
19
|
+
- dropped support for Rails < 5.
|
|
20
|
+
|
|
21
|
+
# 0.2.0
|
|
22
|
+
|
|
23
|
+
- added `balrog_logout_button` view helper method.
|
|
24
|
+
|
|
25
|
+
# 0.1.0
|
|
26
|
+
|
|
27
|
+
- initial release.
|
data/Gemfile.lock
CHANGED
|
@@ -1,28 +1,151 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
balrog (0.1
|
|
4
|
+
balrog (2.0.1)
|
|
5
5
|
bcrypt (~> 3.0)
|
|
6
|
+
rails (>= 5)
|
|
6
7
|
|
|
7
8
|
GEM
|
|
8
9
|
remote: https://rubygems.org/
|
|
9
10
|
specs:
|
|
10
|
-
|
|
11
|
+
actioncable (6.0.2.2)
|
|
12
|
+
actionpack (= 6.0.2.2)
|
|
13
|
+
nio4r (~> 2.0)
|
|
14
|
+
websocket-driver (>= 0.6.1)
|
|
15
|
+
actionmailbox (6.0.2.2)
|
|
16
|
+
actionpack (= 6.0.2.2)
|
|
17
|
+
activejob (= 6.0.2.2)
|
|
18
|
+
activerecord (= 6.0.2.2)
|
|
19
|
+
activestorage (= 6.0.2.2)
|
|
20
|
+
activesupport (= 6.0.2.2)
|
|
21
|
+
mail (>= 2.7.1)
|
|
22
|
+
actionmailer (6.0.2.2)
|
|
23
|
+
actionpack (= 6.0.2.2)
|
|
24
|
+
actionview (= 6.0.2.2)
|
|
25
|
+
activejob (= 6.0.2.2)
|
|
26
|
+
mail (~> 2.5, >= 2.5.4)
|
|
27
|
+
rails-dom-testing (~> 2.0)
|
|
28
|
+
actionpack (6.0.2.2)
|
|
29
|
+
actionview (= 6.0.2.2)
|
|
30
|
+
activesupport (= 6.0.2.2)
|
|
31
|
+
rack (~> 2.0, >= 2.0.8)
|
|
32
|
+
rack-test (>= 0.6.3)
|
|
33
|
+
rails-dom-testing (~> 2.0)
|
|
34
|
+
rails-html-sanitizer (~> 1.0, >= 1.2.0)
|
|
35
|
+
actiontext (6.0.2.2)
|
|
36
|
+
actionpack (= 6.0.2.2)
|
|
37
|
+
activerecord (= 6.0.2.2)
|
|
38
|
+
activestorage (= 6.0.2.2)
|
|
39
|
+
activesupport (= 6.0.2.2)
|
|
40
|
+
nokogiri (>= 1.8.5)
|
|
41
|
+
actionview (6.0.2.2)
|
|
42
|
+
activesupport (= 6.0.2.2)
|
|
43
|
+
builder (~> 3.1)
|
|
44
|
+
erubi (~> 1.4)
|
|
45
|
+
rails-dom-testing (~> 2.0)
|
|
46
|
+
rails-html-sanitizer (~> 1.1, >= 1.2.0)
|
|
47
|
+
activejob (6.0.2.2)
|
|
48
|
+
activesupport (= 6.0.2.2)
|
|
49
|
+
globalid (>= 0.3.6)
|
|
50
|
+
activemodel (6.0.2.2)
|
|
51
|
+
activesupport (= 6.0.2.2)
|
|
52
|
+
activerecord (6.0.2.2)
|
|
53
|
+
activemodel (= 6.0.2.2)
|
|
54
|
+
activesupport (= 6.0.2.2)
|
|
55
|
+
activestorage (6.0.2.2)
|
|
56
|
+
actionpack (= 6.0.2.2)
|
|
57
|
+
activejob (= 6.0.2.2)
|
|
58
|
+
activerecord (= 6.0.2.2)
|
|
59
|
+
marcel (~> 0.3.1)
|
|
60
|
+
activesupport (6.0.2.2)
|
|
61
|
+
concurrent-ruby (~> 1.0, >= 1.0.2)
|
|
62
|
+
i18n (>= 0.7, < 2)
|
|
63
|
+
minitest (~> 5.1)
|
|
64
|
+
tzinfo (~> 1.1)
|
|
65
|
+
zeitwerk (~> 2.2)
|
|
66
|
+
bcrypt (3.1.13)
|
|
67
|
+
builder (3.2.4)
|
|
68
|
+
concurrent-ruby (1.1.6)
|
|
69
|
+
crass (1.0.6)
|
|
11
70
|
diff-lcs (1.3)
|
|
71
|
+
erubi (1.9.0)
|
|
72
|
+
globalid (0.4.2)
|
|
73
|
+
activesupport (>= 4.2.0)
|
|
74
|
+
i18n (1.8.2)
|
|
75
|
+
concurrent-ruby (~> 1.0)
|
|
76
|
+
loofah (2.5.0)
|
|
77
|
+
crass (~> 1.0.2)
|
|
78
|
+
nokogiri (>= 1.5.9)
|
|
79
|
+
mail (2.7.1)
|
|
80
|
+
mini_mime (>= 0.1.1)
|
|
81
|
+
marcel (0.3.3)
|
|
82
|
+
mimemagic (~> 0.3.2)
|
|
83
|
+
method_source (1.0.0)
|
|
84
|
+
mimemagic (0.3.4)
|
|
85
|
+
mini_mime (1.0.2)
|
|
86
|
+
mini_portile2 (2.4.0)
|
|
87
|
+
minitest (5.14.0)
|
|
88
|
+
nio4r (2.5.2)
|
|
89
|
+
nokogiri (1.10.9)
|
|
90
|
+
mini_portile2 (~> 2.4.0)
|
|
91
|
+
rack (2.2.2)
|
|
92
|
+
rack-test (1.1.0)
|
|
93
|
+
rack (>= 1.0, < 3)
|
|
94
|
+
rails (6.0.2.2)
|
|
95
|
+
actioncable (= 6.0.2.2)
|
|
96
|
+
actionmailbox (= 6.0.2.2)
|
|
97
|
+
actionmailer (= 6.0.2.2)
|
|
98
|
+
actionpack (= 6.0.2.2)
|
|
99
|
+
actiontext (= 6.0.2.2)
|
|
100
|
+
actionview (= 6.0.2.2)
|
|
101
|
+
activejob (= 6.0.2.2)
|
|
102
|
+
activemodel (= 6.0.2.2)
|
|
103
|
+
activerecord (= 6.0.2.2)
|
|
104
|
+
activestorage (= 6.0.2.2)
|
|
105
|
+
activesupport (= 6.0.2.2)
|
|
106
|
+
bundler (>= 1.3.0)
|
|
107
|
+
railties (= 6.0.2.2)
|
|
108
|
+
sprockets-rails (>= 2.0.0)
|
|
109
|
+
rails-dom-testing (2.0.3)
|
|
110
|
+
activesupport (>= 4.2.0)
|
|
111
|
+
nokogiri (>= 1.6)
|
|
112
|
+
rails-html-sanitizer (1.3.0)
|
|
113
|
+
loofah (~> 2.3)
|
|
114
|
+
railties (6.0.2.2)
|
|
115
|
+
actionpack (= 6.0.2.2)
|
|
116
|
+
activesupport (= 6.0.2.2)
|
|
117
|
+
method_source
|
|
118
|
+
rake (>= 0.8.7)
|
|
119
|
+
thor (>= 0.20.3, < 2.0)
|
|
12
120
|
rake (10.5.0)
|
|
13
|
-
rspec (3.
|
|
14
|
-
rspec-core (~> 3.
|
|
15
|
-
rspec-expectations (~> 3.
|
|
16
|
-
rspec-mocks (~> 3.
|
|
17
|
-
rspec-core (3.
|
|
18
|
-
rspec-support (~> 3.
|
|
19
|
-
rspec-expectations (3.
|
|
121
|
+
rspec (3.9.0)
|
|
122
|
+
rspec-core (~> 3.9.0)
|
|
123
|
+
rspec-expectations (~> 3.9.0)
|
|
124
|
+
rspec-mocks (~> 3.9.0)
|
|
125
|
+
rspec-core (3.9.0)
|
|
126
|
+
rspec-support (~> 3.9.0)
|
|
127
|
+
rspec-expectations (3.9.0)
|
|
20
128
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
21
|
-
rspec-support (~> 3.
|
|
22
|
-
rspec-mocks (3.
|
|
129
|
+
rspec-support (~> 3.9.0)
|
|
130
|
+
rspec-mocks (3.9.0)
|
|
23
131
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
24
|
-
rspec-support (~> 3.
|
|
25
|
-
rspec-support (3.
|
|
132
|
+
rspec-support (~> 3.9.0)
|
|
133
|
+
rspec-support (3.9.0)
|
|
134
|
+
sprockets (4.0.0)
|
|
135
|
+
concurrent-ruby (~> 1.0)
|
|
136
|
+
rack (> 1, < 3)
|
|
137
|
+
sprockets-rails (3.2.1)
|
|
138
|
+
actionpack (>= 4.0)
|
|
139
|
+
activesupport (>= 4.0)
|
|
140
|
+
sprockets (>= 3.0.0)
|
|
141
|
+
thor (1.0.1)
|
|
142
|
+
thread_safe (0.3.6)
|
|
143
|
+
tzinfo (1.2.7)
|
|
144
|
+
thread_safe (~> 0.1)
|
|
145
|
+
websocket-driver (0.7.1)
|
|
146
|
+
websocket-extensions (>= 0.1.0)
|
|
147
|
+
websocket-extensions (0.1.4)
|
|
148
|
+
zeitwerk (2.3.0)
|
|
26
149
|
|
|
27
150
|
PLATFORMS
|
|
28
151
|
ruby
|
data/README.md
CHANGED
|
@@ -2,22 +2,35 @@
|
|
|
2
2
|
|
|
3
3
|
|
|
4
4
|
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
Balrog is
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
5
|
+
[](https://badge.fury.io/rb/balrog)
|
|
6
|
+
[](https://circleci.com/gh/pixielabs/balrog)
|
|
7
|
+
|
|
8
|
+
Balrog is a lightweight authorization library for Ruby on Rails >= 5 written by
|
|
9
|
+
[Pixie Labs](https://pixielabs.io) that can protect your routes. Balrog can be
|
|
10
|
+
configured to authorize users using a simple password or single sign-on or both.
|
|
11
|
+
|
|
12
|
+
- If you choose to protect your routes with a password, the password will be
|
|
13
|
+
stored as a password hash, not plain text, and Balrog provides a lightweight
|
|
14
|
+
HTML form that can be styled and used with password managers.
|
|
15
|
+
- If you choose to configure Balrog to use SSO, you can whitelist multiple email
|
|
16
|
+
domains, allowing groups of users access parts of your app, without circulating
|
|
17
|
+
a password.
|
|
18
|
+
- Balrog's authentication can and should be configured to expire, requiring
|
|
19
|
+
users to sign-in again in accordance with [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-expiration) best practices.
|
|
20
|
+
- Balrog can also be used to restrict access to [mounted Rack applications](#Restricting-access-to-mounted-Rack-applications-within-config/routes.rb) like Sidekiq.
|
|
21
|
+
|
|
22
|
+
## Table of Contents
|
|
23
|
+
|
|
24
|
+
- [Installation](#Installation)
|
|
25
|
+
- [Regenerating a password hash](#Regenerating-a-password-hash)
|
|
26
|
+
- [Restricting access in a controller](#Restricting-access-in-a-controller)
|
|
27
|
+
- [Restricting access to mounted Rack applications](#Restricting-access-to-mounted-Rack-applications-within-config/routes.rb)
|
|
28
|
+
- [Logout button](#Logout-button)
|
|
29
|
+
- [Changing session expiry length](#Changing-session-expiry-length)
|
|
30
|
+
- [Configuring the Balrog gate view](#Configuring-the-Balrog-gate-view)
|
|
31
|
+
- [Single Sign On](#Single-Sign-On)
|
|
32
|
+
- [Upgrading from 1.1 to 2.0](#Upgrading-from-1.1-to-2.0)
|
|
33
|
+
- [Contributing](#Contributing)
|
|
21
34
|
|
|
22
35
|
## Installation
|
|
23
36
|
|
|
@@ -29,10 +42,10 @@ gem 'balrog'
|
|
|
29
42
|
|
|
30
43
|
Run the installer to generate an initializer:
|
|
31
44
|
|
|
32
|
-
```
|
|
45
|
+
```shell
|
|
33
46
|
$ bundle exec rails generate balrog:install
|
|
34
|
-
Enter New Password:
|
|
35
|
-
Confirm New Password:
|
|
47
|
+
Enter New Password:
|
|
48
|
+
Confirm New Password:
|
|
36
49
|
create config/initializers/balrog.rb
|
|
37
50
|
$
|
|
38
51
|
```
|
|
@@ -60,8 +73,169 @@ class AdminController < ApplicationController
|
|
|
60
73
|
end
|
|
61
74
|
```
|
|
62
75
|
|
|
76
|
+
## Restricting access to mounted Rack applications within config/routes.rb
|
|
77
|
+
|
|
78
|
+
Use the `.use` [method](https://www.rubydoc.info/gems/rack/Rack%2FBuilder:use) to add Balrog to the 'stack'.
|
|
79
|
+
|
|
80
|
+
For example with Sidekiq::Web...
|
|
81
|
+
|
|
82
|
+
```ruby
|
|
83
|
+
# Then we tell SideKiq to use Balrog::RoutesMiddleware
|
|
84
|
+
Sidekiq::Web.use Balrog::RoutesMiddleware
|
|
85
|
+
|
|
86
|
+
mount Sidekiq::Web => '/sidekiq'
|
|
87
|
+
```
|
|
88
|
+
|
|
89
|
+
N.B. If you are mounting Sidekiq Web, you need to [disable Sidekiq Web's session in config/initializers/sidekiq.rb](https://github.com/mperham/sidekiq/issues/3377#issuecomment-381254940).
|
|
90
|
+
|
|
91
|
+
```ruby
|
|
92
|
+
require 'sidekiq/web'
|
|
93
|
+
|
|
94
|
+
# In order to force sidekiq to use the rails app's session,
|
|
95
|
+
# we need to disable the Sidekiq's session.
|
|
96
|
+
Sidekiq::Web.disable(:sessions)
|
|
97
|
+
```
|
|
98
|
+
|
|
99
|
+
## Logout button
|
|
100
|
+
|
|
101
|
+
To add a logout button, you can call the `balrog_logout_button` view helper
|
|
102
|
+
method and pass in a hash of HTML options to style it. After logout, the user
|
|
103
|
+
will be redirected to the root of the app.
|
|
104
|
+
|
|
105
|
+
For example, in your view:
|
|
106
|
+
|
|
107
|
+
```erb
|
|
108
|
+
<ul class='nav'>
|
|
109
|
+
<li>....</li>
|
|
110
|
+
<li><%= balrog_logout_button 'Admin Logout' %></li>
|
|
111
|
+
<li>....</li>
|
|
112
|
+
</ul>
|
|
113
|
+
```
|
|
114
|
+
|
|
115
|
+
Other usage examples:
|
|
116
|
+
|
|
117
|
+
```erb
|
|
118
|
+
<%= balrog_logout_button %>
|
|
119
|
+
<%= balrog_logout_button "Leave this place" %>
|
|
120
|
+
<%= balrog_logout_button "Click me", class: 'fancy-button--with-custom-text' %>
|
|
121
|
+
<%= balrog_logout_button class: 'fancy-button--with-default-text' %>
|
|
122
|
+
```
|
|
123
|
+
|
|
124
|
+
## Changing session expiry length
|
|
125
|
+
|
|
126
|
+
`set_session_expiry` requires the user to login again after a period of time.
|
|
127
|
+
To customise this value, open `config/initializers/balrog.rb` after running `balrog:install`
|
|
128
|
+
and change the argument being passed to `set_session_expiry`.
|
|
129
|
+
|
|
130
|
+
The argument passed to `set_session_expiry` can be any of the
|
|
131
|
+
[Rails time extensions](https://api.rubyonrails.org/classes/Numeric.html).
|
|
132
|
+
|
|
133
|
+
If you don't want sessions to expire, remove `set_session_expiry`
|
|
134
|
+
from the initializer completely.
|
|
135
|
+
|
|
136
|
+
```ruby
|
|
137
|
+
Balrog::Middleware.setup do |config|
|
|
138
|
+
config.password_hash '$2a$12$BLz7XCFdG9YfwL64KlTgY.T3FY55aQk8SZEzHfpHfw15F2uN1kuSi'
|
|
139
|
+
config.set_session_expiry 30.minutes
|
|
140
|
+
end
|
|
141
|
+
```
|
|
142
|
+
|
|
143
|
+
## Configuring the Balrog gate view
|
|
144
|
+
|
|
145
|
+
We built Balrog to have a default view and stylesheet so that you can drop
|
|
146
|
+
Balrog into your project and everything should “just work”.
|
|
147
|
+
However, we don't want to be in your way if you needed to customise
|
|
148
|
+
your Balrog gate view.
|
|
149
|
+
|
|
150
|
+
If you want to customise the Balrog view, you can run the `balrog:view`
|
|
151
|
+
generator, which will copy the required view and layout to your application:
|
|
152
|
+
|
|
153
|
+
```shell
|
|
154
|
+
$ rails generate balrog:view
|
|
155
|
+
```
|
|
156
|
+
|
|
157
|
+
After running the generator, you can now add elements and classes to the
|
|
158
|
+
`views/balrog/gate.html.erb`, add styles to the
|
|
159
|
+
`assets/stylesheets/application.css` and import the application stylesheet in
|
|
160
|
+
`app/views/layouts/balrog.html.erb`. For an example, see the
|
|
161
|
+
[dummy-rails-app](https://github.com/pixielabs/balrog/tree/master/spec/dummy-rails-app) in the spec folder.
|
|
162
|
+
|
|
163
|
+
## Single Sign On
|
|
164
|
+
|
|
165
|
+
To add single sign on you will need to add the [omniauth gem](https://github.com/omniauth/omniauth)
|
|
166
|
+
to your gem file, along with the omniauth gem for your chosen
|
|
167
|
+
[provider](https://github.com/omniauth/omniauth/wiki/List-of-Strategies).
|
|
168
|
+
|
|
169
|
+
In `config/initializers/balrog.rb`, call `config.set_omniauth` in the setup block.
|
|
170
|
+
`.set_omniauth` takes the same arguments as the `OmniAuth::Builder#provider`
|
|
171
|
+
[method](https://github.com/omniauth/omniauth#getting-started),
|
|
172
|
+
a provider and any required keys.
|
|
173
|
+
|
|
174
|
+
To whitelist any email addresses with a specific domain, call
|
|
175
|
+
`config.set_domain_whitelist`in the setup block and pass in the domain.
|
|
176
|
+
If you want to whitelist multiple domains, you can pass multiple domains
|
|
177
|
+
to the `.set_domain_whitelist`.
|
|
178
|
+
|
|
179
|
+
Balrog does not require a password to be set if you wish to use single sign-on only.
|
|
180
|
+
|
|
181
|
+
```ruby
|
|
182
|
+
Balrog::Middleware.setup do |config|
|
|
183
|
+
credentials = Rails.application.credentials
|
|
184
|
+
config.set_omniauth :google_oauth2, credentials.google_client_id, credentials.google_client_secret
|
|
185
|
+
config.set_domain_whitelist 'pixielabs.io', 'the_fellowship.com'
|
|
186
|
+
end
|
|
187
|
+
```
|
|
188
|
+
**Please note:** there is currently a CSRF vulnerability which affects OmniAuth
|
|
189
|
+
(designated [CVE-2015-9284](https://nvd.nist.gov/vuln/detail/CVE-2015-9284))
|
|
190
|
+
that requires mitigation at the application level. More details on how to do
|
|
191
|
+
this can be found on the [Omniauth Wiki](https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284).
|
|
192
|
+
|
|
193
|
+
## Upgrading from 1.1 to 2.0
|
|
194
|
+
|
|
195
|
+
To upgrade, you will need to change your Balrog initializer.
|
|
196
|
+
|
|
197
|
+
1. Instead of calling `Rails.application.config.middleware.use Balrog::Middleware`, you will now need to call `Balrog::Middleware.setup`.
|
|
198
|
+
|
|
199
|
+
2. Change the block you pass into these methods. `#password_hash` and `#set_session_expiry` now need to called on a block parameter, e.g `set_session_expiry 30.minutes` needs to be changed to `config.set_session_expiry 30.minutes`.
|
|
200
|
+
|
|
201
|
+
See below for code examples.
|
|
202
|
+
|
|
203
|
+
```ruby
|
|
204
|
+
# Balrog 1.1
|
|
205
|
+
Rails.application.config.middleware.use Balrog::Middleware do
|
|
206
|
+
password_hash '$2a$12$I8Fp3e2GfSdM7KFyoMx56.BVdHeeyk9DQWKkdsxw7USvU/mC8a8.q'
|
|
207
|
+
set_session_expiry 30.minutes
|
|
208
|
+
end
|
|
209
|
+
```
|
|
210
|
+
|
|
211
|
+
```ruby
|
|
212
|
+
# Balrog 2.0
|
|
213
|
+
Balrog::Middleware.setup do |config|
|
|
214
|
+
config.set_password_hash '$2a$12$9lquJW6mVYYS1pD1xYMGzulyC6sEDuLIUfkA/Y7F3RQ8psLNYyLeO'
|
|
215
|
+
config.set_session_expiry 30.minutes
|
|
216
|
+
end
|
|
217
|
+
```
|
|
218
|
+
|
|
63
219
|
## Contributing
|
|
64
220
|
|
|
221
|
+
### Running the tests
|
|
222
|
+
|
|
223
|
+
Tests are part of the dummy Rails app within the spec folder. To run the tests:
|
|
224
|
+
|
|
225
|
+
```
|
|
226
|
+
$ cd spec/dummy-rails-app
|
|
227
|
+
$ bundle
|
|
228
|
+
$ rails generate active_record:session_migration
|
|
229
|
+
$ redis-server
|
|
230
|
+
```
|
|
231
|
+
|
|
232
|
+
Then in a different terminal:
|
|
233
|
+
|
|
234
|
+
```
|
|
235
|
+
$ cd spec/dummy-rails-app
|
|
236
|
+
$ rspec
|
|
237
|
+
```
|
|
238
|
+
|
|
65
239
|
Before contributing, please read the [code of conduct](CODE_OF_CONDUCT.md).
|
|
66
240
|
- Check out the latest master to make sure the feature hasn't been implemented
|
|
67
241
|
or the bug hasn't been fixed yet.
|
|
@@ -74,11 +248,7 @@ Before contributing, please read the [code of conduct](CODE_OF_CONDUCT.md).
|
|
|
74
248
|
want to have your own version, or is otherwise necessary, that is fine, but
|
|
75
249
|
please isolate to its own commit so we can cherry-pick around it.
|
|
76
250
|
|
|
77
|
-
|
|
78
251
|
## TODO
|
|
79
252
|
|
|
80
253
|
* Restricting access via `routes.rb`
|
|
81
|
-
* Logout
|
|
82
254
|
* Test coverage
|
|
83
|
-
* Check it's OK with Ruby on Rails 6
|
|
84
|
-
* Expire sessions
|
|
@@ -27,8 +27,7 @@ footer {
|
|
|
27
27
|
align-self: center;
|
|
28
28
|
}
|
|
29
29
|
|
|
30
|
-
|
|
31
|
-
-webkit-appearance: button;
|
|
30
|
+
.button_background {
|
|
32
31
|
overflow: visible;
|
|
33
32
|
text-transform: none;
|
|
34
33
|
-webkit-transition-duration: 0.4s;
|
|
@@ -39,13 +38,25 @@ button {
|
|
|
39
38
|
font-size: 20px;
|
|
40
39
|
font-family: 'Helvetica Neue', 'Helvetica', Calibri, 'Trebuchet MS', sans-serif;
|
|
41
40
|
cursor: pointer;
|
|
42
|
-
padding: 8px 10px;
|
|
43
41
|
border: 0;
|
|
44
42
|
font-weight: 100;
|
|
45
43
|
letter-spacing: 1px;
|
|
44
|
+
margin: 5px 0px;
|
|
45
|
+
}
|
|
46
|
+
|
|
47
|
+
button {
|
|
48
|
+
-webkit-appearance: button;
|
|
49
|
+
padding: 8px 10px;
|
|
50
|
+
}
|
|
51
|
+
|
|
52
|
+
.sso_button {
|
|
53
|
+
display: inline-block;
|
|
54
|
+
text-decoration: none;
|
|
55
|
+
padding: 8px 0px;
|
|
56
|
+
width: 305.438px;
|
|
46
57
|
}
|
|
47
58
|
|
|
48
|
-
button:hover {
|
|
59
|
+
button:hover, .sso_button:hover {
|
|
49
60
|
background-color: rgb(201, 41, 41);
|
|
50
61
|
}
|
|
51
62
|
|
|
@@ -1,26 +1,17 @@
|
|
|
1
|
-
|
|
2
|
-
<
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
</
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
</
|
|
17
|
-
|
|
18
|
-
<footer>
|
|
19
|
-
<a href="https://github.com/pixielabs/balrog" target="_blank">
|
|
20
|
-
<%= image_tag "balrog/logo.png", class: 'logo' %>
|
|
21
|
-
</a>
|
|
22
|
-
</footer>
|
|
23
|
-
|
|
24
|
-
</body>
|
|
25
|
-
|
|
26
|
-
</html>
|
|
1
|
+
<section>
|
|
2
|
+
<div>
|
|
3
|
+
<% if show_balrog_password_prompt? %>
|
|
4
|
+
<form action='/balrog/signin' method='POST'>
|
|
5
|
+
<input autofocus type='password' name='password' placeholder='Password'>
|
|
6
|
+
<button type='submit' class="button_background">Login</button>
|
|
7
|
+
</form>
|
|
8
|
+
<% end %>
|
|
9
|
+
<% if balrog_omniauth_configured? %>
|
|
10
|
+
<%= button_to(
|
|
11
|
+
"Sign in with SSO",
|
|
12
|
+
"/auth/#{Balrog::Middleware.omniauth_config[:provider]}",
|
|
13
|
+
class: 'button_background sso_button'
|
|
14
|
+
) %>
|
|
15
|
+
<% end %>
|
|
16
|
+
</div>
|
|
17
|
+
</section>
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
<!doctype html>
|
|
2
|
+
<html lang=en>
|
|
3
|
+
<head>
|
|
4
|
+
<meta charset=utf-8>
|
|
5
|
+
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
6
|
+
<title>Login</title>
|
|
7
|
+
<%= stylesheet_link_tag "balrog/gate" %>
|
|
8
|
+
</head>
|
|
9
|
+
|
|
10
|
+
<body>
|
|
11
|
+
|
|
12
|
+
<%= yield %>
|
|
13
|
+
|
|
14
|
+
<footer>
|
|
15
|
+
<a href="https://github.com/pixielabs/balrog" target="_blank">
|
|
16
|
+
<%= image_tag "balrog/logo.png", class: 'logo' %>
|
|
17
|
+
</a>
|
|
18
|
+
</footer>
|
|
19
|
+
|
|
20
|
+
</body>
|
|
21
|
+
|
|
22
|
+
</html>
|
data/balrog.gemspec
CHANGED
data/bin/console
CHANGED
data/lib/balrog.rb
CHANGED
|
@@ -1,6 +1,9 @@
|
|
|
1
|
-
|
|
1
|
+
require 'rails'
|
|
2
|
+
|
|
2
3
|
module Balrog
|
|
4
|
+
require_relative 'balrog/version'
|
|
3
5
|
require_relative 'balrog/middleware'
|
|
6
|
+
require_relative 'balrog/routes_middleware'
|
|
4
7
|
require_relative 'balrog/engine'
|
|
5
8
|
require_relative 'balrog/rake_tasks'
|
|
6
9
|
require_relative 'balrog/generators'
|
data/lib/balrog/engine.rb
CHANGED
|
@@ -1,13 +1,20 @@
|
|
|
1
|
-
require_relative 'helpers'
|
|
2
|
-
|
|
3
1
|
class Balrog::Engine < Rails::Engine
|
|
4
|
-
# Make
|
|
5
|
-
initializer "balrog.
|
|
2
|
+
# Make authenticate_with_balrog! available.
|
|
3
|
+
initializer "balrog.action_controller" do
|
|
6
4
|
ActiveSupport.on_load(:action_controller) do
|
|
5
|
+
require_relative 'helpers'
|
|
7
6
|
include Balrog::Helpers
|
|
8
7
|
end
|
|
9
8
|
end
|
|
10
9
|
|
|
10
|
+
# Add balrog_logout_button as a global view helper.
|
|
11
|
+
initializer "balrog.action_view" do
|
|
12
|
+
ActiveSupport.on_load(:action_view) do
|
|
13
|
+
require_relative 'view_helpers'
|
|
14
|
+
include Balrog::ViewHelpers
|
|
15
|
+
end
|
|
16
|
+
end
|
|
17
|
+
|
|
11
18
|
# Precompile the Balrog assets
|
|
12
19
|
initializer "balrog.assets.precompile" do |app|
|
|
13
20
|
app.config.assets.precompile += %w(
|
|
@@ -15,4 +22,16 @@ class Balrog::Engine < Rails::Engine
|
|
|
15
22
|
balrog/logo.png
|
|
16
23
|
)
|
|
17
24
|
end
|
|
25
|
+
|
|
26
|
+
# Insert Balrog into middleware stack.
|
|
27
|
+
initializer "Balrog.middleware", after: :load_config_initializers, before: :build_middleware_stack do |app|
|
|
28
|
+
# If OmniAuth configured, insert OmniAuth into middleware stack.
|
|
29
|
+
omniauth_config = Balrog::Middleware.omniauth_config
|
|
30
|
+
if omniauth_config
|
|
31
|
+
app.middleware.use OmniAuth::Builder do
|
|
32
|
+
provider omniauth_config[:provider], *omniauth_config[:args]
|
|
33
|
+
end
|
|
34
|
+
end
|
|
35
|
+
app.middleware.use Balrog::Middleware
|
|
36
|
+
end
|
|
18
37
|
end
|
data/lib/balrog/generators.rb
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# This Railtie makes the Balrog Generators available from the command line.
|
|
2
2
|
class Balrog::Generators < Rails::Railtie
|
|
3
3
|
generators do
|
|
4
|
-
|
|
4
|
+
Dir[File.join(__dir__, 'generators', '*.rb')].each { |file| require file }
|
|
5
5
|
end
|
|
6
6
|
end
|
|
@@ -6,8 +6,9 @@ class Balrog::InstallGenerator < Rails::Generators::Base
|
|
|
6
6
|
def create_initializer_file
|
|
7
7
|
password_hash = PasswordHasher.encrypt_password
|
|
8
8
|
contents = <<~EOF
|
|
9
|
-
|
|
10
|
-
|
|
9
|
+
Balrog::Middleware.setup do |config|
|
|
10
|
+
config.set_password_hash '#{password_hash}'
|
|
11
|
+
config.set_session_expiry 30.minutes
|
|
11
12
|
end
|
|
12
13
|
EOF
|
|
13
14
|
create_file "config/initializers/balrog.rb", contents
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
class Balrog::ViewGenerator < Rails::Generators::Base
|
|
2
|
+
|
|
3
|
+
desc "Copies the Balrog gate view and layout into your application, where you can edit and style them."
|
|
4
|
+
def copy_gate_view
|
|
5
|
+
gate_view = File.open(
|
|
6
|
+
File.join(__dir__, '../../../', 'app/views/balrog/gate.html.erb'),
|
|
7
|
+
'r')
|
|
8
|
+
|
|
9
|
+
content = gate_view.read
|
|
10
|
+
gate_view.close
|
|
11
|
+
|
|
12
|
+
create_file "app/views/balrog/gate.html.erb", content
|
|
13
|
+
end
|
|
14
|
+
|
|
15
|
+
def copy_layout
|
|
16
|
+
gate_view = File.open(
|
|
17
|
+
File.join(__dir__, '../../../', 'app/views/layouts/balrog.html.erb'),
|
|
18
|
+
'r')
|
|
19
|
+
|
|
20
|
+
content = gate_view.read
|
|
21
|
+
gate_view.close
|
|
22
|
+
|
|
23
|
+
create_file "app/views/layouts/balrog.html.erb", content
|
|
24
|
+
end
|
|
25
|
+
end
|
data/lib/balrog/guard.rb
ADDED
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
# Contains authentication logic to check the user has been authenticated,
|
|
2
|
+
# and that the session hasn't expired.
|
|
3
|
+
module Balrog::Guard
|
|
4
|
+
def authenticated?(balrog_session)
|
|
5
|
+
@balrog_session = balrog_session&.with_indifferent_access
|
|
6
|
+
previously_authenticated? && still_valid?
|
|
7
|
+
end
|
|
8
|
+
|
|
9
|
+
private
|
|
10
|
+
|
|
11
|
+
# A method to check that the user has been authenticated before.
|
|
12
|
+
def previously_authenticated?
|
|
13
|
+
return false unless @balrog_session
|
|
14
|
+
@balrog_session[:value] == 'authenticated'
|
|
15
|
+
end
|
|
16
|
+
|
|
17
|
+
# A method to check that the authentication has not expired.
|
|
18
|
+
def still_valid?
|
|
19
|
+
# If the user did not set configured the Balrog session
|
|
20
|
+
# to expire, the cookie is valid.
|
|
21
|
+
return true unless @balrog_session[:expiry_date]
|
|
22
|
+
DateTime.current < @balrog_session[:expiry_date]
|
|
23
|
+
end
|
|
24
|
+
end
|
data/lib/balrog/helpers.rb
CHANGED
|
@@ -1,8 +1,12 @@
|
|
|
1
|
+
require_relative 'guard'
|
|
2
|
+
|
|
1
3
|
# Helpers methods are made available in all controllers by the code in engine.rb.
|
|
2
4
|
module Balrog::Helpers
|
|
5
|
+
include Balrog::Guard
|
|
6
|
+
|
|
3
7
|
def authenticate_with_balrog!
|
|
4
|
-
unless session[:balrog]
|
|
5
|
-
render 'balrog/gate', layout:
|
|
8
|
+
unless authenticated?(session[:balrog])
|
|
9
|
+
render 'balrog/gate', layout: 'balrog'
|
|
6
10
|
end
|
|
7
11
|
end
|
|
8
12
|
end
|
data/lib/balrog/middleware.rb
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
require 'bcrypt'
|
|
2
|
+
require_relative 'middleware/controller'
|
|
2
3
|
|
|
3
4
|
# Public: Balrog middleware that handles form submissions, checking the
|
|
4
5
|
# password against the configured hash, and setting a session variable if
|
|
@@ -7,60 +8,73 @@ require 'bcrypt'
|
|
|
7
8
|
# This is typically set up in an initialize when you run
|
|
8
9
|
# `rails g balrog:install`, and looks a bit like this:
|
|
9
10
|
#
|
|
10
|
-
#
|
|
11
|
-
#
|
|
12
|
-
#
|
|
11
|
+
# Balrog::Middleware.setup do |config|
|
|
12
|
+
# config.set_password_hash '<bcrypt hash>'
|
|
13
|
+
# end
|
|
14
|
+
|
|
13
15
|
class Balrog::Middleware
|
|
14
|
-
|
|
16
|
+
include Controller
|
|
17
|
+
|
|
18
|
+
mattr_reader :password_hash
|
|
19
|
+
mattr_reader :session_length
|
|
20
|
+
mattr_reader :omniauth_config
|
|
21
|
+
mattr_reader :domain_whitelist
|
|
22
|
+
|
|
23
|
+
def initialize(app)
|
|
15
24
|
@app = app
|
|
16
|
-
instance_eval(&block) if block_given?
|
|
17
25
|
end
|
|
18
26
|
|
|
19
27
|
def call(env)
|
|
20
28
|
path = env["PATH_INFO"]
|
|
21
29
|
method = env["REQUEST_METHOD"]
|
|
22
|
-
if
|
|
23
|
-
|
|
30
|
+
if login_request?(path, method)
|
|
31
|
+
password_login(env)
|
|
32
|
+
elsif omniauth_request?(path, method)
|
|
33
|
+
omniauthentication(env)
|
|
34
|
+
elsif logout_request?(path, method)
|
|
35
|
+
logout(env)
|
|
24
36
|
else
|
|
25
37
|
@app.call(env)
|
|
26
38
|
end
|
|
27
39
|
end
|
|
28
40
|
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
def password_hash(input)
|
|
32
|
-
@password_hash = BCrypt::Password.new(input)
|
|
41
|
+
def self.setup
|
|
42
|
+
yield self
|
|
33
43
|
end
|
|
34
44
|
|
|
35
|
-
|
|
36
|
-
if env['rack.request.form_hash']
|
|
37
|
-
submitted_password = env['rack.request.form_hash']['password']
|
|
38
|
-
end
|
|
39
|
-
|
|
40
|
-
unless submitted_password
|
|
41
|
-
return [302, {"Location" => referer}, [""]]
|
|
42
|
-
end
|
|
45
|
+
private
|
|
43
46
|
|
|
44
|
-
|
|
45
|
-
|
|
47
|
+
def self.set_password_hash(input)
|
|
48
|
+
@@password_hash = BCrypt::Password.new(input)
|
|
49
|
+
end
|
|
46
50
|
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
51
|
+
def self.set_omniauth(provider, *args)
|
|
52
|
+
@@omniauth_config = {
|
|
53
|
+
provider: provider,
|
|
54
|
+
args: args
|
|
55
|
+
}
|
|
56
|
+
end
|
|
52
57
|
|
|
53
|
-
|
|
54
|
-
|
|
58
|
+
def self.set_domain_whitelist(*domains)
|
|
59
|
+
@@domain_whitelist = domains
|
|
60
|
+
end
|
|
55
61
|
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
62
|
+
def self.set_session_expiry(time_period)
|
|
63
|
+
@@session_length = time_period
|
|
64
|
+
end
|
|
59
65
|
|
|
60
|
-
|
|
66
|
+
def login_request?(path, method)
|
|
67
|
+
method == 'POST' && path == '/balrog/signin'
|
|
68
|
+
end
|
|
61
69
|
|
|
62
|
-
|
|
70
|
+
def omniauth_request?(path, method)
|
|
71
|
+
omniauth_config &&
|
|
72
|
+
method == "GET" &&
|
|
73
|
+
path == "/auth/#{omniauth_config[:provider]}/callback"
|
|
63
74
|
end
|
|
64
75
|
|
|
76
|
+
def logout_request?(path, method)
|
|
77
|
+
method == "DELETE" && path == '/balrog/logout'
|
|
78
|
+
end
|
|
65
79
|
end
|
|
66
80
|
|
|
@@ -0,0 +1,106 @@
|
|
|
1
|
+
# Methods that are called in response to specific application requests.
|
|
2
|
+
class Balrog::Middleware
|
|
3
|
+
module Controller
|
|
4
|
+
|
|
5
|
+
# This method is called if a user attempts to sign in with a password
|
|
6
|
+
# and will authenticate the user if the password is correct.
|
|
7
|
+
def password_login(env)
|
|
8
|
+
# Extract the submitted_password from the rack request hash.
|
|
9
|
+
if env['rack.request.form_hash']
|
|
10
|
+
submitted_password = env['rack.request.form_hash']['password']
|
|
11
|
+
end
|
|
12
|
+
|
|
13
|
+
# If there is no submitted_password, redirect the user before authentication.
|
|
14
|
+
unless submitted_password
|
|
15
|
+
return [302, {"Location" => referer}, [""]]
|
|
16
|
+
end
|
|
17
|
+
|
|
18
|
+
# If there is no password_hash, alert the developer.
|
|
19
|
+
unless password_hash
|
|
20
|
+
warn <<~EOF
|
|
21
|
+
|
|
22
|
+
!! Balrog has not been configured with a password_hash. You shall not
|
|
23
|
+
!! pass! When adding Balrog::Middleware to your middleware stack, pass
|
|
24
|
+
!! in a block and call `password_hash` passing in a bcrypt hash.
|
|
25
|
+
!!
|
|
26
|
+
!! Check out https://github.com/pixielabs/balrog for more information.
|
|
27
|
+
|
|
28
|
+
EOF
|
|
29
|
+
end
|
|
30
|
+
|
|
31
|
+
# Authenticate the user if the submitted_password matches the password_hash.
|
|
32
|
+
if password_hash == submitted_password
|
|
33
|
+
authenticate_user(env)
|
|
34
|
+
end
|
|
35
|
+
|
|
36
|
+
referer = env["HTTP_REFERER"] || '/'
|
|
37
|
+
|
|
38
|
+
[302, {"Location" => referer}, [""]]
|
|
39
|
+
end
|
|
40
|
+
|
|
41
|
+
|
|
42
|
+
# This method is called if a user attempts to sign in with Single Sign-on
|
|
43
|
+
# and will authenticate the user if email domain has been whitelisted.
|
|
44
|
+
def omniauthentication(env)
|
|
45
|
+
# Extract the email domain from the omniauth hash.
|
|
46
|
+
if env['omniauth.auth']['info']['email']
|
|
47
|
+
user_email = env['omniauth.auth']['info']['email']
|
|
48
|
+
email_domain = user_email.split("@").last
|
|
49
|
+
end
|
|
50
|
+
|
|
51
|
+
# If there is no email domain, redirect the user before authentication.
|
|
52
|
+
unless email_domain
|
|
53
|
+
return [302, {"Location" => referer}, [""]]
|
|
54
|
+
end
|
|
55
|
+
|
|
56
|
+
# If there is no domain_whitelist, alert the developer.
|
|
57
|
+
unless domain_whitelist
|
|
58
|
+
warn <<~EOF
|
|
59
|
+
|
|
60
|
+
!! Balrog has not been configured with a domain_whitelist. You shall not
|
|
61
|
+
!! pass! When setting up Balrog::Middleware, pass in a block and
|
|
62
|
+
!! call `set_domain_whitelist` passing in an omniauth provider and
|
|
63
|
+
!! required keys.
|
|
64
|
+
!!
|
|
65
|
+
!! Check out https://github.com/pixielabs/balrog for more information.
|
|
66
|
+
|
|
67
|
+
EOF
|
|
68
|
+
return [302, {"Location" => referer}, [""]]
|
|
69
|
+
end
|
|
70
|
+
|
|
71
|
+
# Authenticate the user if the user's email domain is whitelisted.
|
|
72
|
+
if domain_whitelist.include?(email_domain)
|
|
73
|
+
authenticate_user(env)
|
|
74
|
+
end
|
|
75
|
+
|
|
76
|
+
referer = env["omniauth.origin"] || '/'
|
|
77
|
+
|
|
78
|
+
[302, {"Location" => referer}, [""]]
|
|
79
|
+
end
|
|
80
|
+
|
|
81
|
+
|
|
82
|
+
# This method is called if a user logs out using a balrog logout button.
|
|
83
|
+
# It will achieve this by removing all balrog data from the session.
|
|
84
|
+
def logout(env)
|
|
85
|
+
env['rack.session'].delete(:balrog)
|
|
86
|
+
[302, {"Location" => '/'}, [""]]
|
|
87
|
+
end
|
|
88
|
+
|
|
89
|
+
private
|
|
90
|
+
|
|
91
|
+
# This method marks the user as 'authenicated'.
|
|
92
|
+
def authenticate_user(env)
|
|
93
|
+
session_data = { value: 'authenticated' }
|
|
94
|
+
add_expiry_date!(session_data)
|
|
95
|
+
env['rack.session'][:balrog] = session_data
|
|
96
|
+
end
|
|
97
|
+
|
|
98
|
+
# If the user configured the Balrog session to expire, add the
|
|
99
|
+
# expiry_date to the Balrog session.
|
|
100
|
+
def add_expiry_date!(session_data)
|
|
101
|
+
if session_length
|
|
102
|
+
session_data[:expiry_date] = DateTime.current + session_length
|
|
103
|
+
end
|
|
104
|
+
end
|
|
105
|
+
end
|
|
106
|
+
end
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
require_relative 'guard'
|
|
2
|
+
|
|
3
|
+
# Public: Balrog routes middleware that redirects the user to a security
|
|
4
|
+
# gate unless the session includes { 'balrog' => 'authenticated' }.
|
|
5
|
+
#
|
|
6
|
+
# In order to protect SideKiq Web you would do something like this:
|
|
7
|
+
#
|
|
8
|
+
# require 'sidekiq/web'
|
|
9
|
+
#
|
|
10
|
+
# Sidekiq::Web.disable(:sessions)
|
|
11
|
+
# Sidekiq::Web.use Balrog::RoutesMiddleware
|
|
12
|
+
#
|
|
13
|
+
# mount Sidekiq::Web => '/sidekiq'
|
|
14
|
+
|
|
15
|
+
class Balrog::RoutesMiddleware
|
|
16
|
+
include Balrog::Guard
|
|
17
|
+
|
|
18
|
+
def initialize(app)
|
|
19
|
+
@app = app
|
|
20
|
+
end
|
|
21
|
+
|
|
22
|
+
def call(env)
|
|
23
|
+
unless authenticated?(env['rack.session']['balrog'])
|
|
24
|
+
html = ApplicationController.renderer.render 'balrog/gate', layout: 'balrog'
|
|
25
|
+
return [200, {"Content-Type" => "text/html"}, [html]]
|
|
26
|
+
end
|
|
27
|
+
@app.call(env)
|
|
28
|
+
end
|
|
29
|
+
end
|
|
30
|
+
|
data/lib/balrog/version.rb
CHANGED
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
# ViewHelpers methods are made available in all views by the code in engine.rb.
|
|
2
|
+
module Balrog::ViewHelpers
|
|
3
|
+
def balrog_logout_button(options = nil, html_options = nil)
|
|
4
|
+
name = 'Logout'
|
|
5
|
+
html_options ||= {}
|
|
6
|
+
html_options[:method] = 'delete'
|
|
7
|
+
|
|
8
|
+
if options.is_a?(String)
|
|
9
|
+
name = options
|
|
10
|
+
elsif options.is_a?(Hash)
|
|
11
|
+
html_options = html_options.merge(options)
|
|
12
|
+
end
|
|
13
|
+
|
|
14
|
+
button_to(name, '/balrog/logout', html_options)
|
|
15
|
+
end
|
|
16
|
+
|
|
17
|
+
def show_balrog_password_prompt?
|
|
18
|
+
!!Balrog::Middleware.password_hash || !Balrog::Middleware.omniauth_config
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
def balrog_omniauth_configured?
|
|
22
|
+
!!Balrog::Middleware.omniauth_config
|
|
23
|
+
end
|
|
24
|
+
end
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: balrog
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.1
|
|
4
|
+
version: 2.0.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Pixie Labs
|
|
8
|
-
autorequire:
|
|
8
|
+
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2020-09-11 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: bcrypt
|
|
@@ -24,6 +24,20 @@ dependencies:
|
|
|
24
24
|
- - "~>"
|
|
25
25
|
- !ruby/object:Gem::Version
|
|
26
26
|
version: '3.0'
|
|
27
|
+
- !ruby/object:Gem::Dependency
|
|
28
|
+
name: rails
|
|
29
|
+
requirement: !ruby/object:Gem::Requirement
|
|
30
|
+
requirements:
|
|
31
|
+
- - ">="
|
|
32
|
+
- !ruby/object:Gem::Version
|
|
33
|
+
version: '5'
|
|
34
|
+
type: :runtime
|
|
35
|
+
prerelease: false
|
|
36
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
37
|
+
requirements:
|
|
38
|
+
- - ">="
|
|
39
|
+
- !ruby/object:Gem::Version
|
|
40
|
+
version: '5'
|
|
27
41
|
- !ruby/object:Gem::Dependency
|
|
28
42
|
name: bundler
|
|
29
43
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -74,9 +88,11 @@ executables: []
|
|
|
74
88
|
extensions: []
|
|
75
89
|
extra_rdoc_files: []
|
|
76
90
|
files:
|
|
91
|
+
- ".circleci/config.yml"
|
|
77
92
|
- ".gitignore"
|
|
78
93
|
- ".rspec"
|
|
79
94
|
- ".travis.yml"
|
|
95
|
+
- CHANGELOG.md
|
|
80
96
|
- CODE_OF_CONDUCT.md
|
|
81
97
|
- Gemfile
|
|
82
98
|
- Gemfile.lock
|
|
@@ -86,6 +102,7 @@ files:
|
|
|
86
102
|
- app/assets/images/balrog/logo.png
|
|
87
103
|
- app/assets/stylesheets/balrog/gate.css
|
|
88
104
|
- app/views/balrog/gate.html.erb
|
|
105
|
+
- app/views/layouts/balrog.html.erb
|
|
89
106
|
- balrog.gemspec
|
|
90
107
|
- bin/console
|
|
91
108
|
- bin/setup
|
|
@@ -93,17 +110,22 @@ files:
|
|
|
93
110
|
- lib/balrog/engine.rb
|
|
94
111
|
- lib/balrog/generators.rb
|
|
95
112
|
- lib/balrog/generators/install_generator.rb
|
|
113
|
+
- lib/balrog/generators/view_generator.rb
|
|
114
|
+
- lib/balrog/guard.rb
|
|
96
115
|
- lib/balrog/helpers.rb
|
|
97
116
|
- lib/balrog/middleware.rb
|
|
117
|
+
- lib/balrog/middleware/controller.rb
|
|
98
118
|
- lib/balrog/password_hasher.rb
|
|
99
119
|
- lib/balrog/rake_tasks.rb
|
|
120
|
+
- lib/balrog/routes_middleware.rb
|
|
100
121
|
- lib/balrog/tasks/generate_hash.rake
|
|
101
122
|
- lib/balrog/version.rb
|
|
123
|
+
- lib/balrog/view_helpers.rb
|
|
102
124
|
homepage: https://github.com/pixielabs/balrog
|
|
103
125
|
licenses:
|
|
104
126
|
- MIT
|
|
105
127
|
metadata: {}
|
|
106
|
-
post_install_message:
|
|
128
|
+
post_install_message:
|
|
107
129
|
rdoc_options: []
|
|
108
130
|
require_paths:
|
|
109
131
|
- lib
|
|
@@ -118,8 +140,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
118
140
|
- !ruby/object:Gem::Version
|
|
119
141
|
version: '0'
|
|
120
142
|
requirements: []
|
|
121
|
-
rubygems_version: 3.0.
|
|
122
|
-
signing_key:
|
|
143
|
+
rubygems_version: 3.0.3
|
|
144
|
+
signing_key:
|
|
123
145
|
specification_version: 4
|
|
124
146
|
summary: An alternative to HTTP basic auth
|
|
125
147
|
test_files: []
|