casino 3.0.4 → 4.0.0.pre.1

data/app/helpers/casino/sessions_helper.rb

@@ -1,5 +1,80 @@
+require 'addressable/uri'
+
 module CASino::SessionsHelper
+  include CASino::TicketGrantingTicketProcessor
+  include CASino::ServiceTicketProcessor
+
   def current_ticket_granting_ticket?(ticket_granting_ticket)
     ticket_granting_ticket.ticket == cookies[:tgt]
   end
+
+  def current_ticket_granting_ticket
+    return nil unless cookies[:tgt]
+    return @current_ticket_granting_ticket unless @current_ticket_granting_ticket.nil?
+    find_valid_ticket_granting_ticket(cookies[:tgt], request.user_agent).tap do |tgt|
+      cookies.delete :tgt if tgt.nil?
+      @current_ticket_granting_ticket = tgt
+    end
+  end
+
+  def current_user
+    tgt = current_ticket_granting_ticket
+    return nil if tgt.nil?
+    tgt.user
+  end
+
+  def ensure_signed_in
+    redirect_to login_path unless signed_in?
+  end
+
+  def signed_in?
+    !current_ticket_granting_ticket.nil?
+  end
+
+  def sign_in(authentication_result, options = {})
+    tgt = acquire_ticket_granting_ticket(authentication_result, request.user_agent, options)
+    set_tgt_cookie(tgt)
+    handle_signed_in(tgt, options)
+  end
+
+  def set_tgt_cookie(tgt)
+    cookies[:tgt] = { value: tgt.ticket }.tap do |cookie|
+      if tgt.long_term?
+        cookie[:expires] = CASino.config.ticket_granting_ticket[:lifetime_long_term].seconds.from_now
+      end
+    end
+  end
+
+  def sign_out
+    remove_ticket_granting_ticket(cookies[:tgt], request.user_agent)
+    cookies.delete :tgt
+  end
+
+  private
+  def handle_signed_in(tgt, options = {})
+    if tgt.awaiting_two_factor_authentication?
+      @ticket_granting_ticket = tgt
+      render 'casino/sessions/validate_otp'
+    else
+      if params[:service].present?
+        begin
+          handle_signed_in_with_service(tgt, options)
+          return
+        rescue Addressable::URI::InvalidURIError => e
+          Rails.logger.warn "Service #{params[:service]} not valid: #{e}"
+        end
+      end
+      redirect_to sessions_path, status: :see_other
+    end
+  end
+
+  def handle_signed_in_with_service(tgt, options)
+    if !service_allowed?(params[:service])
+      @service = params[:service]
+      render 'casino/sessions/service_not_allowed', status: 403
+    else
+      url = acquire_service_ticket(tgt, params[:service], options).service_with_ticket_url
+      redirect_to url, status: :see_other
+    end
+  end
 end

data/app/helpers/casino/two_factor_authenticators_helper.rb

@@ -0,0 +1,12 @@
+require 'rqrcode_png'
+
+module CASino::TwoFactorAuthenticatorsHelper
+  def otp_auth_url(two_factor_authenticator)
+    "otpauth://totp/#{u CASino.config.frontend[:sso_name] + ': ' + two_factor_authenticator.user.username}?secret=#{two_factor_authenticator.secret}&issuer=#{u CASino.config.frontend[:sso_name]}"
+  end
+
+  def otp_qr_code_data_url(two_factor_authenticator)
+    qr = RQRCode::QRCode.new(otp_auth_url(two_factor_authenticator), size: 5, level: :l)
+    qr.to_img.resize(250,250).to_data_url
+  end
+end

data/app/models/casino/auth_token_ticket.rb

@@ -0,0 +1,15 @@
+class CASino::AuthTokenTicket < ActiveRecord::Base
+  include CASino::ModelConcern::Ticket
+  include CASino::ModelConcern::ConsumableTicket
+
+  self.ticket_prefix = 'ATT'.freeze
+
+  def self.cleanup
+    delete_all(['created_at < ?', CASino.config.auth_token_ticket[:lifetime].seconds.ago])
+  end
+
+  def expired?
+    (Time.now - (self.created_at || Time.now)) > CASino.config.auth_token_ticket[:lifetime].seconds
+  end
+
+end

data/app/models/casino/login_ticket.rb

@@ -1,11 +1,14 @@
 class CASino::LoginTicket < ActiveRecord::Base
-  validates :ticket, uniqueness: true
+  include CASino::ModelConcern::Ticket
+  include CASino::ModelConcern::ConsumableTicket
+
+  self.ticket_prefix = 'LT'.freeze
 
   def self.cleanup
-    self.delete_all(['created_at < ?', CASino.config.login_ticket[:lifetime].seconds.ago])
+    delete_all(['created_at < ?', CASino.config.login_ticket[:lifetime].seconds.ago])
   end
 
-  def to_s
-    self.ticket
+  def expired?
+    (Time.now - (self.created_at || Time.now)) > CASino.config.login_ticket[:lifetime].seconds
   end
 end

data/app/models/casino/model_concern/consumable_ticket.rb

@@ -0,0 +1,20 @@
+module CASino::ModelConcern::ConsumableTicket
+  extend ActiveSupport::Concern
+
+  module ClassMethods
+    def consume(ticket_identifier)
+      ticket = find_by_ticket(ticket_identifier)
+      if ticket.nil?
+        Rails.logger.info "#{model_name.human} '#{ticket_identifier}' not found"
+        false
+      elsif ticket.expired?
+        Rails.logger.info "#{model_name.human} '#{ticket.ticket}' expired"
+        false
+      else
+        Rails.logger.debug "#{model_name.human} '#{ticket.ticket}' successfully validated"
+        ticket.delete
+        true
+      end
+    end
+  end
+end

data/app/models/casino/model_concern/ticket.rb

@@ -0,0 +1,28 @@
+module CASino::ModelConcern::Ticket
+  extend ActiveSupport::Concern
+
+  included do
+    before_validation :ensure_ticket_present
+    validates :ticket, uniqueness: true
+    class_attribute :ticket_prefix
+  end
+
+  def to_s
+    ticket
+  end
+
+  private
+  TICKET_ALLOWED_CHARACTERS = ('A'..'Z').to_a + ('a'..'z').to_a + ('0'..'9').to_a
+  TICKET_LENGTH = 40
+
+  def ensure_ticket_present
+    self.ticket ||= create_random_ticket_string(self.class.ticket_prefix)
+  end
+
+  def create_random_ticket_string(prefix)
+    random_string = SecureRandom.random_bytes(TICKET_LENGTH).each_char.map do |char|
+      TICKET_ALLOWED_CHARACTERS[(char.ord % TICKET_ALLOWED_CHARACTERS.length)]
+    end.join
+    "#{prefix}-#{'%d' % (Time.now.to_f * 10000)}-#{random_string}"
+  end
+end

data/app/models/casino/proxy_granting_ticket.rb

@@ -1,7 +1,19 @@
 
 class CASino::ProxyGrantingTicket < ActiveRecord::Base
+  include CASino::ModelConcern::Ticket
+
+  self.ticket_prefix = 'PGT'.freeze
+
+  before_validation :ensure_iou_present
+
   validates :ticket, uniqueness: true
   validates :iou, uniqueness: true
+
   belongs_to :granter, polymorphic: true
   has_many :proxy_tickets, dependent: :destroy
+
+  private
+  def ensure_iou_present
+    self.iou ||= create_random_ticket_string('PGTIOU')
+  end
 end

data/app/models/casino/proxy_ticket.rb

@@ -1,6 +1,10 @@
 require 'addressable/uri'
 
 class CASino::ProxyTicket < ActiveRecord::Base
+  include CASino::ModelConcern::Ticket
+
+  self.ticket_prefix = 'PT'.freeze
+
   validates :ticket, uniqueness: true
   belongs_to :proxy_granting_ticket
   has_many :proxy_granting_tickets, as: :granter, dependent: :destroy

data/app/models/casino/service_ticket.rb

@@ -1,7 +1,10 @@
 require 'addressable/uri'
 
 class CASino::ServiceTicket < ActiveRecord::Base
-  validates :ticket, uniqueness: true
+  include CASino::ModelConcern::Ticket
+
+  self.ticket_prefix = 'ST'.freeze
+
   belongs_to :ticket_granting_ticket
   before_destroy :send_single_sign_out_notification, if: :consumed?
   has_many :proxy_granting_tickets, as: :granter, dependent: :destroy
@@ -15,16 +18,14 @@ class CASino::ServiceTicket < ActiveRecord::Base
   end
 
   def self.cleanup_consumed_hard
-    self.delete_all(['created_at < ? AND consumed = ?', (CASino.config.service_ticket[:lifetime_consumed].seconds * 2).ago, true])
+    self.delete_all(['created_at < ? AND consumed = ?', (CASino.config.service_ticket[:lifetime_consumed] * 2).seconds.ago, true])
   end
 
-
   def service=(service)
     normalized_encoded_service = Addressable::URI.parse(service).normalize.to_str
     super(normalized_encoded_service)
   end
 
-
   def service_with_ticket_url
     service_uri = Addressable::URI.parse(self.service)
     service_uri.query_values = (service_uri.query_values(Array) || []) << ['ticket', self.ticket]

data/app/models/casino/ticket_granting_ticket.rb

@@ -1,11 +1,15 @@
 require 'user_agent'
 
 class CASino::TicketGrantingTicket < ActiveRecord::Base
-  validates :ticket, uniqueness: true
+  include CASino::ModelConcern::Ticket
+
+  self.ticket_prefix = 'TGC'.freeze
 
   belongs_to :user
   has_many :service_tickets, dependent: :destroy
 
+  scope :active, -> { where(awaiting_two_factor_authentication: false).order('updated_at DESC') }
+
   def self.cleanup(user = nil)
     if user.nil?
       base = self

data/app/models/casino/two_factor_authenticator.rb

@@ -2,6 +2,8 @@
 class CASino::TwoFactorAuthenticator < ActiveRecord::Base
   belongs_to :user
 
+  scope :active, -> { where(active: true) }
+
   def self.cleanup
     self.delete_all(['(created_at < ?) AND active = ?', self.lifetime.ago, false])
   end

data/app/processors/casino/authentication_processor.rb

@@ -0,0 +1,73 @@
+module CASino::AuthenticationProcessor
+  extend ActiveSupport::Concern
+
+  def validate_login_credentials(username, password)
+    authentication_result = nil
+    authenticators.each do |authenticator_name, authenticator|
+      begin
+        data = authenticator.validate(username, password)
+      rescue CASino::Authenticator::AuthenticatorError => e
+        Rails.logger.error "Authenticator '#{authenticator_name}' (#{authenticator.class}) raised an error: #{e}"
+      end
+      if data
+        authentication_result = { authenticator: authenticator_name, user_data: data }
+        Rails.logger.info("Credentials for username '#{data[:username]}' successfully validated using authenticator '#{authenticator_name}' (#{authenticator.class})")
+        break
+      end
+    end
+    authentication_result
+  end
+
+  def load_user_data(authenticator_name, username)
+    authenticator = authenticators[authenticator_name]
+    return nil if authenticator.nil?
+    return nil unless authenticator.respond_to?(:load_user_data)
+    authenticator.load_user_data(username)
+  end
+
+  def authenticators
+    @authenticators ||= {}.tap do |authenticators|
+      CASino.config.authenticators.each do |name, auth|
+        next unless auth.is_a?(Hash)
+
+        authenticator = if auth[:class]
+                          auth[:class].constantize
+                        else
+                          load_authenticator(auth[:authenticator])
+                        end
+
+        authenticators[name] = authenticator.new(auth[:options])
+      end
+    end
+  end
+
+  private
+  def load_authenticator(name)
+    gemname, classname = parse_name(name)
+
+    begin
+      require gemname unless CASino.const_defined?(classname)
+      CASino.const_get(classname)
+    rescue LoadError => error
+      raise LoadError, load_error_message(name, gemname, error)
+    rescue NameError => error
+      raise NameError, name_error_message(name, error)
+    end
+  end
+
+  def parse_name(name)
+    [ "casino-#{name.underscore}_authenticator", "#{name.camelize}Authenticator" ]
+  end
+
+  def load_error_message(name, gemname, error)
+    "Failed to load authenticator '#{name}'. Maybe you have to include " \
+      "\"gem '#{gemname}'\" in your Gemfile?\n" \
+      "  Error: #{error.message}\n"
+  end
+
+  def name_error_message(name, error)
+    "Failed to load authenticator '#{name}'. The authenticator class must " \
+      "be defined in the CASino namespace.\n" \
+      "  Error: #{error.message}\n"
+  end
+end

data/app/processors/casino/browser_processor.rb

@@ -0,0 +1,12 @@
+module CASino::BrowserProcessor
+  extend ActiveSupport::Concern
+
+  def browser_info(user_agent)
+    user_agent = UserAgent.parse(user_agent)
+    "#{user_agent.browser} (#{user_agent.platform})"
+  end
+
+  def same_browser?(user_agent, other_user_agent)
+    user_agent == other_user_agent || browser_info(user_agent) == browser_info(other_user_agent)
+  end
+end

data/app/processors/casino/proxy_granting_ticket_processor.rb

@@ -0,0 +1,37 @@
+require 'faraday'
+
+module CASino::ProxyGrantingTicketProcessor
+  extend ActiveSupport::Concern
+
+  def acquire_proxy_granting_ticket(pgt_url, service_ticket)
+    callback_uri = Addressable::URI.parse(pgt_url)
+    if callback_uri.scheme != 'https'
+      Rails.logger.warn "Proxy tickets can only be granted to callback servers using HTTPS."
+      nil
+    else
+      contact_callback_server(callback_uri, service_ticket)
+    end
+  end
+
+  private
+  def contact_callback_server(callback_uri, service_ticket)
+    pgt = service_ticket.proxy_granting_tickets.new({
+      pgt_url: "#{callback_uri}"
+    })
+    return unless pgt.valid?
+    callback_uri.query_values = (callback_uri.query_values || {}).merge(pgtId: pgt.ticket, pgtIou: pgt.iou)
+    response = Faraday.get "#{callback_uri}"
+    # TODO: does this follow redirects? CAS specification says that redirects MAY be followed (2.5.4)
+    if response.success?
+      pgt.save!
+      Rails.logger.debug "Proxy-granting ticket generated for service '#{service_ticket.service}': #{pgt.inspect}"
+      pgt
+    else
+      Rails.logger.warn "Proxy-granting ticket callback server responded with a bad result code '#{response.status}'. PGT will not be stored."
+      nil
+    end
+  rescue Faraday::Error::ClientError => error
+    Rails.logger.warn "Exception while communicating with proxy-granting ticket callback server: #{error.message}"
+    nil
+  end
+end

data/app/processors/casino/service_ticket_processor.rb

@@ -0,0 +1,81 @@
+module CASino::ServiceTicketProcessor
+  extend ActiveSupport::Concern
+
+  class ServiceNotAllowedError < StandardError; end
+  class ValidationResult < CASino::ValidationResult; end
+
+  RESERVED_CAS_PARAMETER_KEYS = ['service', 'ticket', 'gateway', 'renew']
+
+  def service_allowed?(service)
+    CASino::ServiceRule.allowed?(service)
+  end
+
+  def acquire_service_ticket(ticket_granting_ticket, service, options = {})
+    service_url = clean_service_url(service)
+    unless service_allowed?(service_url)
+      message = "#{service_url} is not in the list of allowed URLs"
+      Rails.logger.error message
+      raise ServiceNotAllowedError, message
+    end
+    service_tickets = ticket_granting_ticket.service_tickets
+    service_tickets.where(service: service_url).destroy_all
+    service_tickets.create!({
+      service: service_url,
+      issued_from_credentials: !!options[:credentials_supplied]
+    })
+  end
+
+  def clean_service_url(dirty_service)
+    return dirty_service if dirty_service.blank?
+    service_uri = Addressable::URI.parse dirty_service
+    unless service_uri.query_values.nil?
+      service_uri.query_values = service_uri.query_values(Array).select { |k,v| !RESERVED_CAS_PARAMETER_KEYS.include?(k) }
+    end
+    if service_uri.query_values.blank?
+      service_uri.query_values = nil
+    end
+
+    service_uri.path = (service_uri.path || '').gsub(/\/+\z/, '')
+    service_uri.path = '/' if service_uri.path.blank?
+
+    service_uri.normalize.to_s.tap do |clean_service|
+      Rails.logger.debug("Cleaned dirty service URL '#{dirty_service}' to '#{clean_service}'") if dirty_service != clean_service
+    end
+  end
+
+  def ticket_valid_for_service?(ticket, service, options = {})
+    validate_ticket_for_service(ticket, service, options).success?
+  end
+
+  def validate_ticket_for_service(ticket, service, options = {})
+    if ticket.nil?
+      result = ValidationResult.new 'INVALID_TICKET', 'Invalid validate request: Ticket does not exist', :warn
+    else
+      result = validate_existing_ticket_for_service(ticket, service, options)
+      ticket.update_attribute(:consumed, true)
+      Rails.logger.debug "Consumed ticket '#{ticket.ticket}'"
+    end
+    if result.success?
+      Rails.logger.info "Ticket '#{ticket.ticket}' for service '#{service}' successfully validated"
+    else
+      Rails.logger.send(result.error_severity, result.error_message)
+    end
+    result
+  end
+
+  private
+  def validate_existing_ticket_for_service(ticket, service, options = {})
+    service = clean_service_url(service) if ticket.is_a?(CASino::ServiceTicket)
+    if ticket.consumed?
+      ValidationResult.new 'INVALID_TICKET', "Ticket '#{ticket.ticket}' already consumed", :warn
+    elsif ticket.expired?
+      ValidationResult.new 'INVALID_TICKET', "Ticket '#{ticket.ticket}' has expired", :warn
+    elsif service != ticket.service
+      ValidationResult.new 'INVALID_SERVICE', "Ticket '#{ticket.ticket}' is not valid for service '#{service}'", :warn
+    elsif options[:renew] && !ticket.issued_from_credentials?
+      ValidationResult.new 'INVALID_TICKET', "Ticket '#{ticket.ticket}' was not issued from credentials but service '#{service}' will only accept a renewed ticket", :info
+    else
+      ValidationResult.new
+    end
+  end
+end