casino 1.3.2 → 2.0.0

data/app/processors/casino/proxy_ticket_provider_processor.rb

@@ -0,0 +1,41 @@
+require 'builder'
+
+# The ProxyTicketProvider processor should be used to handle GET requests to /proxy
+class CASino::ProxyTicketProviderProcessor < CASino::Processor
+  include CASino::ProcessorConcern::ProxyGrantingTickets
+  include CASino::ProcessorConcern::ProxyTickets
+
+  # This method will call `#request_succeeded` or `#request_failed`. In both cases, it supplies
+  # a string as argument. The web application should present that string (and nothing else) to the
+  # requestor. The Content-Type should be set to 'text/xml; charset=utf-8'
+  #
+  # @param [Hash] params parameters delivered by the client
+  def process(params = nil)
+    if params[:pgt].nil? || params[:targetService].nil?
+      @listener.request_failed build_xml false, error_code: 'INVALID_REQUEST', error_message: '"pgt" and "targetService" parameters are both required'
+    else
+      proxy_granting_ticket = CASino::ProxyGrantingTicket.where(ticket: params[:pgt]).first
+      if proxy_granting_ticket.nil?
+        @listener.request_failed build_xml false, error_code: 'BAD_PGT', error_message: 'PGT not found'
+      else
+        proxy_ticket = acquire_proxy_ticket(proxy_granting_ticket, params[:targetService])
+        @listener.request_succeeded build_xml true, proxy_ticket: proxy_ticket
+      end
+    end
+  end
+
+  private
+  def build_xml(success, options = {})
+    xml = Builder::XmlMarkup.new(indent: 2)
+    xml.cas :serviceResponse, 'xmlns:cas' => 'http://www.yale.edu/tp/cas' do |service_response|
+      if success
+        service_response.cas :proxySuccess do |proxy_success|
+          proxy_success.cas :proxyTicket, options[:proxy_ticket].ticket
+        end
+      else
+        service_response.cas :proxyFailure, options[:error_message], code: options[:error_code]
+      end
+    end
+    xml.target!
+  end
+end

data/app/processors/casino/proxy_ticket_validator_processor.rb

@@ -0,0 +1,22 @@
+# The ProxyTicketValidator processor should be used to handle GET requests to /proxyValidate
+class CASino::ProxyTicketValidatorProcessor < CASino::ServiceTicketValidatorProcessor
+
+  # This method will call `#validation_succeeded` or `#validation_failed`. In both cases, it supplies
+  # a string as argument. The web application should present that string (and nothing else) to the
+  # requestor. The Content-Type should be set to 'text/xml; charset=utf-8'
+  #
+  # @param [Hash] params parameters delivered by the client
+  def process(params = nil)
+    params ||= {}
+    if request_valid?(params)
+      ticket = if params[:ticket].start_with?('PT-')
+        CASino::ProxyTicket.where(ticket: params[:ticket]).first
+      elsif params[:ticket].start_with?('ST-')
+        CASino::ServiceTicket.where(ticket: params[:ticket]).first
+      else
+        nil
+      end
+      validate_ticket!(ticket, params)
+    end
+  end
+end

data/app/processors/casino/second_factor_authentication_acceptor_processor.rb

@@ -0,0 +1,45 @@
+# The SecondFactorAuthenticationAcceptor processor can be used to activate a previously generated ticket-granting ticket with pending two-factor authentication.
+#
+# This feature is not described in the CAS specification so it's completly optional
+# to implement this on the web application side.
+class CASino::SecondFactorAuthenticationAcceptorProcessor < CASino::Processor
+  include CASino::ProcessorConcern::ServiceTickets
+  include CASino::ProcessorConcern::TicketGrantingTickets
+  include CASino::ProcessorConcern::TwoFactorAuthenticators
+
+  # The method will call one of the following methods on the listener:
+  # * `#user_not_logged_in`: The user should be redirected to /login.
+  # * `#user_logged_in`: The first argument (String) is the URL (if any), the user should be redirected to.
+  #   The second argument (String) is the ticket-granting ticket. It should be stored in a cookie named "tgt".
+  # * `#invalid_one_time_password`: The user should be asked for a new OTP.
+  #
+  # @param [Hash] params parameters supplied by user. The processor will look for keys :otp and :service.
+  # @param [String] user_agent user-agent delivered by the client
+  def process(params = nil, user_agent = nil)
+    cookies ||= {}
+    tgt = find_valid_ticket_granting_ticket(params[:tgt], user_agent, true)
+    if tgt.nil?
+      @listener.user_not_logged_in
+    else
+      validation_result = validate_one_time_password(params[:otp], tgt.user.active_two_factor_authenticator)
+      if validation_result.success?
+        tgt.awaiting_two_factor_authentication = false
+        tgt.save!
+        begin
+          url = unless params[:service].blank?
+            acquire_service_ticket(tgt, params[:service], true).service_with_ticket_url
+          end
+          if tgt.long_term?
+            @listener.user_logged_in(url, tgt.ticket, CASino.config.ticket_granting_ticket[:lifetime_long_term].seconds.from_now)
+          else
+            @listener.user_logged_in(url, tgt.ticket)
+          end
+        rescue ServiceNotAllowedError => e
+          @listener.service_not_allowed(clean_service_url params[:service])
+        end
+      else
+        @listener.invalid_one_time_password
+      end
+    end
+  end
+end

data/app/processors/casino/service_ticket_validator_processor.rb

@@ -0,0 +1,46 @@
+# The ServiceTicketValidator processor should be used to handle GET requests to /serviceValidate
+class CASino::ServiceTicketValidatorProcessor < CASino::Processor
+  include CASino::ProcessorConcern::ServiceTickets
+  include CASino::ProcessorConcern::ProxyGrantingTickets
+
+  # This method will call `#validation_succeeded` or `#validation_failed`. In both cases, it supplies
+  # a string as argument. The web application should present that string (and nothing else) to the
+  # requestor. The Content-Type should be set to 'text/xml; charset=utf-8'
+  #
+  # @param [Hash] params parameters delivered by the client
+  def process(params = nil)
+    params ||= {}
+    if request_valid?(params)
+      ticket = CASino::ServiceTicket.where(ticket: params[:ticket]).first
+      validate_ticket!(ticket, params)
+    end
+  end
+
+  protected
+  def build_service_response(success, options = {})
+    builder = CASino::TicketValidationResponseBuilder.new(success, options)
+    builder.build
+  end
+
+  def request_valid?(params)
+    if params[:ticket].nil? || params[:service].nil?
+      @listener.validation_failed build_service_response(false, error_code: 'INVALID_REQUEST', error_message: '"ticket" and "service" parameters are both required')
+      false
+    else
+      true
+    end
+  end
+
+  def validate_ticket!(ticket, params)
+    validation_result = validate_ticket_for_service(ticket, params[:service], !!params[:renew])
+    if validation_result.success?
+      options = { ticket: ticket }
+      unless params[:pgtUrl].nil?
+        options[:proxy_granting_ticket] = acquire_proxy_granting_ticket(params[:pgtUrl], ticket)
+      end
+      @listener.validation_succeeded(build_service_response(true, options))
+    else
+      @listener.validation_failed(build_service_response(false, error_code: validation_result.error_code, error_message: validation_result.error_message))
+    end
+  end
+end

data/app/processors/casino/session_destroyer_processor.rb

@@ -0,0 +1,25 @@
+# The SessionDestroyer processor is used to destroy a ticket-granting ticket.
+#
+# This feature is not described in the CAS specification so it's completly optional
+# to implement this on the web application side. It is especially useful in
+# combination with the {CASino::SessionOverviewProcessor} processor.
+class CASino::SessionDestroyerProcessor < CASino::Processor
+
+  # This method will call `#ticket_not_found` or `#ticket_deleted` on the listener.
+  # @param [Hash] params parameters supplied by user (ID of ticket-granting ticket to delete should by in params[:id])
+  # @param [Hash] cookies cookies supplied by user
+  # @param [String] user_agent user-agent delivered by the client
+  def process(params = nil, cookies = nil, user_agent = nil)
+    params ||= {}
+    cookies ||= {}
+    ticket = CASino::TicketGrantingTicket.where(id: params[:id]).first
+    owner_ticket = CASino::TicketGrantingTicket.where(ticket: cookies[:tgt]).first
+    if ticket.nil? || !ticket.same_user?(owner_ticket)
+      @listener.ticket_not_found
+    else
+      Rails.logger.info "Destroying ticket-granting ticket '#{ticket.ticket}'"
+      ticket.destroy
+      @listener.ticket_deleted
+    end
+  end
+end

data/app/processors/casino/session_overview_processor.rb

@@ -0,0 +1,21 @@
+# The SessionOverview processor to list all open session for the currently signed in user.
+#
+# This feature is not described in the CAS specification so it's completly optional
+# to implement this on the web application side.
+class CASino::SessionOverviewProcessor < CASino::Processor
+  include CASino::ProcessorConcern::TicketGrantingTickets
+
+  # This method will call `#user_not_logged_in` or `#ticket_granting_tickets_found(Enumerable)` on the listener.
+  # @param [Hash] cookies cookies delivered by the client
+  # @param [String] user_agent user-agent delivered by the client
+  def process(cookies = nil, user_agent = nil)
+    cookies ||= {}
+    tgt = find_valid_ticket_granting_ticket(cookies[:tgt], user_agent)
+    if tgt.nil?
+      @listener.user_not_logged_in
+    else
+      ticket_granting_tickets = tgt.user.ticket_granting_tickets.where(awaiting_two_factor_authentication: false).order('updated_at DESC')
+      @listener.ticket_granting_tickets_found(ticket_granting_tickets)
+    end
+  end
+end

data/app/processors/casino/two_factor_authenticator_activator_processor.rb

@@ -0,0 +1,41 @@
+# The TwoFactorAuthenticatorActivator processor can be used to activate a previously generated two-factor authenticator.
+#
+# This feature is not described in the CAS specification so it's completly optional
+# to implement this on the web application side.
+class CASino::TwoFactorAuthenticatorActivatorProcessor < CASino::Processor
+  include CASino::ProcessorConcern::TicketGrantingTickets
+  include CASino::ProcessorConcern::TwoFactorAuthenticators
+
+  # The method will call one of the following methods on the listener:
+  # * `#user_not_logged_in`: The user is not logged in and should be redirected to /login.
+  # * `#two_factor_authenticator_activated`: The two-factor authenticator was successfully activated.
+  # * `#invalid_two_factor_authenticator`: The two-factor authenticator is not valid.
+  # * `#invalid_one_time_password`: The user should be asked for a new OTP.
+  #
+  # @param [Hash] params parameters supplied by user. The processor will look for keys :otp and :id.
+  # @param [Hash] cookies cookies delivered by the client
+  # @param [String] user_agent user-agent delivered by the client
+  def process(params = nil, cookies = nil, user_agent = nil)
+    cookies ||= {}
+    params ||= {}
+    tgt = find_valid_ticket_granting_ticket(cookies[:tgt], user_agent)
+    if tgt.nil?
+      @listener.user_not_logged_in
+    else
+      authenticator = tgt.user.two_factor_authenticators.where(id: params[:id]).first
+      validation_result = validate_one_time_password(params[:otp], authenticator)
+      if validation_result.success?
+        tgt.user.two_factor_authenticators.where(active: true).delete_all
+        authenticator.active = true
+        authenticator.save!
+        @listener.two_factor_authenticator_activated
+      else
+        if validation_result.error_code == 'INVALID_OTP'
+          @listener.invalid_one_time_password(authenticator)
+        else
+          @listener.invalid_two_factor_authenticator
+        end
+      end
+    end
+  end
+end

data/app/processors/casino/two_factor_authenticator_destroyer_processor.rb

@@ -0,0 +1,33 @@
+# The TwoFactorAuthenticatorDestroyer processor can be used to deactivate a previously activated two-factor authenticator.
+#
+# This feature is not described in the CAS specification so it's completly optional
+# to implement this on the web application side.
+class CASino::TwoFactorAuthenticatorDestroyerProcessor < CASino::Processor
+  include CASino::ProcessorConcern::TicketGrantingTickets
+  include CASino::ProcessorConcern::TwoFactorAuthenticators
+
+  # The method will call one of the following methods on the listener:
+  # * `#user_not_logged_in`: The user is not logged in and should be redirected to /login.
+  # * `#two_factor_authenticator_destroyed`: The two-factor authenticator was successfully destroyed.
+  # * `#invalid_two_factor_authenticator`: The two-factor authenticator is not valid.
+  #
+  # @param [Hash] params parameters supplied by user. The processor will look for key :id.
+  # @param [Hash] cookies cookies delivered by the client
+  # @param [String] user_agent user-agent delivered by the client
+  def process(params = nil, cookies = nil, user_agent = nil)
+    cookies ||= {}
+    params ||= {}
+    tgt = find_valid_ticket_granting_ticket(cookies[:tgt], user_agent)
+    if tgt.nil?
+      @listener.user_not_logged_in
+    else
+      authenticator = tgt.user.two_factor_authenticators.where(id: params[:id]).first
+      if authenticator
+        authenticator.destroy
+        @listener.two_factor_authenticator_destroyed
+      else
+        @listener.invalid_two_factor_authenticator
+      end
+    end
+  end
+end

data/app/processors/casino/two_factor_authenticator_overview_processor.rb

@@ -0,0 +1,20 @@
+# The TwoFactorAuthenticatorOverview processor lists registered two factor devices for the currently signed in user.
+#
+# This feature is not described in the CAS specification so it's completly optional
+# to implement this on the web application side.
+class CASino::TwoFactorAuthenticatorOverviewProcessor < CASino::Processor
+  include CASino::ProcessorConcern::TicketGrantingTickets
+
+  # This method will call `#user_not_logged_in` or `#two_factor_authenticators_found(Enumerable)` on the listener.
+  # @param [Hash] cookies cookies delivered by the client
+  # @param [String] user_agent user-agent delivered by the client
+  def process(cookies = nil, user_agent = nil)
+    cookies ||= {}
+    tgt = find_valid_ticket_granting_ticket(cookies[:tgt], user_agent)
+    if tgt.nil?
+      @listener.user_not_logged_in
+    else
+      @listener.two_factor_authenticators_found(tgt.user.two_factor_authenticators.where(active: true))
+    end
+  end
+end

data/app/processors/casino/two_factor_authenticator_registrator_processor.rb

@@ -0,0 +1,24 @@
+require 'rotp'
+
+# The TwoFactorAuthenticatorRegistrator processor can be used as the first step to register a new two-factor authenticator.
+# It is inactive until activated using TwoFactorAuthenticatorActivator.
+#
+# This feature is not described in the CAS specification so it's completly optional
+# to implement this on the web application side.
+class CASino::TwoFactorAuthenticatorRegistratorProcessor < CASino::Processor
+  include CASino::ProcessorConcern::TicketGrantingTickets
+
+  # This method will call `#user_not_logged_in` or `#two_factor_authenticator_registered(two_factor_authenticator)` on the listener.
+  # @param [Hash] cookies cookies delivered by the client
+  # @param [String] user_agent user-agent delivered by the client
+  def process(cookies = nil, user_agent = nil)
+    cookies ||= {}
+    tgt = find_valid_ticket_granting_ticket(cookies[:tgt], user_agent)
+    if tgt.nil?
+      @listener.user_not_logged_in
+    else
+      two_factor_authenticator = tgt.user.two_factor_authenticators.create! secret: ROTP::Base32.random_base32
+      @listener.two_factor_authenticator_registered(two_factor_authenticator)
+    end
+  end
+end

data/app/views/casino/application/_footer.html.erb

@@ -1,3 +1,3 @@
   <div id="footer">
-    <%= CASinoCore::Settings.frontend[:footer_text].html_safe %>
+    <%= CASino.config.frontend[:footer_text].html_safe %>
   </div>

data/app/views/casino/sessions/new.html.erb

@@ -16,7 +16,7 @@
         <%= hidden_field_tag :lt, @login_ticket.ticket %>
         <%= hidden_field_tag :service, params[:service] unless params[:service].nil? %>
         <%= label_tag :username, t('login.label_username') %>
-        <%= text_field_tag :username, params[:username] %>
+        <%= text_field_tag :username, params[:username], autofocus:true %>
         <%= label_tag :password, t('login.label_password') %>
         <%= password_field_tag :password %>
         <%= label_tag :rememberMe do %>
@@ -28,3 +28,4 @@
   </div>
   <%= render 'footer' %>
 </div>
+

data/app/views/casino/sessions/validate_otp.html.erb

@@ -8,7 +8,7 @@
         <%= hidden_field_tag :tgt, @ticket_granting_ticket || params[:tgt] %>
         <%= hidden_field_tag :service, params[:service] %>
         <%= label_tag :code, t('validate_otp.code') %>
-        <%= text_field_tag :otp, nil, maxlength: 6 %>
+        <%= text_field_tag :otp, nil, maxlength: 6, autofocus:true %>
         <%= button_tag t('validate_otp.submit'), :class => 'button' %>
       <% end %>
     </div>

data/app/views/casino/two_factor_authenticators/new.html.erb

@@ -11,7 +11,7 @@
         <%= t('two_factor_authenticators.instructions') %>
       </p>
       <div id="qr-code">
-        <img src="https://chart.googleapis.com/chart?cht=qr&chs=250x250&chl=<%= u "otpauth://totp/#{u CASinoCore::Settings.frontend[:sso_name] + ': ' + @two_factor_authenticator.user.username}?secret=#{@two_factor_authenticator.secret}" %>" height="250" width="250"><br />
+        <img src="https://chart.googleapis.com/chart?cht=qr&chs=250x250&chl=<%= u "otpauth://totp/#{u CASino.config.frontend[:sso_name] + ': ' + @two_factor_authenticator.user.username}?secret=#{@two_factor_authenticator.secret}" %>" height="250" width="250"><br />
       </div>
       <p id="secret">
         <%= t('two_factor_authenticators.secret') %>: <%= @two_factor_authenticator.secret %>
@@ -22,7 +22,7 @@
       <%= form_tag(two_factor_authenticators_path, method: :post, id: 'two_factor_authenticators-form') do %>
         <%= hidden_field_tag :id, @two_factor_authenticator.id %>
         <%= label_tag :code, t('two_factor_authenticators.code') %>
-        <%= text_field_tag :otp, nil, maxlength: 6 %>
+        <%= text_field_tag :otp, nil, maxlength: 6, autofocus:true %>
         <%= link_to t('two_factor_authenticators.cancel'), sessions_path, :class => 'secondary button' %>
         <%= button_tag t('two_factor_authenticators.submit'), :class => 'button' %>
       <% end %>

data/app/views/layouts/application.html.erb

@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
-  <title><%= CASinoCore::Settings.frontend[:sso_name] %></title>
+  <title><%= CASino.config.frontend[:sso_name] %></title>
   <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
   <%= stylesheet_link_tag    "application", :media => "all" %>
   <%= javascript_include_tag "application" %>

data/casino.gemspec

@@ -10,7 +10,7 @@ Gem::Specification.new do |s|
   s.homepage    = 'http://rbcas.org/'
   s.license     = 'MIT'
   s.summary     = 'A simple CAS server written in Ruby using the Rails framework.'
-  s.description = 'CASino is a simple CAS (Central Authentication Service) server using CASinoCore as its backend.'
+  s.description = 'CASino is a simple CAS (Central Authentication Service) server.'
 
   s.files         = `git ls-files`.split("\n")
   s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
@@ -27,11 +27,16 @@ Gem::Specification.new do |s|
   s.add_development_dependency 'rake', '~> 10.0'
   s.add_development_dependency 'rspec', '~> 2.12'
   s.add_development_dependency 'rspec-rails', '~> 2.0'
-  s.add_development_dependency 'simplecov', '~> 0.7'
   s.add_development_dependency 'sqlite3', '~> 1.3'
+  s.add_development_dependency 'factory_girl', '~> 4.1'
+  s.add_development_dependency 'webmock', '~> 1.9'
+  s.add_development_dependency 'coveralls', '~> 0.7'
 
   s.add_runtime_dependency 'rails', '~> 3.2.9'
-  s.add_runtime_dependency 'jquery-rails', '~> 2.1'
   s.add_runtime_dependency 'http_accept_language', '~> 2.0.0.pre'
-  s.add_runtime_dependency 'casino_core', '~> 1.4.0'
+  s.add_runtime_dependency 'addressable', '~> 2.3'
+  s.add_runtime_dependency 'terminal-table', '~> 1.4'
+  s.add_runtime_dependency 'useragent', '~> 0.4'
+  s.add_runtime_dependency 'faraday', '~> 0.8'
+  s.add_runtime_dependency 'rotp', '~> 1.4'
 end

data/db/migrate/20130809135400_create_core_schema.rb

@@ -0,0 +1,117 @@
+# In order to support pre-2.0 installations of CASino that included CASinoCore,
+# we must rebuild the un-namespaced CASinoCore schema so that we can upgrade
+class CreateCoreSchema < ActiveRecord::Migration
+  CoreTables = %w{login_tickets proxy_granting_tickets proxy_tickets service_rules service_tickets ticket_granting_tickets two_factor_authenticators users}
+
+  def up
+    CoreTables.each do |table_name|
+      if !ActiveRecord::Base.connection.table_exists? table_name
+        send "create_#{table_name}"
+      end
+    end
+  end
+
+  def down
+    # No-op
+    # Handled by 20130809135401_rename_base_models.rb
+  end
+
+  def create_login_tickets
+    create_table :login_tickets do |t|
+      t.string :ticket, :null => false
+
+      t.timestamps
+    end
+    add_index :login_tickets, :ticket, :unique => true
+  end
+
+  def create_proxy_granting_tickets
+    create_table :proxy_granting_tickets do |t|
+      t.string  :ticket,       :null => false
+      t.string  :iou,          :null => false
+      t.integer :granter_id,   :null => false
+      t.string  :pgt_url,      :null => false
+      t.string  :granter_type, :null => false
+
+      t.timestamps
+    end
+    add_index :proxy_granting_tickets, :ticket, :unique => true
+    add_index :proxy_granting_tickets, :iou, :unique => true
+    add_index :proxy_granting_tickets, [:granter_type, :granter_id], :name => "index_proxy_granting_tickets_on_granter", :unique => true
+  end
+
+  def create_proxy_tickets
+    create_table :proxy_tickets do |t|
+      t.string  :ticket,                                      :null => false
+      t.string  :service,                                     :null => false
+      t.boolean :consumed,                 :default => false, :null => false
+      t.integer :proxy_granting_ticket_id,                    :null => false
+
+      t.timestamps
+    end
+    add_index :proxy_tickets, :ticket, :unique => true
+    add_index :proxy_tickets, :proxy_granting_ticket_id
+  end
+
+  def create_service_rules
+    create_table :service_rules do |t|
+      t.boolean :enabled, :default => true,  :null => false
+      t.integer :order,   :default => 10,    :null => false
+      t.string  :name,                       :null => false
+      t.string  :url,                        :null => false
+      t.boolean :regex,   :default => false, :null => false
+
+      t.timestamps
+    end
+    add_index :service_rules, :url, :unique => true
+  end
+
+  def create_service_tickets
+    create_table :service_tickets do |t|
+      t.string  :ticket,                                      :null => false
+      t.string  :service,                                     :null => false
+      t.integer :ticket_granting_ticket_id
+      t.boolean :consumed,                 :default => false, :null => false
+      t.boolean :issued_from_credentials,  :default => false, :null => false
+
+      t.timestamps
+    end
+    add_index :service_tickets, :ticket, :unique => true
+    add_index :service_tickets, :ticket_granting_ticket_id
+  end
+
+  def create_ticket_granting_tickets
+    create_table :ticket_granting_tickets do |t|
+      t.string  :ticket,                                                :null => false
+      t.string  :user_agent
+      t.integer :user_id,                                               :null => false
+      t.boolean :awaiting_two_factor_authentication, :default => false, :null => false
+      t.boolean :long_term,                          :default => false, :null => false
+
+      t.timestamps
+    end
+    add_index :ticket_granting_tickets, :ticket, :unique => true
+  end
+
+  def create_two_factor_authenticators
+    create_table :two_factor_authenticators do |t|
+      t.integer :user_id,                    :null => false
+      t.string  :secret,                     :null => false
+      t.boolean :active,  :default => false, :null => false
+
+      t.timestamps
+    end
+    add_index :two_factor_authenticators, :user_id
+  end
+
+  def create_users
+    create_table :users do |t|
+      t.string  :authenticator,   :null => false
+      t.string  :username,        :null => false
+      t.text    :extra_attributes
+
+      t.timestamps
+    end
+    add_index :users, [:authenticator, :username], :unique => true
+  end
+end