barkest_core 1.5.3.0

data/app/models/barkest_core/user_alert.rb

@@ -0,0 +1,29 @@
+module BarkestCore
+  ##
+  # This model provides informational alerts to the user.
+  class UserAlert
+    include ActiveModel::Model
+    include ActiveModel::Validations
+
+    attr_accessor :message, :model
+
+    validates :message, presence: true
+
+    def type
+      @type || :info
+    end
+
+    def type=(value)
+      @type = value ? value.to_s.to_sym : nil
+    end
+
+    def view
+      @view || 'generic_user_alert'
+    end
+
+    def view=(value)
+      @view = value.blank? ? nil : value.to_s
+    end
+
+  end
+end

data/app/models/barkest_core/user_alert_generators.rb

@@ -0,0 +1,58 @@
+module BarkestCore
+  ##
+  # A repository for user alert generators.
+  #
+  # Register any alert generators that you want to give the user automatically at login.
+  #
+  class UserAlertGenerators
+
+    ##
+    # Enumerates all of the generators that have been registered.
+    #
+    # Yields the +type+ and +generator+.
+    def self.each(&block)
+      return unless block_given?
+      list.each do |type,generators|
+        generators.each do |generator|
+          yield type, generator
+        end
+      end
+    end
+
+    ##
+    # Gets all of the generators that have been registered.
+    #
+    # This list does not include the type.
+    def self.all
+      list.values.flatten.freeze
+    end
+
+    ##
+    # Gets a subset of the generators that have been registered.
+    #
+    # Provide the type of generators you would like to return.
+    def self.[](type)
+      type ||= :info
+      type = type.to_sym
+      (list[type] || []).freeze
+    end
+
+    ##
+    # Registers an alert generator.
+    #
+    # The generator shold be designed to take a User model as an argument.
+    def self.register(type = nil, &block)
+      type ||= :info
+      type = type.to_sym
+      list[type] ||= []
+      list[type] << block
+    end
+
+    private
+
+    def self.list
+      @list ||= {}
+    end
+
+  end
+end

data/app/models/barkest_core/user_manager.rb

@@ -0,0 +1,404 @@
+require 'net-ldap'
+
+module BarkestCore
+  ##
+  # Handles login requests, group mapping, and password changing for both the DB and LDAP sources.
+  #
+  class UserManager
+
+    ##
+    # Creates a new user manager.
+    def initialize(options = {})
+      @options = (options || {}).symbolize_keys
+      if @options[:enable_ldap_auth]
+        @ldap = get_ldap_connection
+        raise ArgumentError.new('Failed to connect to LDAP host using supplied arguments.') unless @ldap.bind
+      end
+      @options[:enable_db_auth] = true unless @options[:enable_ldap_auth]
+      User.ensure_admin_exists!
+    end
+
+    ##
+    # Is this user manager using ldap?
+    def using_ldap?
+      @options[:enable_ldap_auth]
+    end
+
+    ##
+    # Is the user manager using ldap?
+    def self.using_ldap?
+      default.using_ldap?
+    end
+
+    ##
+    # Is this user manager using the db?
+    def using_db?
+      @options[:enable_db_auth]
+    end
+
+    ##
+    # Is the user manager using the db?
+    def self.using_db?
+      default.using_db?
+    end
+
+    ##
+    # Gets the first authentication source for this user manager.
+    def primary_source
+      return :ldap if using_ldap? && !using_db?
+      return :db if using_db? && !using_ldap?
+
+      source = @options[:primary_source]
+      source = source.to_sym if source.is_a?(String)
+
+      return source if [:ldap, :db].include?(source)
+
+      return :ldap if using_ldap?
+
+      :db
+    end
+
+    ##
+    # Gets the first authentication source for the user manager.
+    def self.primary_source
+      default.primary_source
+    end
+
+    ##
+    # Attempts to authenticate the user and returns the model on success.
+    def authenticate(email, password, client_ip)
+      return nil unless email && BarkestCore::EmailTester.valid_email?(email, false)
+
+      email = email.downcase
+
+      sources.each do |source|
+        if source == :ldap
+          entry = @ldap.search(filter: "(&(objectClass=user)(mail=#{email}))")
+          if entry && entry.count == 1  # we found a match.
+            user = User.find_by(email: email, ldap: true)
+
+            # make sure it authenticates correctly.
+            entry = @ldap.bind_as(filter: "(&(objectClass=user)(mail=#{email}))", password: password)
+
+            # do not allow authenticating against the DB now.
+            unless entry && entry.count == 1
+              add_failure_to user || email, '(LDAP) failed to authenticate', client_ip
+              return nil
+            end
+
+            # load the user and return.
+            user = load_ldap_user(entry.first, true, client_ip)
+            unless user.enabled?
+              add_failure_to user, '(LDAP) account disabled', client_ip
+              return nil
+            end
+            add_success_to user, '(LDAP)', client_ip
+            return user
+          end
+        else
+          user = User.find_by(email: email)
+          if user
+            # user must be enabled, cannot be LDAP, and the password must match.
+            if user.ldap?
+              add_failure_to user, '(DB) cannot authenticate LDAP user', client_ip
+              return nil
+            end
+            unless user.enabled?
+              add_failure_to user, '(DB) account disabled', client_ip
+              return nil
+            end
+            if user.authenticate(password)
+              add_success_to user, '(DB)', client_ip
+              return user
+            else
+              add_failure_to user, '(DB) invalid password', client_ip
+              return nil
+            end
+          end
+        end
+      end
+      add_failure_to email, 'invalid email', client_ip
+      nil
+    end
+
+    ##
+    # Attempts to authenticate the user and returns the model on success.
+    def self.authenticate(email, password, client_ip)
+      default.authenticate email, password, client_ip
+    end
+
+    ##
+    # Should valid ldap users be auto-activated on first login?
+    def auto_activate_ldap?
+      @options[:ldap_auto_activate]
+    end
+
+    ##
+    # Should valid ldap users be auto-activated on first login?
+    def self.auto_activate_ldap?
+      default.auto_activate_ldap?
+    end
+
+    ##
+    # Gets the list of ldap groups that map to system administrators.
+    def ldap_system_admin_groups
+      @ldap_system_admin_groups ||=
+          begin
+            val = @options[:ldap_system_admin_groups]
+            val.blank? ? [] : val.strip.gsub(',', ';').split(';').map{|v| v.strip.upcase}
+          end
+    end
+
+    ##
+    # Gets the list of ldap groups that map to system administrators.
+    def self.ldap_system_admin_groups
+      default.ldap_system_admin_groups
+    end
+
+    private
+
+    def purge_old_history_for(user, max_months = 2)
+      user.login_histories.where('"user_login_histories"."created_at" <= ?', Time.zone.now - max_months.months).delete_all
+    end
+
+    def add_failure_to(user, message, client_ip)
+      Rails.logger.info "LOGIN(#{user}) FAILURE FROM #{client_ip}: #{message}"
+      history_length = 2
+      unless user.is_a?(User)
+        message = "[email: #{user}] #{message}"
+        user = User.anonymous
+        history_length = 6
+      end
+      purge_old_history_for user, history_length
+      user.login_histories.create(ip_address: client_ip, successful: false, message: message)
+    end
+
+    def add_success_to(user, message, client_ip)
+      Rails.logger.debug "LOGIN(#{user}) SUCCESS FROM #{client_ip}: #{message}"
+      purge_old_history_for user
+      user.login_histories.create(ip_address: client_ip, successful: true, message: message)
+    end
+
+    def sources
+      @sources ||=
+          if using_ldap? && using_db?
+            if primary_source == :db
+              [ :db, :ldap ]
+            else
+              [ :ldap, :db ]
+            end
+          elsif using_ldap?
+            [ :ldap ]
+          else
+            [ :db ]
+          end
+    end
+
+    def self.default
+      @default ||= UserManager.new(BarkestCore.auth_config)
+    end
+
+    # Decode a binary SID into the common string form.
+    # Used on AD servers to locate the primary group membership.
+    # See http://blogs.msdn.com/b/oldnewthing/archive/2004/03/15/89753.aspx
+    def self.decode_sid(binary_sid)
+
+      # only support SID revision 1
+      return false unless binary_sid && binary_sid[0].ord == 1
+
+      ret = 'S-1-'
+
+      dashes_remaining = binary_sid[1].ord
+
+      # remove first 2 bytes and continue.
+      binary_sid = binary_sid[2..-1]
+
+      # first group is 48-bit big-endian.
+      i = 0
+      binary_sid[0..5].chars.each do |b|
+        i = (i * 256) + b.ord
+      end
+
+      ret <<= i.to_s
+
+      # remaining groups are 32-bit little-endian.
+      binary_sid = binary_sid[6..-1]
+      while dashes_remaining > 0
+        i = 0
+        binary_sid[0..3].reverse.chars.each do |b|
+          i = (i * 256) + b.ord
+        end
+        ret <<= "-#{i}"
+        dashes_remaining -= 1
+        binary_sid = binary_sid[4..-1]
+      end
+
+      ret
+    end
+
+
+    def get_ldap_connection
+      ldap = Net::LDAP.new(host: @options[:ldap_host], port: @options[:ldap_port], base: @options[:ldap_base_dn])
+      ssl = @options[:ldap_ssl]
+      ssl = ssl.to_s.downcase
+      ssl = true if ssl == 'true'
+      ssl = false if ssl == 'false' || ssl == '' || ssl == 'nil'
+      ssl = ssl.to_sym if ssl.is_a?(String)
+
+      if ssl
+        if ssl == :simple_tls
+          ldap.encryption method: :simple_tls
+        elsif ssl == :start_tls
+          ldap.encryption method: :start_tls
+        else
+          if @options[:ldap_port] == 389
+            ldap.encryption method: :start_tls
+          else
+            ldap.encryption method: :simple_tls
+          end
+        end
+      end
+
+      if @options[:ldap_browse_user]
+        ldap.authenticate @options[:ldap_browse_user], @options[:ldap_browse_password]
+      end
+
+      ldap
+    end
+
+    def attrib_val(entry, attr)
+      return nil unless entry.attribute_names.include?(attr)
+      val = entry[attr]
+      val = val.first if val && val.respond_to?(:first)
+      val
+    end
+
+    def first_attrib_val(entry, *attr)
+      attr.each do |a|
+        v = attrib_val(entry, a)
+        return v if v
+      end
+      nil
+    end
+
+    def group_to_groups(group_entry, existing_groups)
+      return [] unless group_entry
+
+      ret = []
+
+      # get the group name.
+
+      name = first_attrib_val(group_entry, :samaccountname, :name, :cn)
+
+      return [] unless name
+
+      name.upcase!
+
+      # do not duplicate entries.  this will also prevent the possibility of infinite recursion.
+      unless existing_groups.index { |x| x == name } || ret.index { |x| x == name }
+
+        # add this group.
+        ret <<= name
+
+        # if the group belongs to parent groups, add them as well.
+        if group_entry[:memberof] && group_entry[:memberof].respond_to?('each')
+          group_entry[:memberof].each do |dn|
+            parent_entry = @ldap.search(base: dn).first
+            ret += group_to_groups(parent_entry, ret + existing_groups)
+          end
+        end
+      end
+
+      ret
+    end
+
+    def load_ldap_user(entry, update_permissions = false, client_ip = '0.0.0.0')
+
+      # email is our unique identifier
+      email = attrib_val(entry, :mail)
+      return nil unless email
+      email.downcase!
+
+      # grab the SID and find the user.
+      ret = User.find_by(email: email)
+      pwd = SecureRandom.urlsafe_base64(53) # should generate a 71 character string.
+                                            # max supported by has_secure_password is 72 characters.
+
+      if ret
+        # set ldap flag and change to random password.
+        ret.ldap = true
+        ret.password = ret.password_confirmation = pwd
+      else
+        # create new user with random password.
+        ret = User.create!(
+            name:                   email,
+            email:                  email,
+            password:               pwd,
+            password_confirmation:  pwd,
+            enabled:                true
+        )
+
+        if auto_activate_ldap?
+          ret.activate
+        else
+          ret.send_activation_email(client_ip)
+        end
+      end
+
+      # update the user attributes in the database.
+      ret.name = first_attrib_val(entry, :displayname, :givenname, :name, :cn)
+      ret.ldap = true
+      ret.save!
+
+      if update_permissions
+        # now we need the user group memberships from ldap
+        # once we get those, we can translate them over.
+        groups = []
+        entry[:memberof].each do |dn|
+          # load the group and get the group name (always in uppercase)
+          group_entry = @ldap.search(base: dn).first
+          groups += group_to_groups(group_entry, groups)
+        end
+
+        # there may be one missing group still, the default group is not included in the 'memberOf' attribute.
+        if (group_rid = attrib_val(entry, :primarygroupid))
+          # the primary group id is the relative ID within the domain SID for the group.
+          # so we'll get the domain SID from the user SID and append the group RID.
+          user_sid = UserManager.decode_sid(attrib_val(entry, :objectsid))
+          if user_sid
+            domain_sid = user_sid.rpartition('-')[0]
+            group_sid = "#{domain_sid}-#{group_rid}"
+
+            # the search takes the SID in string form, not in binary form (like in other places).
+            group_entry = @ldap.search(filter: "(&(objectClass=group)(objectSID=#{group_sid}))")
+
+            # did we locate the group?
+            if group_entry && group_entry.count == 1
+              groups += group_to_groups(group_entry.first, groups)
+            else
+              Rails.logger.warn "WARNING: Failed to locate group with SID=#{group_sid}"
+            end
+          end
+        end
+
+        # so now 'groups' contains a list of every ldap group the user belongs to.
+        ret.system_admin = false
+        ldap_system_admin_groups.each do |group|
+          ret.system_admin = true if groups.include?(group)
+        end
+
+        access_groups = []
+        groups.each do |group|
+          access_group = AccessGroup.find_by(name: group)
+          access_groups << access_group.group if access_group && !access_groups.include?(access_group.group)
+        end
+
+        ret.groups = access_groups
+        ret.save!
+      end
+
+      ret
+    end
+
+  end
+end