casino 1.3.2 → 2.0.0

data/app/processors/casino/logout_processor.rb

@@ -0,0 +1,23 @@
+# The Logout processor should be used to process GET requests to /logout.
+class CASino::LogoutProcessor < CASino::Processor
+  include CASino::ProcessorConcern::TicketGrantingTickets
+
+  # This method will call `#user_logged_out` and may supply an URL that should be presented to the user.
+  # As per specification, the URL specified by "url" SHOULD be on the logout page with descriptive text.
+  # For example, "The application you just logged out of has provided a link it would like you to follow.
+  # Please click here to access http://www.go-back.edu/."
+  #
+  # @param [Hash] params parameters supplied by user
+  # @param [Hash] cookies cookies supplied by user
+  # @param [String] user_agent user-agent delivered by the client
+  def process(params = nil, cookies = nil, user_agent = nil)
+    params ||= {}
+    cookies ||= {}
+    remove_ticket_granting_ticket(cookies[:tgt], user_agent)
+    if params[:service] && CASino::ServiceRule.allowed?(params[:service])
+      @listener.user_logged_out(params[:service], true)
+    else
+      @listener.user_logged_out(params[:url])
+    end
+  end
+end

data/app/processors/casino/other_sessions_destroyer_processor.rb

@@ -0,0 +1,26 @@
+# The OtherSessionsDestroyer processor should be used to process GET requests to /destroy-other-sessions.
+#
+# It is usefule to redirect users to this action after a password change.
+#
+# This feature is not described in the CAS specification so it's completly optional
+# to implement this on the web application side.
+class CASino::OtherSessionsDestroyerProcessor < CASino::Processor
+  include CASino::ProcessorConcern::TicketGrantingTickets
+
+  # This method will call `#other_sessions_destroyed` and may supply an URL that should be presented to the user.
+  # The user should be redirected to this URL immediately.
+  #
+  # @param [Hash] params parameters supplied by user
+  # @param [Hash] cookies cookies supplied by user
+  # @param [String] user_agent user-agent delivered by the client
+  def process(params = nil, cookies = nil, user_agent = nil)
+    params ||= {}
+    cookies ||= {}
+    tgt = find_valid_ticket_granting_ticket(cookies[:tgt], user_agent)
+    unless tgt.nil?
+      other_ticket_granting_tickets = tgt.user.ticket_granting_tickets.where('id != ?', tgt.id)
+      other_ticket_granting_tickets.destroy_all
+    end
+    @listener.other_sessions_destroyed(params[:service])
+  end
+end

data/app/processors/casino/processor.rb

@@ -0,0 +1,5 @@
+class CASino::Processor
+  def initialize(listener)
+    @listener = listener
+  end
+end

data/app/processors/casino/processor_concern/authentication.rb

@@ -0,0 +1,87 @@
+module CASino
+  module ProcessorConcern
+    module Authentication
+
+      def validate_login_credentials(username, password)
+        authentication_result = nil
+        authenticators.each do |authenticator_name, authenticator|
+          begin
+            data = authenticator.validate(username, password)
+          rescue CASino::Authenticator::AuthenticatorError => e
+            Rails.logger.error "Authenticator '#{authenticator_name}' (#{authenticator.class}) raised an error: #{e}"
+          end
+          if data
+            authentication_result = { authenticator: authenticator_name, user_data: data }
+            Rails.logger.info("Credentials for username '#{data[:username]}' successfully validated using authenticator '#{authenticator_name}' (#{authenticator.class})")
+            break
+          end
+        end
+        authentication_result
+      end
+
+      def authenticators
+        @authenticators ||= begin
+          CASino.config.authenticators.each do |name, auth|
+            next unless auth.is_a?(Hash)
+
+            authenticator = if auth[:class]
+              auth[:class].constantize
+            else
+              load_authenticator(auth[:authenticator])
+            end
+
+            CASino.config.authenticators[name] = authenticator.new(auth[:options])
+          end
+        end
+      end
+
+      private
+      def load_legacy_authenticator(name)
+        gemname, classname = parse_legacy_name(name)
+
+        begin
+          require gemname
+          CASinoCore::Authenticator.const_get("#{classname}")
+        rescue LoadError, NameError
+          false
+        end
+      end
+
+      def load_authenticator(name)
+        legacy_authenticator = load_legacy_authenticator(name)
+        return legacy_authenticator if legacy_authenticator
+
+        gemname, classname = parse_name(name)
+
+        begin
+          require gemname
+          CASino.const_get(classname)
+        rescue LoadError => error
+          raise LoadError, load_error_message(name, gemname, error)
+        rescue NameError => error
+          raise NameError, name_error_message(name, error)
+        end
+      end
+
+      def parse_name(name)
+        [ "casino-#{name.underscore}_authenticator", "#{name.camelize}Authenticator" ]
+      end
+
+      def parse_legacy_name(name)
+        [ "casino_core-authenticator-#{name.underscore}", name.camelize ]
+      end
+
+      def load_error_message(name, gemname, error)
+        "Failed to load authenticator '#{name}'. Maybe you have to include " \
+        "\"gem '#{gemname}'\" in your Gemfile?\n" \
+        "  Error: #{error.message}\n"
+      end
+
+      def name_error_message(name, error)
+        "Failed to load authenticator '#{name}'. The authenticator class must " \
+        "be defined in the CASino namespace.\n" \
+        "  Error: #{error.message}\n"
+      end
+    end
+  end
+end

data/app/processors/casino/processor_concern/browser.rb

@@ -0,0 +1,14 @@
+module CASino
+  module ProcessorConcern
+    module Browser
+      def browser_info(user_agent)
+        user_agent = UserAgent.parse(user_agent)
+        "#{user_agent.browser} (#{user_agent.platform})"
+      end
+
+      def same_browser?(user_agent, other_user_agent)
+        user_agent == other_user_agent || browser_info(user_agent) == browser_info(other_user_agent)
+      end
+    end
+  end
+end

data/app/processors/casino/processor_concern/login_tickets.rb

@@ -0,0 +1,28 @@
+module CASino
+  module ProcessorConcern
+    module LoginTickets
+      include CASino::ProcessorConcern::Tickets
+
+      def acquire_login_ticket
+        ticket = CASino::LoginTicket.create ticket: random_ticket_string('LT')
+        Rails.logger.debug "Created login ticket '#{ticket.ticket}'"
+        ticket
+      end
+
+      def login_ticket_valid?(lt)
+        ticket = CASino::LoginTicket.find_by_ticket lt
+        if ticket.nil?
+          Rails.logger.info "Login ticket '#{lt}' not found"
+          false
+        elsif ticket.created_at < CASino.config.login_ticket[:lifetime].seconds.ago
+          Rails.logger.info "Login ticket '#{ticket.ticket}' expired"
+          false
+        else
+          Rails.logger.debug "Login ticket '#{ticket.ticket}' successfully validated"
+          ticket.delete
+          true
+        end
+      end
+    end
+  end
+end

data/app/processors/casino/processor_concern/proxy_granting_tickets.rb

@@ -0,0 +1,43 @@
+require 'addressable/uri'
+require 'faraday'
+
+module CASino
+  module ProcessorConcern
+    module ProxyGrantingTickets
+      include CASino::ProcessorConcern::Tickets
+
+      def acquire_proxy_granting_ticket(pgt_url, service_ticket)
+        callback_uri = Addressable::URI.parse(pgt_url)
+        if callback_uri.scheme != 'https'
+          Rails.logger.warn "Proxy tickets can only be granted to callback servers using HTTPS."
+          nil
+        else
+          contact_callback_server(callback_uri, service_ticket)
+        end
+      end
+
+      private
+      def contact_callback_server(callback_uri, service_ticket)
+        pgt = service_ticket.proxy_granting_tickets.new({
+          ticket: random_ticket_string('PGT'),
+          iou: random_ticket_string('PGTIOU'),
+          pgt_url: "#{callback_uri}"
+        })
+        callback_uri.query_values = (callback_uri.query_values || {}).merge(pgtId: pgt.ticket, pgtIou: pgt.iou)
+        response = Faraday.get "#{callback_uri}"
+        # TODO: does this follow redirects? CAS specification says that redirects MAY be followed (2.5.4)
+        if response.success?
+          pgt.save!
+          Rails.logger.debug "Proxy-granting ticket generated for service '#{service_ticket.service}': #{pgt.inspect}"
+          pgt
+        else
+          Rails.logger.warn "Proxy-granting ticket callback server responded with a bad result code '#{response.status}'. PGT will not be stored."
+          nil
+        end
+      rescue Faraday::Error::ClientError => error
+        Rails.logger.warn "Exception while communicating with proxy-granting ticket callback server: #{error.message}"
+        nil
+      end
+    end
+  end
+end

data/app/processors/casino/processor_concern/proxy_tickets.rb

@@ -0,0 +1,56 @@
+module CASino
+  module ProcessorConcern
+    module ProxyTickets
+
+      include CASino::ProcessorConcern::Tickets
+
+      class ValidationResult < CASino::ValidationResult; end
+
+      def acquire_proxy_ticket(proxy_granting_ticket, service)
+        proxy_granting_ticket.proxy_tickets.create!({
+          ticket: random_ticket_string('PT'),
+          service: service,
+        })
+      end
+
+      def validate_ticket_for_service(ticket, service, renew = false)
+        if ticket.nil?
+          result = ValidationResult.new 'INVALID_TICKET', 'Invalid validate request: Ticket does not exist', :warn
+        else
+          result = validate_existing_ticket_for_service(ticket, service, renew)
+          ticket.consumed = true
+          ticket.save!
+          Rails.logger.debug "Consumed ticket '#{ticket.ticket}'"
+        end
+        if result.success?
+          Rails.logger.info "Ticket '#{ticket.ticket}' for service '#{service}' successfully validated"
+        else
+          Rails.logger.send(result.error_severity, result.error_message)
+        end
+        result
+      end
+
+      def ticket_valid_for_service?(ticket, service, renew = false)
+        validate_ticket_for_service(ticket, service, renew).success?
+      end
+
+      private
+      def validate_existing_ticket_for_service(ticket, service, renew = false)
+        if ticket.is_a?(CASino::ServiceTicket)
+          service = clean_service_url(service)
+        end
+        if ticket.consumed?
+          ValidationResult.new 'INVALID_TICKET', "Ticket '#{ticket.ticket}' already consumed", :warn
+        elsif ticket.expired?
+          ValidationResult.new 'INVALID_TICKET', "Ticket '#{ticket.ticket}' has expired", :warn
+        elsif service != ticket.service
+          ValidationResult.new 'INVALID_SERVICE', "Ticket '#{ticket.ticket}' is not valid for service '#{service}'", :warn
+        elsif renew && !ticket.issued_from_credentials?
+          ValidationResult.new 'INVALID_TICKET', "Ticket '#{ticket.ticket}' was not issued from credentials but service '#{service}' will only accept a renewed ticket", :info
+        else
+          ValidationResult.new
+        end
+      end
+    end
+  end
+end

data/app/processors/casino/processor_concern/service_tickets.rb

@@ -0,0 +1,50 @@
+require 'addressable/uri'
+
+module CASino
+  module ProcessorConcern
+    module ServiceTickets
+      include CASino::ProcessorConcern::Tickets
+      include CASino::ProcessorConcern::ProxyTickets
+
+      class ServiceNotAllowedError < StandardError; end
+
+      RESERVED_CAS_PARAMETER_KEYS = ['service', 'ticket', 'gateway', 'renew']
+
+      def acquire_service_ticket(ticket_granting_ticket, service, credentials_supplied = nil)
+        service_url = clean_service_url(service)
+        unless CASino::ServiceRule.allowed?(service_url)
+          message = "#{service_url} is not in the list of allowed URLs"
+          Rails.logger.error message
+          raise ServiceNotAllowedError, message
+        end
+        service_tickets = ticket_granting_ticket.service_tickets
+        service_tickets.where(service: service_url).destroy_all
+        service_tickets.create!({
+          ticket: random_ticket_string('ST'),
+          service: service_url,
+          issued_from_credentials: !!credentials_supplied
+        })
+      end
+
+      def clean_service_url(dirty_service)
+        return dirty_service if dirty_service.blank?
+        service_uri = Addressable::URI.parse dirty_service
+        unless service_uri.query_values.nil?
+          service_uri.query_values = service_uri.query_values(Array).select { |k,v| !RESERVED_CAS_PARAMETER_KEYS.include?(k) }
+        end
+        if service_uri.query_values.blank?
+          service_uri.query_values = nil
+        end
+
+        service_uri.path = (service_uri.path || '').gsub(/\/+\z/, '')
+        service_uri.path = '/' if service_uri.path.blank?
+
+        clean_service = service_uri.to_s
+
+        Rails.logger.debug("Cleaned dirty service URL '#{dirty_service}' to '#{clean_service}'") if dirty_service != clean_service
+
+        clean_service
+      end
+    end
+  end
+end

data/app/processors/casino/processor_concern/ticket_granting_tickets.rb

@@ -0,0 +1,65 @@
+require 'addressable/uri'
+
+module CASino
+  module ProcessorConcern
+    module TicketGrantingTickets
+
+      include CASino::ProcessorConcern::Browser
+
+      def find_valid_ticket_granting_ticket(tgt, user_agent, ignore_two_factor = false)
+        ticket_granting_ticket = CASino::TicketGrantingTicket.where(ticket: tgt).first
+        unless ticket_granting_ticket.nil?
+          if ticket_granting_ticket.expired?
+            Rails.logger.info "Ticket-granting ticket expired (Created: #{ticket_granting_ticket.created_at})"
+            ticket_granting_ticket.destroy
+            nil
+          elsif !ignore_two_factor && ticket_granting_ticket.awaiting_two_factor_authentication?
+            Rails.logger.info 'Ticket-granting ticket is valid, but two-factor authentication is pending'
+            nil
+          elsif same_browser?(ticket_granting_ticket.user_agent, user_agent)
+            ticket_granting_ticket.user_agent = user_agent
+            ticket_granting_ticket.touch
+            ticket_granting_ticket.save!
+            ticket_granting_ticket
+          else
+            Rails.logger.info 'User-Agent changed: ticket-granting ticket not valid for this browser'
+            nil
+          end
+        end
+      end
+
+      def acquire_ticket_granting_ticket(authentication_result, user_agent = nil, long_term = nil)
+        user_data = authentication_result[:user_data]
+        user = load_or_initialize_user(authentication_result[:authenticator], user_data[:username], user_data[:extra_attributes])
+        cleanup_expired_ticket_granting_tickets(user)
+        user.ticket_granting_tickets.create!({
+          ticket: random_ticket_string('TGC'),
+          awaiting_two_factor_authentication: !user.active_two_factor_authenticator.nil?,
+          user_agent: user_agent,
+          long_term: !!long_term
+        })
+      end
+
+      def load_or_initialize_user(authenticator, username, extra_attributes)
+        user = CASino::User.where(
+          authenticator: authenticator,
+          username: username).first_or_initialize
+        user.extra_attributes = extra_attributes
+        user.save!
+        return user
+      end
+
+      def remove_ticket_granting_ticket(ticket_granting_ticket, user_agent = nil)
+        tgt = find_valid_ticket_granting_ticket(ticket_granting_ticket, user_agent)
+        unless tgt.nil?
+          tgt.destroy
+        end
+      end
+
+      def cleanup_expired_ticket_granting_tickets(user)
+        CASino::TicketGrantingTicket.cleanup(user)
+      end
+
+    end
+  end
+end

data/app/processors/casino/processor_concern/tickets.rb

@@ -0,0 +1,17 @@
+require 'securerandom'
+
+module CASino
+  module ProcessorConcern
+    module Tickets
+
+      ALLOWED_TICKET_STRING_CHARACTERS = ('A'..'Z').to_a + ('a'..'z').to_a + ('0'..'9').to_a
+
+      def random_ticket_string(prefix, length = 40)
+        random_string = SecureRandom.random_bytes(length).each_char.map do |char|
+          ALLOWED_TICKET_STRING_CHARACTERS[(char.ord % ALLOWED_TICKET_STRING_CHARACTERS.length)]
+        end.join
+        "#{prefix}-#{'%d' % (Time.now.to_f * 10000)}-#{random_string}"
+      end
+    end
+  end
+end

data/app/processors/casino/processor_concern/two_factor_authenticators.rb

@@ -0,0 +1,22 @@
+require 'addressable/uri'
+
+module CASino
+  module ProcessorConcern
+    module TwoFactorAuthenticators
+      class ValidationResult < CASino::ValidationResult; end
+
+      def validate_one_time_password(otp, authenticator)
+        if authenticator.nil? || authenticator.expired?
+          ValidationResult.new 'INVALID_AUTHENTICATOR', 'Authenticator does not exist or expired', :warn
+        else
+          totp = ROTP::TOTP.new(authenticator.secret)
+          if totp.verify_with_drift(otp, CASino.config.two_factor_authenticator[:drift])
+            ValidationResult.new
+          else
+            ValidationResult.new 'INVALID_OTP', 'One-time password not valid', :warn
+          end
+        end
+      end
+    end
+  end
+end