global_session 3.2.4 → 3.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c7e181a406367d55cef38b2965dcfaa5d7f5a601
-  data.tar.gz: aded36bd963545b5930fdec586cf1ebf1824c1ac
+  metadata.gz: 4cf0f0c904f527bf182584e926bd80e8b98afcaa
+  data.tar.gz: eddd6c5e8c9fea9175dfeb3059737757196f5f76
 SHA512:
-  metadata.gz: 24a37d9464766407ad1150318c1cfc1e6c1fefd09023fb4c9433fda7ab68ba9f59ef10dd71f5fd23815cef17b0927ca4c913083c562039735e2ed9bd03eedf88
-  data.tar.gz: d33635ee36886e29d4422a0a3a1e48e5caf4977b08c10e7023b7de55815f87c06d7fb62a9bc92e9543879b2937e143ab2b5e3c700fdd4916cbd9d4990f252e1d
+  metadata.gz: 83c3cfd4461a9c17a30e4881cfe9bd33e0468de8410e38cb740e8a70e415c1aa382be43adf3650d33676cf45e04ec39b4ec3d7cc581d4ee262d1dcbd86334b73
+  data.tar.gz: 8fdba2a31e228e3eac3cf1dc72e39190a3e51089882523b5b2ef1949710c2807ede4fbc4714b6a1a6bfc2f28885ed138335ebce550ef6414c1fd50372bdba5a3

data/README.rdoc

@@ -1,5 +1,16 @@
 Copyright (c) 2009-2015 RightScale, Inc. <support@rightscale.com>; see LICENSE for more details.
 
+= Preamble
+
+<b>WARNING:</b> This RubyGem was authored in 2010 when Rails 2.1 was state of
+the art. Its Rails integration has not been kept up to date over time; it is
+untested with Rails 3, 4 and 5, and its generators are broken with Rails above
+2.3.5.
+
+We continue to support the Rack middleware and other components of this gem,
+and recommend using it as a plain old Rack middleware in your Rails apps.
+Instructions for doing so are provided in this README.
+
 = Introduction
 
 GlobalSession enables multiple heterogeneous Web applications to share
@@ -44,25 +55,81 @@ particular, it does not provide any of the following:
 
 = Examples
 
-== Integration with Rails
+== Make a YML configuration file
+
+The config file format is designed to be self-documenting. The most important
+data are: what data can be in your global session (`attributes`), what
+directory contains your `.pub` files with authorities' public keys (`keystore.public`),
+and the locatio nof `.key` private key file, if any, used by this app (`keystore.private`).
+
+You can omit `keystore.private` if the app should be able to read, but not
+write, global sessions.
+
+If you have asymmetrical trust (e.g. dev trusts production but not vice-versa),
+you can include an optional `trust` list. By default, every public key file is
+trusted.
+
+    common:
+      attributes:
+        signed:
+        - user
+        insecure:
+        - favorite_color
+      cookie:
+        name: global_session
+      keystore:
+        public: config/authorities
+      renew: 30
+      timeout: 60
+    development:
+      keystore:
+        private: config/authorities/dev
+    production:
+    trust:
+      - prod
+    keystore:
+      private: config/authorities/prod
 
-1) Create a basic config file and edit it to suit your needs:
-    $ script/generate global_session_config mycoolapp.com
+== Make a new keypair for a GlobalSession authority
 
-2) Create an authentication authority:
-    $ script/generate global_session_authority mycoolapp
+Decide on a name for your authority. The name is a short string that identifies
+a pair of key files on disk (one public, one private) which will be used to
+sign and verify sessions. If you have mutual trust between every app in your
+architecture, then you only need one authority and your domain name, e.g.
+`example-com`, is a fine choice of name. If you want partition trust within your
+architecture, then authorities could be named after environments
+(`staging`, `production`), regions (`us`, `eu`) or even specific apps
+(`frontend`, `api`) depending on where you draw the trust boundaries.
 
-3) Declare that some or all of your controllers will use the global session:
-    class ApplicationController < ActionController::Base
-      has_global_session
-    end
+Figure out where key files live in your application. This is whatever value
+you set in the `keystore: public: ...` directive in the configuration.
 
-4) Make use of the global session hash in your controllers:
-    global_session['user'] = @user.id
-    ...
-    @current_user = User.find(global_session['user'])
+If you have complete, mutual trust between all components of your architecture,
+then something based on your organization's domain name (e.g. `example-com`)
+is a fine choice.
 
-== Integration with Other Ruby Web Frameworks
+Open irb or your console of choice and require the `global_session` gem.
+
+    # default is RSA cryptosystem with 1024-bit keys.
+    keypair = GlobalSession::Keystore.create_keypair(:RSA, 1024)
+    public_pem  = keypair.public_key.to_pem
+    private_pem = keypair.to_pem
+
+    # write keys to disk
+    File.open('config/authorities/example-com.pub', 'w') { |f| f.write public_pem }
+    File.open('config/authorities/example-com.key', 'w') { |f| f.write private_pem }
+
+== Integration with Rails
+
+Install the GlobalSession middleware in your application startup. Open
+`environment.rb` or `application.rb` (depending on your Rails version) and
+add a new file to `config/initializers` to configure and install the
+middleware:
+
+    configuration = GlobalSession::Configuration.new('config/global_session.yml', Rails.env)
+    directory = GlobalSession::Directory.new(configuration)
+
+== Integration with Rack
 
 Install the GlobalSession middleware into your Rack stack; pass a config and a directory
 object to its initializer. For instance, in config.ru:
@@ -71,6 +138,12 @@ object to its initializer. For instance, in config.ru:
     directory = GlobalSession::Directory.new(configuration)
     use ::GlobalSession::Rack::Middleware, configuration, directory
 
+    Application.config.middleware.insert_before(Application.config.session_store, ::Rack::Cookies)
+    Application.config.middleware.insert_before(Application.config.session_store, ::Rack::GlobalSession, configuration, directory)
+
+Note that the GlobalSession middleware depends on `Rack::Cookies`; be sure
+to install them both, and in the proper order.
+
 = Global Session Contents
 
 Global session state is stored as a cookie in the user's browser and/or sent

data/VERSION

@@ -1 +1 @@
-3.2.4
+3.2.5

data/global_session.gemspec

@@ -2,16 +2,16 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: global_session 3.2.4 ruby lib
+# stub: global_session 3.2.5 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "global_session"
-  s.version = "3.2.4"
+  s.version = "3.2.5"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]
   s.authors = ["Tony Spataro"]
-  s.date = "2016-02-05"
+  s.date = "2016-04-07"
   s.description = "This Rack middleware allows several web apps in an authentication domain to share session state, facilitating single sign-on in a distributed web app. It only provides session sharing and does not concern itself with authentication or replication of the user database."
   s.email = "support@rightscale.com"
   s.extra_rdoc_files = [

data/lib/global_session/keystore.rb

@@ -62,6 +62,17 @@ module GlobalSession
       load
     end
 
+    # Factory method to generate a new keypair for use with GlobalSession.
+    #
+    # @raise [ArgumentError] if cryptosystem is unknown to OpenSSL
+    # @return [OpenSSL::PKey::PKey] a public/private keypair
+    def self.create_keypair(cryptosystem=:RSA, keysize=1024)
+      factory = OpenSSL::PKey.const_get(cryptosystem)
+      factory.generate( 1024 )
+    rescue NameError => e
+      raise ArgumentError, e.message
+    end
+
     private
 
     # Load all public and/or private keys from location(s) specified in the configuration's
@@ -136,4 +147,4 @@ module GlobalSession
       end
     end
   end
-end
+end

data/rails_generators/global_session_authority/global_session_authority_generator.rb

@@ -30,7 +30,7 @@ class GlobalSessionAuthorityGenerator < Rails::Generator::Base
 
   def manifest
     record do |m|
-      new_key     = OpenSSL::PKey::RSA.generate( 1024 )
+      new_key = GlobalSession::Keystore.create_keypair(:RSA, 1024)
       new_public  = new_key.public_key.to_pem
       new_private = new_key.to_pem
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: global_session
 version: !ruby/object:Gem::Version
-  version: 3.2.4
+  version: 3.2.5
 platform: ruby
 authors:
 - Tony Spataro
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-25 00:00:00.000000000 Z
+date: 2016-04-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json