kch-rubycas-server 0.8.0.20090715

data/config.ru

@@ -0,0 +1,38 @@
+# This is the Rackup initialization script for running RubyCAS-Server under Passenger/Rack.
+#
+# This file doesn't really have anything to do with your server's "configuration",
+# and you almost certainly don't need to modify it. Instead, a config file should
+# have been created for you (probably under /etc/rubycas-server/config.yml) -- this
+# is the file you'll want to modify. If for some reason the configuration file
+# was not created for you, have a look at the config.example.yml template and
+# go from there.
+
+require 'rubygems'
+require 'rack'
+
+$APP_NAME = 'rubycas-server'
+$APP_ROOT = File.dirname(File.expand_path(__FILE__))
+
+if File.exists?("#{$APP_ROOT}/tmp/debug.txt")
+  require 'ruby-debug'
+  Debugger.wait_connection = true
+  Debugger.start_remote
+end
+
+$: << $APP_ROOT + "/lib"
+
+require 'casserver/load_picnic'
+require 'picnic'
+require 'casserver'
+
+CASServer.create
+
+if $CONF.uri_path
+	map($CONF.uri_path) do
+    # FIXME: this probably isn't the smartest way of remapping the themes dir to uri_path/themes
+    use Rack::Static, $CONF[:static] if $CONF[:static]
+		run CASServer
+	end
+else
+	run CASServer
+end

data/config/hoe.rb

@@ -0,0 +1,78 @@
+require 'rubycas-server/version'
+
+AUTHOR = 'Matt Zukowski'  # can also be an array of Authors
+EMAIL = "matt@zukowski.ca"
+DESCRIPTION = "Provides single sign-on authentication for web applications using the CAS protocol."
+GEM_NAME = 'rubycas-server' # what ppl will type to install your gem
+RUBYFORGE_PROJECT = 'rubycas-server' # The unix name for your project
+HOMEPATH = "http://#{RUBYFORGE_PROJECT}.rubyforge.org"
+DOWNLOAD_PATH = "http://rubyforge.org/projects/#{RUBYFORGE_PROJECT}"
+EXTRA_DEPENDENCIES = [
+  'activesupport',
+  'activerecord',
+  'locale',
+  'gettext',
+  ['picnic', '>= 0.8.1']
+]    # An array of rubygem dependencies [name, version]
+
+@config_file = "~/.rubyforge/user-config.yml"
+@config = nil
+RUBYFORGE_USERNAME = "unknown"
+def rubyforge_username
+  unless @config
+    begin
+      @config = YAML.load(File.read(File.expand_path(@config_file)))
+    rescue
+      puts <<-EOS
+ERROR: No rubyforge config file found: #{@config_file}
+Run 'rubyforge setup' to prepare your env for access to Rubyforge
+ - See http://newgem.rubyforge.org/rubyforge.html for more details
+      EOS
+      exit
+    end
+  end
+  RUBYFORGE_USERNAME.replace @config["username"]
+end
+
+ENV['NODOT'] = '1'
+
+#REV = nil
+# UNCOMMENT IF REQUIRED:
+REV = Time.now.strftime('%Y%m%d%H%M')
+VERS = CASServer::VERSION::STRING + (REV ? ".#{REV}" : "")
+RDOC_OPTS = ['--quiet', '--title', 'rubycas-server documentation',
+    "--opname", "index.html",
+    "--line-numbers",
+    "--main", "README",
+    "--inline-source"]
+
+class Hoe
+  def extra_deps
+    @extra_deps.reject! { |x| Array(x).first == 'hoe' }
+    @extra_deps
+  end
+end
+
+# Generate all the Rake tasks
+# Run 'rake -T' to see list of generated tasks (from gem root directory)
+$hoe = Hoe.new(GEM_NAME, VERS) do |p|
+  p.developer(AUTHOR, EMAIL)
+  p.description = DESCRIPTION
+  p.summary = DESCRIPTION
+  p.url = HOMEPATH
+  p.rubyforge_name = RUBYFORGE_PROJECT if RUBYFORGE_PROJECT
+  p.test_globs = ["test/**/test_*.rb"]
+  p.clean_globs |= ['**/.*.sw?', '*.gem', '.config', '**/.DS_Store']  #An array of file patterns to delete on clean.
+
+  # == Optional
+  p.changes = p.paragraphs_of("History.txt", 0..1).join("\n\n")
+  p.extra_deps = EXTRA_DEPENDENCIES
+
+  p.spec_extras = {:executables => ['rubycas-server', 'rubycas-server-ctl']}    # A hash of extra values to set in the gemspec.
+end
+
+CHANGES = $hoe.paragraphs_of('History.txt', 0..1).join("\\n\\n")
+PATH    = (RUBYFORGE_PROJECT == GEM_NAME) ? RUBYFORGE_PROJECT : "#{RUBYFORGE_PROJECT}"
+$hoe.remote_rdoc_dir = File.join(PATH.gsub(/^#{RUBYFORGE_PROJECT}\/?/,''), 'rdoc')
+$hoe.rsync_args = '-av --delete --ignore-errors'
+$hoe.spec.post_install_message = File.open(File.dirname(__FILE__) + "/../PostInstall.txt").read rescue ""

data/config/requirements.rb

@@ -0,0 +1,15 @@
+require 'fileutils'
+include FileUtils
+
+require 'rubygems'
+%w[rake hoe newgem rubigen].each do |req_gem|
+  begin
+    require req_gem
+  rescue LoadError
+    puts "This Rakefile requires the '#{req_gem}' RubyGem."
+    puts "Installation: gem install #{req_gem} -y"
+    exit
+  end
+end
+
+$:.unshift(File.join(File.dirname(__FILE__), %w[.. lib]))

data/custom_views.example.rb

@@ -0,0 +1,11 @@
+# Custom views file; add methods to the module definition below
+
+module CASServer::Views
+
+  # Override views here, for example, a custom login form:
+  def login_form
+    # Add your custom login form here, using Markaby
+    # See the original views.rb file at lib/casserver/views.rb for method names and usage
+  end
+
+end

data/lib/casserver.rb

@@ -0,0 +1,58 @@
+unless Object.const_defined?(:Picnic)
+  $APP_NAME ||= 'rubycas-server'
+  $APP_ROOT ||= File.expand_path(File.dirname(__FILE__)+'/..')
+
+  require 'casserver/load_picnic'
+end
+
+require 'yaml'
+require 'markaby'
+
+require "casserver/conf"
+require "picnic/logger"
+
+$: << File.dirname(File.expand_path(__FILE__))
+
+$: << File.expand_path("#{File.dirname(__FILE__)}/../vendor/isaac_0.9.1")
+require 'crypt/ISAAC'
+
+Camping.goes :CASServer
+
+Picnic::Logger.init_global_logger!
+
+require "casserver/utils"
+require "casserver/models"
+require "casserver/cas"
+require "casserver/views"
+require "casserver/controllers"
+require "casserver/localization"
+
+def CASServer.create
+  $LOG.info "Creating RubyCAS-Server with pid #{Process.pid}."
+
+
+  CASServer::Models::Base.establish_connection($CONF.database)
+  CASServer::Models.create_schema
+
+  #TODO: these warnings should eventually be deleted
+  if $CONF.service_ticket_expiry
+    $LOG.warn "The 'service_ticket_expiry' option has been renamed to 'maximum_unused_service_ticket_lifetime'. Please make the necessary change to your config file!"
+    $CONF.maximum_unused_service_ticket_lifetime ||= $CONF.service_ticket_expiry
+  end
+  if $CONF.login_ticket_expiry
+    $LOG.warn "The 'login_ticket_expiry' option has been renamed to 'maximum_unused_login_ticket_lifetime'. Please make the necessary change to your config file!"
+    $CONF.maximum_unused_login_ticket_lifetime ||= $CONF.login_ticket_expiry
+  end
+  if $CONF.ticket_granting_ticket_expiry || $CONF.proxy_granting_ticket_expiry
+    $LOG.warn "The 'ticket_granting_ticket_expiry' and 'proxy_granting_ticket_expiry' options have been renamed to 'maximum_session_lifetime'. Please make the necessary change to your config file!"
+    $CONF.maximum_session_lifetime ||= $CONF.ticket_granting_ticket_expiry || $CONF.proxy_granting_ticket_expiry
+  end
+
+  if $CONF.maximum_session_lifetime
+    CASServer::Models::ServiceTicket.cleanup($CONF.maximum_session_lifetime, $CONF.maximum_unused_service_ticket_lifetime)
+    CASServer::Models::LoginTicket.cleanup($CONF.maximum_session_lifetime, $CONF.maximum_unused_login_ticket_lifetime)
+    CASServer::Models::ProxyGrantingTicket.cleanup($CONF.maximum_session_lifetime)
+    CASServer::Models::TicketGrantingTicket.cleanup($CONF.maximum_session_lifetime)
+  end
+end
+

data/lib/casserver/authenticators/active_directory_ldap.rb

@@ -0,0 +1,11 @@
+require 'casserver/authenticators/ldap'
+
+# Slightly modified version of the LDAP authenticator for Microsoft's ActiveDirectory.
+# The only difference is that the default_username_attribute for AD is 'sAMAccountName'
+# rather than 'uid'.
+class CASServer::Authenticators::ActiveDirectoryLDAP < CASServer::Authenticators::LDAP
+  protected
+  def default_username_attribute
+    "sAMAccountName"
+  end
+end

data/lib/casserver/authenticators/base.rb

@@ -0,0 +1,48 @@
+module CASServer
+  module Authenticators
+    class Base
+      attr_accessor :options
+      attr_reader :username # make this accessible so that we can pick up any 
+                            # transformations done within the authenticator
+    
+      def validate(credentials)
+        raise NotImplementedError, "This method must be implemented by a class extending #{self.class}"
+      end
+      
+      def configure(options)
+        raise ArgumentError, "options must be a HashWithIndifferentAccess" unless options.kind_of? HashWithIndifferentAccess
+        @options = options.dup
+        @extra_attributes = {}
+      end
+      
+      def extra_attributes
+        @extra_attributes
+      end
+      
+      protected
+      def read_standard_credentials(credentials)
+        @username = credentials[:username]
+        @password = credentials[:password]
+        @service = credentials[:service]
+        @request = credentials[:request]
+      end
+      
+      def extra_attributes_to_extract
+        if @options[:extra_attributes].kind_of? Array
+          attrs = @options[:extra_attributes]
+        elsif @options[:extra_attributes].kind_of? String
+          attrs = @options[:extra_attributes].split(',').collect{|col| col.strip}
+        else
+          $LOG.error("Can't figure out attribute list from #{@options[:extra_attributes].inspect}. This must be an Aarray of column names or a comma-separated list.")
+          attrs = []
+        end
+        
+        $LOG.debug("#{self.class.name} will try to extract the following extra_attributes: #{attrs.inspect}")
+        return attrs
+      end
+    end
+  end
+  
+  class AuthenticatorError < Exception
+  end
+end

data/lib/casserver/authenticators/client_certificate.rb

@@ -0,0 +1,46 @@
+require 'casserver/authenticators/base'
+
+# NOT YET IMPLEMENTED
+#
+# This authenticator will authenticate the user based on a client SSL certificate.
+#
+# You will probably want to use this along with another authenticator, chaining
+# it so that if the client does not provide a certificate, the server can
+# fall back to some other authentication mechanism.
+#
+# Here's an example of how to use two chained authenticators in the config.yml
+# file. The server will first use the ClientCertificate authenticator, and 
+# only fall back to the SQL authenticator of the first one fails:
+#
+# authenticator:
+#  -
+#    class: CASServer::Authenticators::ClientCertificate
+#  -
+#    class: CASServer::Authenticators::SQL
+#    database:
+#      adapter: mysql
+#      database: some_database_with_users_table
+#      user: root
+#      password:
+#      server: localhost
+#    user_table: user
+#    username_column: username
+#    password_column: password
+#
+class CASServer::Authenticators::ClientCertificate < CASServer::Authenticators::Base
+  def validate(credentials)
+    read_standard_credentials(credentials)
+    
+    @client_cert = credentials[:request]['SSL_CLIENT_CERT']
+    
+    # note that I haven't actually tested to see if SSL_CLIENT_CERT gets
+    # filled with data when a client cert is provided, but this should be
+    # the case at least in theory :)
+    
+    return false if @client_cert.blank?
+    
+    # IMPLEMENT SSL CERTIFICATE VALIDATION CODE HERE
+    
+    return true # if SSL certificate is valid, false otherwise
+  end
+end

data/lib/casserver/authenticators/google.rb

@@ -0,0 +1,54 @@
+require 'casserver/authenticators/base'
+require 'uri'
+require 'net/http'
+require 'net/https'
+require 'timeout'
+
+# Validates Google accounts against Google's authentication service -- in other 
+# words, this authenticator allows users to log in to CAS using their
+# Gmail/Google accounts.
+class CASServer::Authenticators::Google < CASServer::Authenticators::Base
+  def validate(credentials)
+    read_standard_credentials(credentials)
+
+    return false if @username.blank? || @password.blank?
+   
+    auth_data = {
+      'Email'   => @username, 
+      'Passwd'  => @password, 
+      'service' => 'xapi', 
+      'source'  => 'RubyCAS-Server',
+      'accountType' => 'HOSTED_OR_GOOGLE'
+    }
+   
+    url = URI.parse('https://www.google.com/accounts/ClientLogin')
+    http = Net::HTTP.new(url.host, url.port)
+    http.use_ssl = true
+    
+    # TODO: make the timeout configurable
+    wait_seconds = 10
+    begin
+      timeout(wait_seconds) do
+        res = http.start do |conn|
+          req = Net::HTTP::Post.new(url.path)
+          req.set_form_data(auth_data,'&')
+          conn.request(req)
+        end
+        
+        case res
+        when Net::HTTPSuccess
+          true
+        when Net::HTTPForbidden
+          false
+        else
+          $LOG.error("Unexpected response from Google while validating credentials: #{res.inspect} ==> #{res.body}.")
+          raise CASServer::AuthenticatorError, "Unexpected response received from Google while validating credentials."
+        end
+      end
+    rescue Timeout::Error
+      $LOG.error("Google did not respond to the credential validation request. We waited for #{wait_seconds.inspect} seconds before giving up.")
+      raise CASServer::AuthenticatorError, "Timeout while waiting for Google to validate credentials."
+    end
+
+  end
+end

data/lib/casserver/authenticators/ldap.rb

@@ -0,0 +1,147 @@
+require 'casserver/authenticators/base'
+
+begin
+  require 'net/ldap'
+rescue LoadError
+  require 'rubygems'
+  begin
+    gem 'ruby-net-ldap', '~> 0.0.4'
+  rescue Gem::LoadError
+    $stderr.puts
+    $stderr.puts "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+    $stderr.puts
+    $stderr.puts "To use the LDAP/AD authenticator, you must first install the 'ruby-net-ldap' gem."
+    $stderr.puts
+    $stderr.puts "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+    exit 1
+  end
+  require 'net/ldap'
+end
+
+# Basic LDAP authenticator. Should be compatible with OpenLDAP and other similar LDAP servers,
+# although it hasn't been officially tested. See example config file for details on how
+# to configure it.
+class CASServer::Authenticators::LDAP < CASServer::Authenticators::Base
+  def validate(credentials)
+    read_standard_credentials(credentials)
+
+    return false if @password.blank?
+   
+    raise CASServer::AuthenticatorError, "Cannot validate credentials because the authenticator hasn't yet been configured" unless @options
+    raise CASServer::AuthenticatorError, "Invalid LDAP authenticator configuration!" unless @options[:ldap]
+    raise CASServer::AuthenticatorError, "You must specify a server host in the LDAP configuration!" unless @options[:ldap][:host] || @options[:ldap][:server]
+        
+    raise CASServer::AuthenticatorError, "The username '#{@username}' contains invalid characters." if (@username =~ /[*\(\)\0\/]/)
+    
+    preprocess_username
+    
+    @ldap = Net::LDAP.new
+    
+    
+    @options[:ldap][:host] ||= @options[:ldap][:server]
+    @ldap.host = @options[:ldap][:host]
+    @ldap.port = @options[:ldap][:port] if @options[:ldap][:port]
+    @ldap.encryption(@options[:ldap][:encryption].intern) if @options[:ldap][:encryption]
+    
+    begin
+      if @options[:ldap][:auth_user]
+        bind_success = bind_by_username_with_preauthentication
+      else
+        bind_success = bind_by_username
+      end
+      
+      return false unless bind_success
+      
+      entry = find_user
+      extract_extra_attributes(entry)
+      
+      return true
+    rescue Net::LDAP::LdapError => e
+      raise CASServer::AuthenticatorError,
+        "LDAP authentication failed with '#{e}'. Check your authenticator configuration."
+    end
+  end
+  
+  protected
+    def default_username_attribute
+      "cn"
+    end
+  
+  private
+    # Add prefix to username, if :username_prefix was specified in the :ldap config.
+    def preprocess_username
+      @username = @options[:ldap][:username_prefix] + @username if @options[:ldap][:username_prefix]
+    end
+
+    # Attempt to bind with the LDAP server using the username and password entered by
+    # the user. If a :filter was specified in the :ldap config, the filter will be
+    # added to the LDAP query for the username.
+    def bind_by_username
+      username_attribute = options[:ldap][:username_attribute] || default_username_attribute
+      
+      @ldap.bind_as(:base => @options[:ldap][:base], :password => @password, :filter => user_filter)
+    end
+
+    # If an auth_user is specified, we will connect ("pre-authenticate") with the
+    # LDAP server using the authenticator account, and then attempt to bind as the
+    # user who is actually trying to authenticate. Note that you need to set up 
+    # the special authenticator account first. Also, auth_user must be the authenticator
+    # user's full CN, which is probably not the same as their username.
+    #
+    # This pre-authentication process is necessary because binding can only be done
+    # using the CN, so having just the username is not enough. We connect as auth_user, 
+    # and then try to find the target user's CN based on the given username. Then we bind
+    # as the target user to validate their credentials.
+    def bind_by_username_with_preauthentication
+      raise CASServer::AuthenticatorError, "A password must be specified in the configuration for the authenticator user!" unless 
+        @options[:ldap][:auth_password]
+      
+      @ldap.authenticate(@options[:ldap][:auth_user], @options[:ldap][:auth_password])
+      
+      @ldap.bind_as(:base => @options[:ldap][:base], :password => @password, :filter => user_filter)
+    end
+  
+    # Combine the filter for finding the user with the optional extra filter specified in the config
+    # (if any).
+    def user_filter
+      username_attribute = options[:ldap][:username_attribute] || default_username_attribute
+      
+      filter = Net::LDAP::Filter.eq(username_attribute, @username)
+      unless @options[:ldap][:filter].blank?
+        filter &= Net::LDAP::Filter.construct(@options[:ldap][:filter])
+      end
+
+      filter
+    end
+  
+    # Finds the user based on the user_filter (this is called after authentication).
+    # We do this to make it possible to extract extra_attributes.
+    def find_user
+      results = @ldap.search( :base => options[:ldap][:base], :filter => user_filter)
+      return results.first
+    end
+  
+    def extract_extra_attributes(ldap_entry)
+      @extra_attributes = {}
+      extra_attributes_to_extract.each do |attr|
+        v = !ldap_entry[attr].blank? && ldap_entry[attr].first
+        if v
+          if ldap_entry[attr].kind_of?(Array)
+             @extra_attributes[attr] = []
+             ldap_entry[attr].each do |a|
+               @extra_attributes[attr] << a
+             end
+          else
+            @extra_attributes[attr] = v.to_s
+          end
+        end
+      end
+      
+      if @extra_attributes.empty?
+        $LOG.warn("#{self.class}: Did not read any extra_attributes for user #{@username.inspect} even though an :extra_attributes option was provided.")
+      else
+        $LOG.debug("#{self.class}: Read the following extra_attributes for user #{@username.inspect}: #{@extra_attributes.inspect}")
+      end
+      ldap_entry
+    end
+end