gunark-rubycas-server 0.8.0.20090715 → 0.8.0.20090812

data/History.txt

@@ -15,6 +15,7 @@
   * Failure to connect to a service during a single sign out request is now
     handled gracefully.
   * Required gem dependencies have been re-enabled in the gemspec.
+  * Authlogic authenticator files added to gemspec. [rajiv]
 
 === 0.7.1 :: 2008-11-10
 

data/Rakefile

@@ -1,4 +1,115 @@
 require 'config/requirements'
 require 'config/hoe' # setup Hoe + all gem configuration
 
-Dir['tasks/**/*.rake'].each { |rake| load rake }
+Dir['tasks/**/*.rake'].each { |rake| load rake }
+
+desc "generate a self signed SSL certificate (in order to get going easily)"
+task :generate_ssl_certificate do
+  `mkdir -p ssl/newcerts ssl/private`
+  File.open("ssl/openssl.cnf", "w") do |f|
+    f.write <<-EOF
+    #
+    # OpenSSL configuration file.
+    #
+
+    # Establish working directory.
+
+    dir			= .
+
+    [ ca ]
+    default_ca		= CA_default
+
+    [ CA_default ]
+    serial			= $dir/serial
+    database		= $dir/index.txt
+    new_certs_dir		= $dir/newcerts
+    certificate		= $dir/cacert.pem
+    private_key		= $dir/private/cakey.pem
+    default_days		= 365
+    default_md		= md5
+    preserve		= no
+    email_in_dn		= no
+    nameopt			= default_ca
+    certopt			= default_ca
+    policy			= policy_match
+
+    [ policy_match ]
+    countryName		= match
+    stateOrProvinceName	= match
+    organizationName	= match
+    organizationalUnitName	= optional
+    commonName		= supplied
+    emailAddress		= optional
+
+    [ req ]
+    default_bits		= 1024			# Size of keys
+    default_keyfile		= key.pem		# name of generated keys
+    default_md		= md5			# message digest algorithm
+    string_mask		= nombstr		# permitted characters
+    distinguished_name	= req_distinguished_name
+    req_extensions		= v3_req
+
+    [ req_distinguished_name ]
+    # Variable name		  Prompt string
+    #----------------------	  ----------------------------------
+    0.organizationName	= Organization Name (company)
+    organizationalUnitName	= Organizational Unit Name (department, division)
+    emailAddress		= Email Address
+    emailAddress_max	= 40
+    localityName		= Locality Name (city, district)
+    stateOrProvinceName	= State or Province Name (full name)
+    countryName		= Country Name (2 letter code)
+    countryName_min		= 2
+    countryName_max		= 2
+    commonName		= Common Name (hostname, IP, or your name)
+    commonName_max		= 64
+
+    # Default values for the above, for consistency and less typing.
+    # Variable name			  Value
+    #------------------------------	  ------------------------------
+    0.organizationName_default	= The Sample Company
+    localityName_default		= Metropolis
+    stateOrProvinceName_default	= New York
+    countryName_default		= US
+    commonName_default		= localhost
+
+    [ v3_ca ]
+    basicConstraints	= CA:TRUE
+    subjectKeyIdentifier	= hash
+    authorityKeyIdentifier	= keyid:always,issuer:always
+
+    [ v3_req ]
+    basicConstraints	= CA:FALSE
+    subjectKeyIdentifier	= hash
+    EOF
+  end
+
+  `cd ssl && echo '01' > serial`
+  `cd ssl && touch index.txt`
+
+  puts
+  puts "When asked for a passphrase enter one, for example rubycas"
+  puts
+
+  `cd ssl && openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 365 -config ./openssl.cnf`
+  `cd ssl && openssl req -new -nodes -out req.pem -config ./openssl.cnf`
+  `cd ssl && openssl ca -out cert.pem -config ./openssl.cnf -infiles req.pem`
+
+
+
+
+  puts
+  puts "If you are using Firefox and want to access the CAS server through localhost you need to add an exception:"
+  puts " 1. Go to Preferences > Advanced > Encryption > View Certificates"
+  puts " 2. Click the Tab Servers"
+  puts " 3. Click the Button Add Exception"
+  puts " 4. Enter https://localhost:<port> into the textfield and press Get Certificate"
+  puts " 5. Then press View"
+  puts " 6. Then press Confirm Security Exception"
+
+end
+
+desc "clear all generated files for SSL certificate"
+task :clear_ssl_certificate do
+  `rm -rf ssl`
+end

data/config.example.yml

@@ -32,10 +32,17 @@ server: webrick
 port: 443
 ssl_cert: /path/to/your/ssl.pem
 
-# If your private key is separate from cert
+# If your private key is in a separate file from the cert
 
 #ssl_key: /path/to/your/private_key.pem
 
+# If you do not already have an SSL certificate and would like to automatically
+# generate one, run the "generate_ssl_certificate" rake task and use the following 
+# settings:
+
+#  ssl_cert: ssl/cert.pem
+#  ssl_key: ssl/key.pem
+
 
 # By default the login page will be available at the root path 
 # (e.g. https://login.example.net/). The uri_path option lets you serve it from a 

data/lib/casserver/authenticators/authlogic_crypto_providers/aes256.rb

@@ -0,0 +1,43 @@
+require "openssl"
+
+module Authlogic
+  module CryptoProviders
+    # This encryption method is reversible if you have the supplied key. So in order to use this encryption method you must supply it with a key first.
+    # In an initializer, or before your application initializes, you should do the following:
+    #
+    #   Authlogic::CryptoProviders::AES256.key = "my really long and unique key, preferrably a bunch of random characters"
+    #
+    # My final comment is that this is a strong encryption method, but its main weakness is that its reversible. If you do not need to reverse the hash
+    # then you should consider Sha512 or BCrypt instead.
+    #
+    # Keep your key in a safe place, some even say the key should be stored on a separate server.
+    # This won't hurt performance because the only time it will try and access the key on the separate server is during initialization, which only
+    # happens once. The reasoning behind this is if someone does compromise your server they won't have the key also. Basically, you don't want to
+    # store the key with the lock.
+    class AES256
+      class << self
+        attr_writer :key
+    
+        def encrypt(*tokens)
+          aes.encrypt
+          aes.key = @key
+          [aes.update(tokens.join) + aes.final].pack("m").chomp
+        end
+    
+        def matches?(crypted, *tokens)
+          aes.decrypt
+          aes.key = @key
+          (aes.update(crypted.unpack("m").first) + aes.final) == tokens.join
+        rescue OpenSSL::CipherError
+          false
+        end
+    
+        private
+          def aes
+            raise ArgumentError.new("You must provide a key like #{name}.key = my_key before using the #{name}") if @key.blank?
+            @aes ||= OpenSSL::Cipher::Cipher.new("AES-256-ECB")
+          end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/bcrypt.rb

@@ -0,0 +1,92 @@
+begin
+  require "bcrypt"
+rescue LoadError
+end
+
+module Authlogic
+  module CryptoProviders
+    # For most apps Sha512 is plenty secure, but if you are building an app that stores nuclear launch codes you might want to consier BCrypt. This is an extremely
+    # secure hashing algorithm, mainly because it is slow. A brute force attack on a BCrypt encrypted password would take much longer than a brute force attack on a
+    # password encrypted with a Sha algorithm. Keep in mind you are sacrificing performance by using this, generating a password takes exponentially longer than any
+    # of the Sha algorithms. I did some benchmarking to save you some time with your decision:
+    #
+    #   require "bcrypt"
+    #   require "digest"
+    #   require "benchmark"
+    #
+    #   Benchmark.bm(18) do |x|
+    #     x.report("BCrypt (cost = 10:") { 100.times { BCrypt::Password.create("mypass", :cost => 10) } }
+    #     x.report("BCrypt (cost = 2:") { 100.times { BCrypt::Password.create("mypass", :cost => 2) } }
+    #     x.report("Sha512:") { 100.times { Digest::SHA512.hexdigest("mypass") } }
+    #     x.report("Sha1:") { 100.times { Digest::SHA1.hexdigest("mypass") } }
+    #   end
+    #
+    #                           user     system      total        real
+    #   BCrypt (cost = 10): 10.780000   0.060000  10.840000 ( 11.100289)
+    #   BCrypt (cost = 2):  0.180000   0.000000   0.180000 (  0.181914)
+    #   Sha512:             0.000000   0.000000   0.000000 (  0.000829)
+    #   Sha1:               0.000000   0.000000   0.000000 (  0.000395)
+    #
+    # You can play around with the cost to get that perfect balance between performance and security.
+    #
+    # Decided BCrypt is for you? Just insall the bcrypt gem:
+    #
+    #   gem install bcrypt-ruby
+    #
+    # Tell acts_as_authentic to use it:
+    #
+    #   acts_as_authentic do |c|
+    #     c.crypto_provider = Authlogic::CryptoProviders::BCrypt
+    #   end
+    #
+    # You are good to go!
+    class BCrypt
+      class << self
+        # This is the :cost option for the BCrpyt library. The higher the cost the more secure it is and the longer is take the generate a hash. By default this is 10.
+        # Set this to whatever you want, play around with it to get that perfect balance between security and performance.
+        def cost
+          @cost ||= 10
+        end
+        attr_writer :cost
+        
+        # Creates a BCrypt hash for the password passed.
+        def encrypt(*tokens)
+          ::BCrypt::Password.create(join_tokens(tokens), :cost => cost)
+        end
+        
+        # Does the hash match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(hash, *tokens)
+          $LOG.debug hash
+          $LOG.debug tokens.inspect
+
+          hash = new_from_hash(hash)
+          return false if hash.blank?
+          hash == join_tokens(tokens)
+        end
+        
+        # This method is used as a flag to tell Authlogic to "resave" the password upon a successful login, using the new cost
+        def cost_matches?(hash)
+          hash = new_from_hash(hash)
+          if hash.blank?
+            false
+          else
+            hash.cost == cost
+          end
+        end
+        
+        private
+          def join_tokens(tokens)
+            tokens.flatten.join
+          end
+          
+          def new_from_hash(hash)
+            begin
+              ::BCrypt::Password.new(hash)
+            rescue ::BCrypt::Errors::InvalidHash
+              return nil
+            end
+          end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/md5.rb

@@ -0,0 +1,34 @@
+require "digest/md5"
+ 
+module Authlogic
+  module CryptoProviders
+    # This class was made for the users transitioning from md5 based systems. 
+    # I highly discourage using this crypto provider as it superbly inferior 
+    # to your other options.
+    #
+    # Please use any other provider offered by Authlogic.
+    class MD5
+      class << self
+        attr_accessor :join_token
+        
+        # The number of times to loop through the encryption.
+        def stretches
+          @stretches ||= 1
+        end
+        attr_writer :stretches
+        
+        # Turns your raw password into a MD5 hash.
+        def encrypt(*tokens)
+          digest = tokens.flatten.join(join_token)
+          stretches.times { digest = Digest::MD5.hexdigest(digest) }
+          digest
+        end
+        
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/sha1.rb

@@ -0,0 +1,35 @@
+require "digest/sha1"
+
+module Authlogic
+  module CryptoProviders
+    # This class was made for the users transitioning from restful_authentication. I highly discourage using this
+    # crypto provider as it inferior to your other options. Please use any other provider offered by Authlogic.
+    class Sha1
+      class << self
+        def join_token
+          @join_token ||= "--"
+        end
+        attr_writer :join_token
+        
+        # The number of times to loop through the encryption. This is ten because that is what restful_authentication defaults to.
+        def stretches
+          @stretches ||= 10
+        end
+        attr_writer :stretches
+        
+        # Turns your raw password into a Sha1 hash.
+        def encrypt(*tokens)
+          tokens = tokens.flatten
+          digest = tokens.shift
+          stretches.times { digest = Digest::SHA1.hexdigest([digest, *tokens].join(join_token)) }
+          digest
+        end
+        
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/sha512.rb

@@ -0,0 +1,50 @@
+require "digest/sha2"
+
+module Authlogic
+  # The acts_as_authentic method has a crypto_provider option. This allows you to use any type of encryption you like.
+  # Just create a class with a class level encrypt and matches? method. See example below.
+  #
+  # === Example
+  #
+  #   class MyAwesomeEncryptionMethod
+  #     def self.encrypt(*tokens)
+  #       # the tokens passed will be an array of objects, what type of object is irrelevant,
+  #       # just do what you need to do with them and return a single encrypted string.
+  #       # for example, you will most likely join all of the objects into a single string and then encrypt that string
+  #     end
+  #
+  #     def self.matches?(crypted, *tokens)
+  #       # return true if the crypted string matches the tokens.
+  #       # depending on your algorithm you might decrypt the string then compare it to the token, or you might
+  #       # encrypt the tokens and make sure it matches the crypted string, its up to you
+  #     end
+  #   end
+  module CryptoProviders
+    # = Sha512
+    #
+    # Uses the Sha512 hash algorithm to encrypt passwords.
+    class Sha512
+      class << self
+        attr_accessor :join_token
+        
+        # The number of times to loop through the encryption. This is ten because that is what restful_authentication defaults to.
+        def stretches
+          @stretches ||= 20
+        end
+        attr_writer :stretches
+        
+        # Turns your raw password into a Sha512 hash.
+        def encrypt(*tokens)
+          digest = tokens.flatten.join(join_token)
+          stretches.times { digest = Digest::SHA512.hexdigest(digest) }
+          digest
+        end
+        
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/sql_authlogic.rb

@@ -0,0 +1,97 @@
+require 'casserver/authenticators/base'
+
+# These were pulled directly from Authlogic, and new ones can be added
+# just by including new Crypto Providers
+require File.dirname(__FILE__) + '/authlogic_crypto_providers/aes256'
+require File.dirname(__FILE__) + '/authlogic_crypto_providers/bcrypt'
+require File.dirname(__FILE__) + '/authlogic_crypto_providers/md5'
+require File.dirname(__FILE__) + '/authlogic_crypto_providers/sha1'
+require File.dirname(__FILE__) + '/authlogic_crypto_providers/sha512'
+
+begin
+  require 'active_record'
+rescue LoadError
+  require 'rubygems'
+  require 'active_record'
+end
+
+# This is a version of the SQL authenticator that works nicely with Authlogic. 
+# Passwords are encrypted the same way as it done in Authlogic. 
+# Before use you this, you MUST configure rest_auth_digest_streches and rest_auth_site_key in 
+# config. 
+#
+# Using this authenticator requires restful authentication plugin on rails (client) side.
+#
+# * git://github.com/binarylogic/authlogic.git
+# 
+# Usage:
+
+# authenticator:
+#   class: CASServer::Authenticators::SQLAuthlogic
+#   database:
+#     adapter: mysql
+#     database: some_database_with_users_table
+#     user: root
+#     password:
+#     server: localhost
+#   user_table: user
+#   username_column: login
+#   password_column: crypted_password
+#   salt_column: password_salt
+#   encryptor: BCrypt
+#
+class CASServer::Authenticators::SQLAuthlogic < CASServer::Authenticators::Base
+
+  def validate(credentials)
+    read_standard_credentials(credentials)
+    
+    raise CASServer::AuthenticatorError, "Cannot validate credentials because the authenticator hasn't yet been configured" unless @options
+    raise CASServer::AuthenticatorError, "Invalid authenticator configuration!" unless @options[:database]
+    
+    CASUser.establish_connection @options[:database]
+    CASUser.set_table_name @options[:user_table] || "users"
+    
+    username_column = @options[:username_column] || "login"
+    password_column = @options[:password_column] || "crypted_password"
+    salt_column = @options[:salt_column]
+    results = CASUser.find(:all, :conditions => ["#{username_column} = ?", @username])
+
+    begin
+      encryptor = eval("Authlogic::CryptoProviders::" + @options[:encryptor] || "Sha512")
+    rescue
+      encryptor = Authlogic::CryptoProviders::Sha512
+    end
+
+    if results.size > 0
+      $LOG.warn("Multiple matches found for user '#{@username}'") if results.size > 1
+      user = results.first
+      tokens = [@password, (not salt_column.nil?) && user.send(salt_column) || nil].compact
+      crypted = user.send(password_column)
+
+      unless @options[:extra_attributes].blank?
+        if results.size > 1
+          $LOG.warn("#{self.class}: Unable to extract extra_attributes because multiple matches were found for #{@username.inspect}")
+        else
+          
+          @extra_attributes = {}
+          extra_attributes_to_extract.each do |col|
+            @extra_attributes[col] = user.send(col)
+          end
+          
+          if @extra_attributes.empty?
+            $LOG.warn("#{self.class}: Did not read any extra_attributes for user #{@username.inspect} even though an :extra_attributes option was provided.")
+          else
+            $LOG.debug("#{self.class}: Read the following extra_attributes for user #{@username.inspect}: #{@extra_attributes.inspect}")
+          end
+        end
+      end
+
+      return encryptor.matches?(crypted, tokens)
+    else
+      return false
+    end
+  end
+
+  class CASUser < ActiveRecord::Base
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: gunark-rubycas-server
 version: !ruby/object:Gem::Version 
-  version: 0.8.0.20090715
+  version: 0.8.0.20090812
 platform: ruby
 authors: 
 - Matt Zukowski
@@ -94,6 +94,11 @@ files:
 - custom_views.example.rb
 - lib/casserver.rb
 - lib/casserver/authenticators/active_directory_ldap.rb
+- lib/casserver/authenticators/authlogic_crypto_providers/aes256.rb
+- lib/casserver/authenticators/authlogic_crypto_providers/bcrypt.rb
+- lib/casserver/authenticators/authlogic_crypto_providers/md5.rb
+- lib/casserver/authenticators/authlogic_crypto_providers/sha1.rb
+- lib/casserver/authenticators/authlogic_crypto_providers/sha512.rb
 - lib/casserver/authenticators/base.rb
 - lib/casserver/authenticators/client_certificate.rb
 - lib/casserver/authenticators/google.rb
@@ -101,6 +106,7 @@ files:
 - lib/casserver/authenticators/ntlm.rb
 - lib/casserver/authenticators/open_id.rb
 - lib/casserver/authenticators/sql.rb
+- lib/casserver/authenticators/sql_authlogic.rb
 - lib/casserver/authenticators/sql_encrypted.rb
 - lib/casserver/authenticators/sql_md5.rb
 - lib/casserver/authenticators/sql_rest_auth.rb
@@ -157,6 +163,7 @@ files:
 - vendor/isaac_0.9.1/test/TC_ISAAC.rb
 has_rdoc: true
 homepage: http://rubycas-server.rubyforge.org
+licenses: 
 post_install_message: |+
   
   For more information on RubyCAS-Server, see http://code.google.com/p/rubycas-server
@@ -185,7 +192,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: rubycas-server
-rubygems_version: 1.2.0
+rubygems_version: 1.3.5
 signing_key: 
 specification_version: 2
 summary: Provides single sign-on authentication for web applications using the CAS protocol.