devise_oam 0.0.1

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright 2012 YOURNAME
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,67 @@
+# DeviseOam [![Build Status](https://secure.travis-ci.org/whatthewhat/devise_oam.png)](http://travis-ci.org/whatthewhat/devise_oam)
+
+OAM authentication strategy for devise.
+
+This Rails engine adds header based authentication strategy to [devise](https://github.com/plataformatec/devise) for 
+integration with Oracle Access Manager. 
+
+## Installation
+In **Rails 3**, add this to your Gemfile and run the `bundle` command.
+
+    gem "devise_oam", github: "whatthewhat/devise_oam"
+
+## Usage
+1) Add the `HeaderAuthenticatable` strategy in devise initializer `config/initializers/devise.rb`:
+
+```ruby
+# Add HeaderAuthenticatable strategy to Warden:
+config.warden do |manager|
+  manager.strategies.add(:custom_auth, DeviseOam::Devise::Strategies::HeaderAuthenticatable)
+  manager.default_strategies(:scope => :user).unshift :custom_auth
+end
+```
+
+2) Set `DeviseOam` settings (i.e. in `config/initializers/devise_oam.rb`):
+
+```ruby
+DeviseOam.setup do |config|
+  config.oam_header = "OAM_REMOTE_USER"
+  config.user_class = "User"
+  config.user_login_field = "email"
+  config.create_user_if_not_found = false
+end
+```
+### Settings explained:
+* `oam_header` - HTTP header that triggers the authentication strategy, should have user login as a value
+* `user_class` - class of your devise user model
+* `user_login_field` - login field for the user model (should be unique)
+* `create_user_if_not_found` - if set to true this will create a new user if no user was found
+* `create_user_method` - method in the `user_class` to handle new user creation
+* `ldap_header` - HTTP header for LDAP roles
+* `roles_setter` - method in the `user_class` to handle updating user roles
+
+### Automatic user creation
+If you need to automatically create new users based on `oam_header` you need to do the following:
+
+1. Set `create_user_if_not_found` setting to `true`
+2. Add a method to your user class that will accept a hash of params (`user_login_field` and also `:roles` if you are using LDAP roles) and create a new user
+3. In the initializer set the `create_user_method` setting to the method you've just added
+
+For an example see `test/dummy` app.
+
+### LDAP roles
+To use LDAP roles parsing:
+
+1. Set `ldap_header` setting to the HTTP header with roles (should be a comma separated string)
+2. Add a method to your user class that will accept an array with roles and update the user
+3. In the initializer set `roles_setter` setting to the method you've just created
+
+For an example see `test/dummy` app.
+
+## Links
+* [Devise](https://github.com/plataformatec/devise)
+* [Warden authentication strategies](https://github.com/hassox/warden/wiki/Strategies)
+
+## License
+
+This project uses MIT-LICENSE.

data/Rakefile

@@ -0,0 +1,38 @@
+#!/usr/bin/env rake
+begin
+  require 'bundler/setup'
+rescue LoadError
+  puts 'You must `gem install bundler` and `bundle install` to run rake tasks'
+end
+begin
+  require 'rdoc/task'
+rescue LoadError
+  require 'rdoc/rdoc'
+  require 'rake/rdoctask'
+  RDoc::Task = Rake::RDocTask
+end
+
+RDoc::Task.new(:rdoc) do |rdoc|
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title    = 'DeviseOam'
+  rdoc.options << '--line-numbers'
+  rdoc.rdoc_files.include('README.rdoc')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end
+
+
+
+
+Bundler::GemHelper.install_tasks
+
+require 'rake/testtask'
+
+Rake::TestTask.new(:test) do |t|
+  t.libs << 'lib'
+  t.libs << 'test'
+  t.pattern = 'test/**/*_test.rb'
+  t.verbose = false
+end
+
+
+task :default => :test

data/lib/devise_oam/authenticatable_entity.rb

@@ -0,0 +1,15 @@
+module DeviseOam
+  class AuthenticatableEntity
+    attr_accessor :login, :ldap_roles
+    
+    def initialize(login, ldap_roles = nil)
+      @login = login.strip.downcase
+      @ldap_roles = parse_ldap_roles(ldap_roles) if ldap_roles
+    end
+    
+    private
+    def parse_ldap_roles(ldap_roles)
+      ldap_roles.strip.downcase.split(',')
+    end
+  end
+end

data/lib/devise_oam/strategies/header_authenticatable.rb

@@ -0,0 +1,50 @@
+module DeviseOam
+  module Devise
+    module Strategies
+      class HeaderAuthenticatable < ::Devise::Strategies::Base
+        attr_reader :authenticatable
+        
+        def valid?
+          # this strategy is only valid if there is a DeviseOam.oam_header header in the request
+          request.headers[DeviseOam.oam_header]
+        end
+
+        def authenticate!         
+          failure_message = "OAM authentication failed"
+          
+          oam_data = request.headers[DeviseOam.oam_header]
+          if DeviseOam.ldap_header
+            ldap_data = request.headers[DeviseOam.ldap_header] || ""
+          end
+
+          if oam_data.blank?
+            fail!(failure_message)
+          else
+            @authenticatable = AuthenticatableEntity.new(oam_data, ldap_data)
+            
+            user = find_or_create_user
+            success!(user)
+          end
+        end
+        
+        def set_roles?
+          !DeviseOam.ldap_header.blank? && @authenticatable.ldap_roles
+        end
+        
+        private
+        
+        def find_or_create_user
+          user = DeviseOam.user_class.where({ DeviseOam.user_login_field.to_sym => @authenticatable.login }).first
+          
+          if user.nil? && DeviseOam.create_user_if_not_found
+            user = DeviseOam.user_class.send(DeviseOam.create_user_method, { DeviseOam.user_login_field.to_sym => @authenticatable.login, :roles => @authenticatable.ldap_roles })
+          elsif user && set_roles?
+            user.send(DeviseOam.roles_setter, @authenticatable.ldap_roles)
+          end
+          
+          user
+        end
+      end
+    end
+  end
+end

data/lib/devise_oam/version.rb

@@ -0,0 +1,3 @@
+module DeviseOam
+  VERSION = "0.0.1"
+end

data/lib/devise_oam.rb

@@ -0,0 +1,23 @@
+require "devise"
+require "devise_oam/strategies/header_authenticatable"
+require "devise_oam/authenticatable_entity"
+
+module DeviseOam
+  
+  # Settings
+  mattr_accessor :oam_header
+  mattr_accessor :user_class
+  mattr_accessor :user_login_field
+  mattr_accessor :create_user_if_not_found
+  mattr_accessor :create_user_method
+  mattr_accessor :ldap_header
+  mattr_accessor :roles_setter
+  
+  def self.setup
+    yield self
+  end
+  
+  def self.user_class
+    @@user_class.constantize
+  end
+end

data/lib/tasks/devise_oam_tasks.rake

@@ -0,0 +1,4 @@
+# desc "Explaining what the task does"
+# task :devise_oam do
+#   # Task goes here
+# end

data/test/devise_oam_test.rb

@@ -0,0 +1,96 @@
+require 'test_helper'
+include TestHelpers
+
+class DeviseOamTest < ActiveSupport::TestCase
+  def setup
+    set_default_settings
+    
+    @strategy = DeviseOam::Devise::Strategies::HeaderAuthenticatable.new(env_with_params("/", {}, { "HTTP_#{DeviseOam.oam_header}" => "foo" }))
+  end
+  
+  test "truth" do
+    assert_kind_of Module, DeviseOam
+  end
+  
+  test "setup block yields self" do
+    DeviseOam.setup do |config|
+      assert_equal DeviseOam, config
+    end
+  end
+  
+  test "strategy is valid when specified header is in the request" do
+    assert @strategy.valid?, "Expected strategy to be valid since oam_header is in the request"
+  end
+  
+  test "strategy is not valid when specified header is not in the request" do
+    DeviseOam.oam_header = "some_header_that_is_not_in_the_request"
+    invalid_strategy = DeviseOam::Devise::Strategies::HeaderAuthenticatable.new(env_with_params)
+    
+    assert !invalid_strategy.valid?, "Expected strategy not to be valid since oam_header is not in the request"
+  end
+  
+  test "authentication fails when oam_header is blank" do
+    strategy = DeviseOam::Devise::Strategies::HeaderAuthenticatable.new(env_with_params("/", {}, { "HTTP_#{DeviseOam.oam_header}" => "" }))
+    strategy._run!
+    
+    assert_equal strategy.result, :failure
+    assert_equal strategy.user, nil
+  end
+  
+  test "authentication succeeds when oam_header is present and not blank" do
+    user = DeviseOam.user_class.new(DeviseOam.user_login_field => "foo")
+    user.save(validate: false)
+    @strategy._run!
+    
+    assert_equal @strategy.result, :success
+    assert_not_nil @strategy.user
+  end
+  
+  test "creates new user when create_user_if_not_found is true" do
+    DeviseOam.create_user_if_not_found = true
+    @strategy._run!
+    
+    assert_equal @strategy.result, :success
+    assert_not_nil @strategy.user
+  end
+  
+  test "correctly parses ldap roles" do
+    ldap_roles = 'role-1,Role-2'
+    roles = ["role-1", "role-2"]
+    
+    authenticatable = DeviseOam::AuthenticatableEntity.new("login", ldap_roles)
+    
+    assert_equal authenticatable.ldap_roles, roles
+  end
+  
+  test "sets user roles on creation" do
+    roles = ["role-1", "role-2"]
+    DeviseOam.create_user_if_not_found = true
+    
+    strategy = DeviseOam::Devise::Strategies::HeaderAuthenticatable.new(
+      env_with_params("/", {}, { "HTTP_#{DeviseOam.oam_header}" => "foo", "HTTP_#{DeviseOam.ldap_header}" => roles.join(",") })
+    )
+    strategy._run!
+    
+    user = DeviseOam.user_class.where(DeviseOam.user_login_field => "foo").first
+    
+    assert_equal strategy.result, :success
+    assert_equal strategy.authenticatable.ldap_roles, roles
+    assert_equal user.roles, roles
+  end
+  
+  test "updates excisting user roles" do
+    roles = ["role-2", "role-3"]
+    user = DeviseOam.user_class.new(DeviseOam.user_login_field => "foo", :roles => ["role-1", "role-2"])
+    user.save(validate: false)
+    
+    strategy = DeviseOam::Devise::Strategies::HeaderAuthenticatable.new(
+      env_with_params("/", {}, { "HTTP_#{DeviseOam.oam_header}" => "foo", "HTTP_#{DeviseOam.ldap_header}" => roles.join(",") })
+    )
+    strategy._run!
+    
+    assert_equal strategy.result, :success
+    assert_equal strategy.authenticatable.ldap_roles, roles
+    assert_equal user.reload.roles, roles
+  end
+end

data/test/dummy/README.rdoc

@@ -0,0 +1,261 @@
+== Welcome to Rails
+
+Rails is a web-application framework that includes everything needed to create
+database-backed web applications according to the Model-View-Control pattern.
+
+This pattern splits the view (also called the presentation) into "dumb"
+templates that are primarily responsible for inserting pre-built data in between
+HTML tags. The model contains the "smart" domain objects (such as Account,
+Product, Person, Post) that holds all the business logic and knows how to
+persist themselves to a database. The controller handles the incoming requests
+(such as Save New Account, Update Product, Show Post) by manipulating the model
+and directing data to the view.
+
+In Rails, the model is handled by what's called an object-relational mapping
+layer entitled Active Record. This layer allows you to present the data from
+database rows as objects and embellish these data objects with business logic
+methods. You can read more about Active Record in
+link:files/vendor/rails/activerecord/README.html.
+
+The controller and view are handled by the Action Pack, which handles both
+layers by its two parts: Action View and Action Controller. These two layers
+are bundled in a single package due to their heavy interdependence. This is
+unlike the relationship between the Active Record and Action Pack that is much
+more separate. Each of these packages can be used independently outside of
+Rails. You can read more about Action Pack in
+link:files/vendor/rails/actionpack/README.html.
+
+
+== Getting Started
+
+1. At the command prompt, create a new Rails application:
+       <tt>rails new myapp</tt> (where <tt>myapp</tt> is the application name)
+
+2. Change directory to <tt>myapp</tt> and start the web server:
+       <tt>cd myapp; rails server</tt> (run with --help for options)
+
+3. Go to http://localhost:3000/ and you'll see:
+       "Welcome aboard: You're riding Ruby on Rails!"
+
+4. Follow the guidelines to start developing your application. You can find
+the following resources handy:
+
+* The Getting Started Guide: http://guides.rubyonrails.org/getting_started.html
+* Ruby on Rails Tutorial Book: http://www.railstutorial.org/
+
+
+== Debugging Rails
+
+Sometimes your application goes wrong. Fortunately there are a lot of tools that
+will help you debug it and get it back on the rails.
+
+First area to check is the application log files. Have "tail -f" commands
+running on the server.log and development.log. Rails will automatically display
+debugging and runtime information to these files. Debugging info will also be
+shown in the browser on requests from 127.0.0.1.
+
+You can also log your own messages directly into the log file from your code
+using the Ruby logger class from inside your controllers. Example:
+
+  class WeblogController < ActionController::Base
+    def destroy
+      @weblog = Weblog.find(params[:id])
+      @weblog.destroy
+      logger.info("#{Time.now} Destroyed Weblog ID ##{@weblog.id}!")
+    end
+  end
+
+The result will be a message in your log file along the lines of:
+
+  Mon Oct 08 14:22:29 +1000 2007 Destroyed Weblog ID #1!
+
+More information on how to use the logger is at http://www.ruby-doc.org/core/
+
+Also, Ruby documentation can be found at http://www.ruby-lang.org/. There are
+several books available online as well:
+
+* Programming Ruby: http://www.ruby-doc.org/docs/ProgrammingRuby/ (Pickaxe)
+* Learn to Program: http://pine.fm/LearnToProgram/ (a beginners guide)
+
+These two books will bring you up to speed on the Ruby language and also on
+programming in general.
+
+
+== Debugger
+
+Debugger support is available through the debugger command when you start your
+Mongrel or WEBrick server with --debugger. This means that you can break out of
+execution at any point in the code, investigate and change the model, and then,
+resume execution! You need to install ruby-debug to run the server in debugging
+mode. With gems, use <tt>sudo gem install ruby-debug</tt>. Example:
+
+  class WeblogController < ActionController::Base
+    def index
+      @posts = Post.all
+      debugger
+    end
+  end
+
+So the controller will accept the action, run the first line, then present you
+with a IRB prompt in the server window. Here you can do things like:
+
+  >> @posts.inspect
+  => "[#<Post:0x14a6be8
+          @attributes={"title"=>nil, "body"=>nil, "id"=>"1"}>,
+       #<Post:0x14a6620
+          @attributes={"title"=>"Rails", "body"=>"Only ten..", "id"=>"2"}>]"
+  >> @posts.first.title = "hello from a debugger"
+  => "hello from a debugger"
+
+...and even better, you can examine how your runtime objects actually work:
+
+  >> f = @posts.first
+  => #<Post:0x13630c4 @attributes={"title"=>nil, "body"=>nil, "id"=>"1"}>
+  >> f.
+  Display all 152 possibilities? (y or n)
+
+Finally, when you're ready to resume execution, you can enter "cont".
+
+
+== Console
+
+The console is a Ruby shell, which allows you to interact with your
+application's domain model. Here you'll have all parts of the application
+configured, just like it is when the application is running. You can inspect
+domain models, change values, and save to the database. Starting the script
+without arguments will launch it in the development environment.
+
+To start the console, run <tt>rails console</tt> from the application
+directory.
+
+Options:
+
+* Passing the <tt>-s, --sandbox</tt> argument will rollback any modifications
+  made to the database.
+* Passing an environment name as an argument will load the corresponding
+  environment. Example: <tt>rails console production</tt>.
+
+To reload your controllers and models after launching the console run
+<tt>reload!</tt>
+
+More information about irb can be found at:
+link:http://www.rubycentral.org/pickaxe/irb.html
+
+
+== dbconsole
+
+You can go to the command line of your database directly through <tt>rails
+dbconsole</tt>. You would be connected to the database with the credentials
+defined in database.yml. Starting the script without arguments will connect you
+to the development database. Passing an argument will connect you to a different
+database, like <tt>rails dbconsole production</tt>. Currently works for MySQL,
+PostgreSQL and SQLite 3.
+
+== Description of Contents
+
+The default directory structure of a generated Ruby on Rails application:
+
+  |-- app
+  |   |-- assets
+  |       |-- images
+  |       |-- javascripts
+  |       `-- stylesheets
+  |   |-- controllers
+  |   |-- helpers
+  |   |-- mailers
+  |   |-- models
+  |   `-- views
+  |       `-- layouts
+  |-- config
+  |   |-- environments
+  |   |-- initializers
+  |   `-- locales
+  |-- db
+  |-- doc
+  |-- lib
+  |   `-- tasks
+  |-- log
+  |-- public
+  |-- script
+  |-- test
+  |   |-- fixtures
+  |   |-- functional
+  |   |-- integration
+  |   |-- performance
+  |   `-- unit
+  |-- tmp
+  |   |-- cache
+  |   |-- pids
+  |   |-- sessions
+  |   `-- sockets
+  `-- vendor
+      |-- assets
+          `-- stylesheets
+      `-- plugins
+
+app
+  Holds all the code that's specific to this particular application.
+
+app/assets
+  Contains subdirectories for images, stylesheets, and JavaScript files.
+
+app/controllers
+  Holds controllers that should be named like weblogs_controller.rb for
+  automated URL mapping. All controllers should descend from
+  ApplicationController which itself descends from ActionController::Base.
+
+app/models
+  Holds models that should be named like post.rb. Models descend from
+  ActiveRecord::Base by default.
+
+app/views
+  Holds the template files for the view that should be named like
+  weblogs/index.html.erb for the WeblogsController#index action. All views use
+  eRuby syntax by default.
+
+app/views/layouts
+  Holds the template files for layouts to be used with views. This models the
+  common header/footer method of wrapping views. In your views, define a layout
+  using the <tt>layout :default</tt> and create a file named default.html.erb.
+  Inside default.html.erb, call <% yield %> to render the view using this
+  layout.
+
+app/helpers
+  Holds view helpers that should be named like weblogs_helper.rb. These are
+  generated for you automatically when using generators for controllers.
+  Helpers can be used to wrap functionality for your views into methods.
+
+config
+  Configuration files for the Rails environment, the routing map, the database,
+  and other dependencies.
+
+db
+  Contains the database schema in schema.rb. db/migrate contains all the
+  sequence of Migrations for your schema.
+
+doc
+  This directory is where your application documentation will be stored when
+  generated using <tt>rake doc:app</tt>
+
+lib
+  Application specific libraries. Basically, any kind of custom code that
+  doesn't belong under controllers, models, or helpers. This directory is in
+  the load path.
+
+public
+  The directory available for the web server. Also contains the dispatchers and the
+  default HTML files. This should be set as the DOCUMENT_ROOT of your web
+  server.
+
+script
+  Helper scripts for automation and generation.
+
+test
+  Unit and functional tests along with fixtures. When using the rails generate
+  command, template test files will be generated for you and placed in this
+  directory.
+
+vendor
+  External libraries that the application depends on. Also includes the plugins
+  subdirectory. If the app has frozen rails, those gems also go here, under
+  vendor/rails/. This directory is in the load path.

data/test/dummy/Rakefile

@@ -0,0 +1,7 @@
+#!/usr/bin/env rake
+# Add your own tasks in files placed in lib/tasks ending in .rake,
+# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
+
+require File.expand_path('../config/application', __FILE__)
+
+Dummy::Application.load_tasks

data/test/dummy/app/assets/javascripts/application.js

@@ -0,0 +1,15 @@
+// This is a manifest file that'll be compiled into application.js, which will include all the files
+// listed below.
+//
+// Any JavaScript/Coffee file within this directory, lib/assets/javascripts, vendor/assets/javascripts,
+// or vendor/assets/javascripts of plugins, if any, can be referenced here using a relative path.
+//
+// It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the
+// the compiled file.
+//
+// WARNING: THE FIRST BLANK LINE MARKS THE END OF WHAT'S TO BE PROCESSED, ANY BLANK LINE SHOULD
+// GO AFTER THE REQUIRES BELOW.
+//
+//= require jquery
+//= require jquery_ujs
+//= require_tree .

data/test/dummy/app/assets/stylesheets/application.css

@@ -0,0 +1,13 @@
+/*
+ * This is a manifest file that'll be compiled into application.css, which will include all the files
+ * listed below.
+ *
+ * Any CSS and SCSS file within this directory, lib/assets/stylesheets, vendor/assets/stylesheets,
+ * or vendor/assets/stylesheets of plugins, if any, can be referenced here using a relative path.
+ *
+ * You're free to add application-wide styles to this file and they'll appear at the top of the
+ * compiled file, but it's generally better to create a new file per style scope.
+ *
+ *= require_self
+ *= require_tree .
+*/

data/test/dummy/app/controllers/application_controller.rb

@@ -0,0 +1,4 @@
+class ApplicationController < ActionController::Base
+  protect_from_forgery
+  before_filter :authenticate_user!
+end

data/test/dummy/app/controllers/users_controller.rb

@@ -0,0 +1,2 @@
+class UsersController < InheritedResources::Base
+end

data/test/dummy/app/helpers/application_helper.rb

@@ -0,0 +1,2 @@
+module ApplicationHelper
+end

data/test/dummy/app/models/user.rb

@@ -0,0 +1,35 @@
+class User < ActiveRecord::Base
+  # Include default devise modules. Others available are:
+  # :token_authenticatable, :encryptable, :confirmable, :lockable, :timeoutable and :omniauthable
+  devise :database_authenticatable, :registerable,
+         :recoverable, :rememberable, :trackable, :validatable
+
+  # Setup accessible (or protected) attributes for your model
+  attr_accessible :email, :password, :password_confirmation, :remember_me, :roles
+  # attr_accessible :title, :body
+  
+  ROLES = %w(admin role-1 role-2 role-3)
+  
+  def self.create_oam_user(attributes)
+    user = User.new
+    user.email = attributes[:email]
+    user.roles = attributes[:roles] if attributes[:roles]
+    
+    user.save validate:false
+  end
+  
+  def roles=(roles)
+    self.roles_mask = (roles & ROLES).map { |r| 2**ROLES.index(r) }.sum
+  end
+
+  def roles
+    ROLES.reject do |r|
+      ((roles_mask || 0) & 2**ROLES.index(r)).zero?
+    end
+  end
+  
+  def update_roles(roles)
+    self.roles = roles
+    self.save validate:false
+  end
+end