casino 1.3.2 → 2.0.0

data/app/models/casino/service_rule.rb

@@ -0,0 +1,27 @@
+
+class CASino::ServiceRule < ActiveRecord::Base
+  attr_accessible :enabled, :order, :name, :url, :regex
+  validates :name, presence: true
+  validates :url, uniqueness: true, presence: true
+
+  def self.allowed?(service_url)
+    rules = self.where(enabled: true)
+    if rules.empty?
+      true
+    else
+      rules.any? { |rule| rule.allows?(service_url) }
+    end
+  end
+
+  def allows?(service_url)
+    if self.regex?
+      regex = Regexp.new self.url, true
+      if regex =~ service_url
+        return true
+      end
+    elsif self.url == service_url
+      return true
+    end
+    false
+  end
+end

data/app/models/casino/service_ticket.rb

@@ -0,0 +1,43 @@
+require 'addressable/uri'
+
+class CASino::ServiceTicket < ActiveRecord::Base
+  attr_accessible :ticket, :service, :issued_from_credentials
+  validates :ticket, uniqueness: true
+  belongs_to :ticket_granting_ticket
+  before_destroy :send_single_sing_out_notification, if: :consumed?
+  has_many :proxy_granting_tickets, as: :granter, dependent: :destroy
+
+  def self.cleanup_unconsumed
+    self.delete_all(['created_at < ? AND consumed = ?', CASino.config.service_ticket[:lifetime_unconsumed].seconds.ago, false])
+  end
+
+  def self.cleanup_consumed
+    self.destroy_all(['(ticket_granting_ticket_id IS NULL OR created_at < ?) AND consumed = ?', CASino.config.service_ticket[:lifetime_consumed].seconds.ago, true])
+  end
+
+  def self.cleanup_consumed_hard
+    self.delete_all(['created_at < ? AND consumed = ?', (CASino.config.service_ticket[:lifetime_consumed].seconds * 2).ago, true])
+  end
+
+  def service_with_ticket_url
+    service_uri = Addressable::URI.parse(self.service)
+    service_uri.query_values = (service_uri.query_values(Array) || []) << ['ticket', self.ticket]
+    service_uri.to_s
+  end
+
+  def expired?
+    lifetime = if consumed?
+      CASino.config.service_ticket[:lifetime_consumed]
+    else
+      CASino.config.service_ticket[:lifetime_unconsumed]
+    end
+    (Time.now - (self.created_at || Time.now)) > lifetime
+  end
+
+  private
+  def send_single_sing_out_notification
+    notifier = SingleSignOutNotifier.new(self)
+    notifier.notify
+    true
+  end
+end

data/app/models/casino/service_ticket/single_sign_out_notifier.rb

@@ -0,0 +1,44 @@
+require 'builder'
+require 'faraday'
+
+class CASino::ServiceTicket::SingleSignOutNotifier
+  def initialize(service_ticket)
+    @service_ticket = service_ticket
+  end
+
+  def notify
+    send_notification @service_ticket.service, build_xml
+  end
+
+  private
+  def build_xml
+    xml = Builder::XmlMarkup.new(indent: 2)
+    xml.samlp :LogoutRequest,
+      'xmlns:samlp' => 'urn:oasis:names:tc:SAML:2.0:protocol',
+      'xmlns:saml' => 'urn:oasis:names:tc:SAML:2.0:assertion',
+      ID: SecureRandom.uuid,
+      Version: '2.0',
+      IssueInstant: Time.now do |logout_request|
+      logout_request.saml :NameID, '@NOT_USED@'
+      logout_request.samlp :SessionIndex, @service_ticket.ticket
+    end
+    xml.target!
+  end
+
+  def send_notification(url, xml)
+    Rails.logger.info "Sending Single Sign Out notification for ticket '#{@service_ticket.ticket}'"
+    result = Faraday.post(url, logoutRequest: xml) do |request|
+      request.options[:timeout] = CASino.config.service_ticket[:single_sign_out_notification][:timeout]
+    end
+    if result.success?
+      Rails.logger.info "Logout notification successfully posted to #{url}."
+      true
+    else
+      Rails.logger.warn "Service #{url} responed to logout notification with code '#{result.status}'!"
+      false
+    end
+  rescue Faraday::Error::ClientError => error
+    Rails.logger.warn "Failed to send logout notification to service #{url} due to #{error}"
+    false
+  end
+end

data/app/models/casino/ticket_granting_ticket.rb

@@ -0,0 +1,57 @@
+require 'user_agent'
+
+class CASino::TicketGrantingTicket < ActiveRecord::Base
+  attr_accessible :ticket, :user_agent, :awaiting_two_factor_authentication, :long_term
+  validates :ticket, uniqueness: true
+
+  belongs_to :user
+  has_many :service_tickets, dependent: :destroy
+
+  def self.cleanup(user = nil)
+    if user.nil?
+      base = self
+    else
+      base = user.ticket_granting_tickets
+    end
+    tgts = base.where([
+      '(created_at < ? AND awaiting_two_factor_authentication = ?) OR (created_at < ? AND long_term = ?) OR created_at < ?',
+      CASino.config.two_factor_authenticator[:timeout].seconds.ago,
+      true,
+      CASino.config.ticket_granting_ticket[:lifetime].seconds.ago,
+      false,
+      CASino.config.ticket_granting_ticket[:lifetime_long_term].seconds.ago
+    ])
+    CASino::ServiceTicket.where(ticket_granting_ticket_id: tgts).destroy_all
+    tgts.destroy_all
+  end
+
+  def browser_info
+    unless self.user_agent.blank?
+      user_agent = UserAgent.parse(self.user_agent)
+      if user_agent.platform.nil?
+        "#{user_agent.browser}"
+      else
+        "#{user_agent.browser} (#{user_agent.platform})"
+      end
+    end
+  end
+
+  def same_user?(other_ticket)
+    if other_ticket.nil?
+      false
+    else
+      other_ticket.user_id == self.user_id
+    end
+  end
+
+  def expired?
+    if awaiting_two_factor_authentication?
+      lifetime = CASino.config.two_factor_authenticator[:timeout]
+    elsif long_term?
+      lifetime = CASino.config.ticket_granting_ticket[:lifetime_long_term]
+    else
+      lifetime = CASino.config.ticket_granting_ticket[:lifetime]
+    end
+    (Time.now - (self.created_at || Time.now)) > lifetime
+  end
+end

data/app/models/casino/two_factor_authenticator.rb

@@ -0,0 +1,18 @@
+
+class CASino::TwoFactorAuthenticator < ActiveRecord::Base
+  attr_accessible :secret
+
+  belongs_to :user
+
+  def self.cleanup
+    self.delete_all(['(created_at < ?) AND active = ?', self.lifetime.ago, false])
+  end
+
+  def self.lifetime
+    CASino.config.two_factor_authenticator[:lifetime_inactive].seconds
+  end
+
+  def expired?
+    !self.active? && (Time.now - (self.created_at || Time.now)) > self.class.lifetime
+  end
+end

data/app/models/casino/user.rb

@@ -0,0 +1,12 @@
+
+class CASino::User < ActiveRecord::Base
+  attr_accessible :authenticator, :username, :extra_attributes
+  serialize :extra_attributes, Hash
+
+  has_many :ticket_granting_tickets
+  has_many :two_factor_authenticators
+
+  def active_two_factor_authenticator
+    self.two_factor_authenticators.where(active: true).first
+  end
+end

data/app/models/casino/validation_result.rb

@@ -0,0 +1,5 @@
+class CASino::ValidationResult < Struct.new(:error_code, :error_message, :error_severity)
+  def success?
+    self.error_code.nil?
+  end
+end

data/app/processors/casino/api/login_credential_acceptor_processor.rb

@@ -0,0 +1,46 @@
+# This processor should be used for API calls: POST /cas/v1/tickets
+class CASino::API::LoginCredentialAcceptorProcessor < CASino::Processor
+  include CASino::ProcessorConcern::ServiceTickets
+  include CASino::ProcessorConcern::Authentication
+  include CASino::ProcessorConcern::TicketGrantingTickets
+
+  # Use this method to process the request. It expects the username in the parameter "username" and the password
+  # in "password".
+  #
+  # The method will call one of the following methods on the listener:
+  # * `#user_logged_in_via_api`: First and only argument is a String with the TGT-id
+  # * `#invalid_login_credentials_via_api`: No argument
+  #
+  # @param [Hash] login_data parameters supplied by user (username and password)
+  def process(login_data, user_agent = nil)
+    @login_data = login_data
+    @user_agent = user_agent
+
+    validate_login_data
+
+    unless @authentication_result.nil?
+      generate_ticket_granting_ticket
+      callback_user_logged_in
+    else
+      callback_invalid_login_credentials
+    end
+  end
+
+  private
+  def validate_login_data
+    @authentication_result = validate_login_credentials(@login_data[:username], @login_data[:password])
+  end
+
+  def callback_user_logged_in
+    @listener.user_logged_in_via_api @ticket_granting_ticket.ticket
+  end
+
+  def generate_ticket_granting_ticket
+    @ticket_granting_ticket = acquire_ticket_granting_ticket(@authentication_result, @user_agent)
+  end
+
+  def callback_invalid_login_credentials
+    @listener.invalid_login_credentials_via_api
+  end
+
+end

data/app/processors/casino/api/logout_processor.rb

@@ -0,0 +1,17 @@
+# The Logout processor should be used to process API DELETE requests to /cas/v1/tickets/<ticket_granting_ticket>
+class CASino::API::LogoutProcessor < CASino::Processor
+  include CASino::ProcessorConcern::TicketGrantingTickets
+
+  # This method will call `#user_logged_out_via_api` on the listener.
+  #
+  # @param [String] ticket_granting_ticket Ticket-granting ticket to logout
+  def process(ticket_granting_ticket, user_agent = nil)
+    remove_ticket_granting_ticket(ticket_granting_ticket, user_agent)
+    callback_user_logged_out
+  end
+
+  def callback_user_logged_out
+    @listener.user_logged_out_via_api
+  end
+
+end

data/app/processors/casino/api/service_ticket_provider_processor.rb

@@ -0,0 +1,69 @@
+# The ServiceTicketProvider processor should be used to handle API calls: POST requests to /cas/v1/tickets/<ticket_granting_ticket>
+class CASino::API::ServiceTicketProviderProcessor < CASino::Processor
+  include CASino::ProcessorConcern::ServiceTickets
+  include CASino::ProcessorConcern::TicketGrantingTickets
+
+  # Use this method to process the request.
+  #
+  # The method will call one of the following methods on the listener:
+  # * `#granted_service_ticket_via_api`: First and only argument is a String with the service ticket.
+  #   The service ticket (and nothing else) should be displayed.
+  # * `#invalid_ticket_granting_ticket_via_api`: No argument. The application should respond with status "400 Bad Request"
+  # * `#no_service_provided_via_api`: No argument. The application should respond with status "400 Bad Request"
+  # * `#service_not_allowed_via_api`: The user tried to access a service that this CAS server is not allowed to serve.
+  #
+  # @param [String] ticket_granting_ticket ticket_granting_ticket supplied by the user in the URL
+  # @param [Hash] parameters parameters supplied by user (`service` in particular)
+  # @param [String] user_agent user-agent delivered by the client
+  def process(ticket_granting_ticket, parameters = nil, user_agent = nil)
+    parameters ||= {}
+    @client_ticket_granting_ticket = ticket_granting_ticket
+    @service_url = parameters[:service]
+    @user_agent = user_agent
+
+    fetch_valid_ticket_granting_ticket
+    handle_ticket_granting_ticket
+  end
+
+  private
+  def fetch_valid_ticket_granting_ticket
+    @ticket_granting_ticket = find_valid_ticket_granting_ticket(@client_ticket_granting_ticket, @user_agent)
+  end
+
+  def handle_ticket_granting_ticket
+    case
+    when (@service_url and @ticket_granting_ticket)
+      begin
+        create_service_ticket
+        callback_granted_service_ticket
+      rescue ServiceNotAllowedError
+        callback_service_not_allowed
+      end
+    when (@service_url and not @ticket_granting_ticket)
+      callback_invalid_tgt
+    when (not @service_url and @ticket_granting_ticket)
+      callback_empty_service
+    end
+  end
+
+  def create_service_ticket
+    @service_ticket = acquire_service_ticket(@ticket_granting_ticket, @service_url)
+  end
+
+  def callback_granted_service_ticket
+    @listener.granted_service_ticket_via_api @service_ticket.ticket
+  end
+
+  def callback_invalid_tgt
+    @listener.invalid_ticket_granting_ticket_via_api
+  end
+
+  def callback_empty_service
+    @listener.no_service_provided_via_api
+  end
+
+  def callback_service_not_allowed
+    @listener.service_not_allowed_via_api(clean_service_url @service_url)
+  end
+
+end

data/app/processors/casino/legacy_validator_processor.rb

@@ -0,0 +1,19 @@
+# The LegacyValidator processor should be used for GET requests to /validate
+class CASino::LegacyValidatorProcessor < CASino::Processor
+  include CASino::ProcessorConcern::ServiceTickets
+
+  # This method will call `#validation_succeeded` or `#validation_failed`. In both cases, it supplies
+  # a string as argument. The web application should present that string (and nothing else) to the
+  # requestor.
+  #
+  # @param [Hash] params parameters supplied by requestor (a service)
+  def process(params = nil)
+    params ||= {}
+    ticket = CASino::ServiceTicket.where(ticket: params[:ticket]).first
+    if !params[:service].nil? && ticket_valid_for_service?(ticket, params[:service], !!params[:renew])
+      @listener.validation_succeeded("yes\n#{ticket.ticket_granting_ticket.user.username}\n")
+    else
+      @listener.validation_failed("no\n\n")
+    end
+  end
+end

data/app/processors/casino/login_credential_acceptor_processor.rb

@@ -0,0 +1,63 @@
+# This processor should be used for POST requests to /login
+class CASino::LoginCredentialAcceptorProcessor < CASino::Processor
+  include CASino::ProcessorConcern::LoginTickets
+  include CASino::ProcessorConcern::ServiceTickets
+  include CASino::ProcessorConcern::Authentication
+  include CASino::ProcessorConcern::TicketGrantingTickets
+
+  # Use this method to process the request. It expects the username in the parameter "username" and the password
+  # in "password".
+  #
+  # The method will call one of the following methods on the listener:
+  # * `#user_logged_in`: The first argument (String) is the URL (if any), the user should be redirected to.
+  #   The second argument (String) is the ticket-granting ticket. It should be stored in a cookie named "tgt".
+  #   The third argument (Time, optional, default = nil) is for "Remember Me" functionality.
+  #   This is the cookies expiration date. If it is `nil`, the cookie should be a session cookie.
+  # * `#invalid_login_ticket` and `#invalid_login_credentials`: The first argument is a LoginTicket.
+  #   See {CASino::LoginCredentialRequestorProcessor} for details.
+  # * `#service_not_allowed`: The user tried to access a service that this CAS server is not allowed to serve.
+  # * `#two_factor_authentication_pending`: The user should be asked to enter his OTP. The first argument (String) is the ticket-granting ticket. The ticket-granting ticket is not active yet. Use SecondFactorAuthenticatonAcceptor to activate it.
+  #
+  # @param [Hash] params parameters supplied by user
+  # @param [String] user_agent user-agent delivered by the client
+  def process(params = nil, user_agent = nil)
+    @params = params || {}
+    @user_agent = user_agent
+    if login_ticket_valid?(@params[:lt])
+      authenticate_user
+    else
+      @listener.invalid_login_ticket(acquire_login_ticket)
+    end
+  end
+
+  private
+  def authenticate_user
+    authentication_result = validate_login_credentials(@params[:username], @params[:password])
+    if !authentication_result.nil?
+      user_logged_in(authentication_result)
+    else
+      @listener.invalid_login_credentials(acquire_login_ticket)
+    end
+  end
+
+  def user_logged_in(authentication_result)
+    long_term = @params[:rememberMe]
+    ticket_granting_ticket = acquire_ticket_granting_ticket(authentication_result, @user_agent, long_term)
+    if ticket_granting_ticket.awaiting_two_factor_authentication?
+      @listener.two_factor_authentication_pending(ticket_granting_ticket.ticket)
+    else
+      begin
+        url = unless @params[:service].blank?
+          acquire_service_ticket(ticket_granting_ticket, @params[:service], true).service_with_ticket_url
+        end
+        if long_term
+          @listener.user_logged_in(url, ticket_granting_ticket.ticket, CASino.config.ticket_granting_ticket[:lifetime_long_term].seconds.from_now)
+        else
+          @listener.user_logged_in(url, ticket_granting_ticket.ticket)
+        end
+      rescue ServiceNotAllowedError => e
+        @listener.service_not_allowed(clean_service_url @params[:service])
+      end
+    end
+  end
+end

data/app/processors/casino/login_credential_requestor_processor.rb

@@ -0,0 +1,66 @@
+# This processor should be used for GET requests to /login
+class CASino::LoginCredentialRequestorProcessor < CASino::Processor
+  include CASino::ProcessorConcern::Browser
+  include CASino::ProcessorConcern::LoginTickets
+  include CASino::ProcessorConcern::ServiceTickets
+  include CASino::ProcessorConcern::TicketGrantingTickets
+
+  # Use this method to process the request.
+  #
+  # The method will call one of the following methods on the listener:
+  # * `#user_logged_in`: The first argument (String) is the URL (if any), the user should be redirected to.
+  # * `#user_not_logged_in`: The first argument is a LoginTicket. It should be stored in a hidden field with name "lt".
+  # * `#service_not_allowed`: The user tried to access a service that this CAS server is not allowed to serve.
+  #
+  # @param [Hash] params parameters supplied by user
+  # @param [Hash] cookies cookies supplied by user
+  # @param [String] user_agent user-agent delivered by the client
+  def process(params = nil, cookies = nil, user_agent = nil)
+    @params = params || {}
+    @cookies = cookies || {}
+    @user_agent = user_agent || {}
+    if check_service_allowed
+      handle_allowed_service
+    end
+  end
+
+  private
+  def handle_allowed_service
+    if !@params[:renew] && (@ticket_granting_ticket = find_valid_ticket_granting_ticket(@cookies[:tgt], @user_agent))
+      handle_logged_in
+    else
+      handle_not_logged_in
+    end
+  end
+
+  def handle_logged_in
+    service_url_with_ticket = unless @params[:service].nil?
+      acquire_service_ticket(@ticket_granting_ticket, @params[:service], true).service_with_ticket_url
+    end
+    @listener.user_logged_in(service_url_with_ticket)
+  end
+
+  def handle_not_logged_in
+    if gateway_request?
+      # we actually lie to the listener to simplify things
+      @listener.user_logged_in(@params[:service])
+    else
+      login_ticket = acquire_login_ticket
+      @listener.user_not_logged_in(login_ticket)
+    end
+  end
+
+  def check_service_allowed
+    service_url = clean_service_url(@params[:service]) unless @params[:service].nil?
+    if service_url.nil? || CASino::ServiceRule.allowed?(service_url)
+      true
+    else
+      @listener.service_not_allowed(service_url)
+      false
+    end
+  end
+
+  def gateway_request?
+    @params[:gateway] == 'true' && @params[:service]
+  end
+end