omniauth-discourse 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 4f61a5877fb60d7830421987d8f197ae16d975af
+  data.tar.gz: 9e9c4dd107e329bacf9038e1be00f611d2639fb4
+SHA512:
+  metadata.gz: eeb010c4df0d42a400baaee162e52efaa111564c4dcbc4767d6dbf4dd6e61c2c4a87b315bd0675a49a38f5294987da4043bf20c7489dc4dd7fe8b57fa085758f
+  data.tar.gz: 39c5aae8a5e8d070fb0a439c9ae18159cee26b7e6d7a62ca503ae532b9a5d02d62854d3dba01321be6c29411609cf3ad2bfa5fe82da258d04af3023a86e662a7

data/.gitignore

@@ -0,0 +1,17 @@
+*.gem
+*.rbc
+.bundle
+.config
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp

data/.rubocop.yml

@@ -0,0 +1,52 @@
+Metrics/AbcSize:
+  Enabled: false
+
+Metrics/BlockNesting:
+  Max: 2
+
+Metrics/LineLength:
+  AllowURI: true
+  Enabled: false
+
+Metrics/MethodLength:
+  CountComments: false
+  Max: 10
+
+Metrics/ParameterLists:
+  Max: 4
+  CountKeywordArgs: true
+
+Style/AccessModifierIndentation:
+  EnforcedStyle: outdent
+
+Style/CollectionMethods:
+  PreferredMethods:
+    map:      'collect'
+    reduce:   'inject'
+    find:     'detect'
+    find_all: 'select'
+
+Style/Documentation:
+  Enabled: false
+
+Style/DotPosition:
+  EnforcedStyle: trailing
+
+Style/DoubleNegation:
+  Enabled: false
+
+Style/FileName:
+  Exclude:
+    - 'lib/omniauth-oauth.rb'
+
+Style/HashSyntax:
+  EnforcedStyle: hash_rockets
+
+Style/Lambda:
+  Enabled: false
+
+Style/SpaceInsideHashLiteralBraces:
+  EnforcedStyle: no_space
+
+Style/StringLiterals:
+  EnforcedStyle: double_quotes

data/Gemfile

@@ -0,0 +1,11 @@
+source "http://rubygems.org"
+
+gemspec
+
+gem "rake"
+
+group :test do
+  gem "rack-test"
+  gem "rspec", "~> 3.2"
+  gem "rubocop", ">= 0.30", :platforms => [:ruby_19, :ruby_20, :ruby_21, :ruby_22]
+end

data/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 Noah Lackstein
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,2 @@
+# OmniAuth Discourse
+...

data/Rakefile

@@ -0,0 +1,16 @@
+#!/usr/bin/env rake
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new
+
+begin
+  require "rubocop/rake_task"
+  RuboCop::RakeTask.new
+rescue LoadError
+  task :rubocop do
+    $stderr.puts "Rubocop is disabled"
+  end
+end
+
+task :default => [:spec, :rubocop]

data/lib/omniauth-discourse.rb

@@ -0,0 +1,2 @@
+require "omniauth-discourse/version"
+require "omniauth/strategies/discourse"

data/lib/omniauth-discourse/version.rb

@@ -0,0 +1,5 @@
+module OmniAuth
+  module Discourse
+    VERSION = "1.0.0"
+  end
+end

data/lib/omniauth/strategies/discourse.rb

@@ -0,0 +1,54 @@
+require "omniauth"
+require "omniauth/strategies/discourse/sso"
+
+module OmniAuth
+  module Strategies
+    class Discourse
+      include OmniAuth::Strategy
+      
+      args [:sso_secret, :sso_url]
+      option :sso_secret, nil
+      option :sso_url, nil
+      
+      attr_reader :user_info
+      
+      def request_phase
+        sso = SSO.new(options.sso_secret, options.sso_url, callback_url)
+        session[:sso_nonce] = sso.nonce
+          
+        redirect sso.request_url
+      end
+      
+      def callback_phase
+        sso = SSO.new(options.sso_secret, options.sso_url, callback_url, session[:sso_nonce])
+        sso.parse(request.params)
+        raise OmniAuth::NoSessionError, "Username or password are not valid" if sso.status == "error"
+
+        @user_info = sso.user_info
+        
+        super
+      rescue OmniAuth::NoSessionError => e
+        fail!(:invalid_credentials, e)
+      end
+
+      uid do
+        user_info[:external_id]
+      end
+
+      info do
+        {
+          "name" => user_info[:name],
+          "email" => user_info[:email],
+          "nickname" => user_info[:username]
+        }
+      end
+
+      extra do
+        {
+          "admin" => user_info[:admin] == "true",
+          "moderator" => user_info[:moderator] == "true"
+        }
+      end
+    end
+  end
+end

data/lib/omniauth/strategies/discourse/sso.rb

@@ -0,0 +1,86 @@
+require "securerandom"
+
+module OmniAuth
+  module Strategies
+    class Discourse
+      class SSO
+        attr_accessor :nonce, :user_info, :status, :message
+        
+        def initialize(sso_secret, sso_url, return_url, nonce = nil)
+          @sso_secret, @sso_url, @return_url = sso_secret, sso_url, return_url
+          @nonce = nonce ? nonce : generate_nonce!
+        end
+
+        def generate_nonce!
+          SecureRandom.hex()
+        end
+
+        def request_url
+          "#{ @sso_url }?sso=#{ url_encoded_payload }&sig=#{ hex_signature }"
+        end
+
+        def parse(params)
+          #params should be something that looks like: {"sso": "xxxxxx", "sig": "yyyyyy"} 
+          if get_hmac_hex_string(params["sso"]) == params["sig"] 
+            if base64? params["sso"]
+              decoded_hash = Rack::Utils.parse_query(Base64.decode64(params["sso"]))
+              decoded_hash.symbolize_keys!
+              if decoded_hash[:nonce] == @nonce   
+                @status = "success"
+                decoded_hash.delete(:nonce)
+                @user_info = decoded_hash
+                @message = "SSO verification passed."
+                return self
+              else
+                @status = "error"
+                @user_info = nil
+                @message = "SSO verification failed. Nonce mismatch."
+                return nil
+              end  
+            else
+              @status = "error"
+              @user_info = nil
+              @message = "The sso string is supposed to be encoded in Base64."
+              return nil       
+            end
+          else
+            @status = "error"
+            @user_info = nil
+            @message = "HMAC mismatch. The message may have been tampered with."
+            return nil          
+          end
+        end
+
+        private 
+          def raw_payload
+            unless @nonce
+              raise "You must generate a nonce by calling generate_nonce! first."
+            else
+              "nonce=#{ @nonce }&return_sso_url=#{ @return_url }"
+            end
+          end
+
+          def base64_encoded_payload
+            Base64.encode64(raw_payload)
+          end
+
+          def url_encoded_payload
+            URI.escape(base64_encoded_payload)
+          end
+
+          def hex_signature
+            get_hmac_hex_string base64_encoded_payload
+          end
+
+          def get_hmac_hex_string payload
+            OpenSSL::HMAC.hexdigest("sha256", @sso_secret, payload)
+          end
+
+          def base64? data
+            !(data =~ /[^a-zA-Z0-9=\r\n\/+]/m)
+          end
+
+      end
+    end
+  end
+end

data/omniauth-discourse.gemspec

@@ -0,0 +1,20 @@
+require File.expand_path("../lib/omniauth-discourse/version", __FILE__)
+
+Gem::Specification.new do |gem|
+  gem.authors       = ["Noah Lackstein"]
+  gem.email         = ["noah@lackstein.com"]
+  gem.description   = "A generic strategy for OmniAuth to authenticate against Discourse forum's SSO."
+  gem.summary       = gem.description
+  gem.homepage      = "https://github.com/lackstein/omniauth-discourse"
+  gem.license       = "MIT"
+
+  gem.add_dependency "omniauth", "~> 1.0"
+  gem.add_development_dependency "bundler", "~> 1.9"
+
+  gem.executables   = `git ls-files -- bin/*`.split("\n").map { |f| File.basename(f) }
+  gem.files         = `git ls-files`.split("\n")
+  gem.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
+  gem.name          = "omniauth-discourse"
+  gem.require_paths = ["lib"]
+  gem.version       = OmniAuth::Discourse::VERSION
+end

metadata

@@ -0,0 +1,85 @@
+--- !ruby/object:Gem::Specification
+name: omniauth-discourse
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Noah Lackstein
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-05-20 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: omniauth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.9'
+description: A generic strategy for OmniAuth to authenticate against Discourse forum's
+  SSO.
+email:
+- noah@lackstein.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- ".rubocop.yml"
+- Gemfile
+- LICENSE
+- README.md
+- Rakefile
+- lib/omniauth-discourse.rb
+- lib/omniauth-discourse/version.rb
+- lib/omniauth/strategies/discourse.rb
+- lib/omniauth/strategies/discourse/sso.rb
+- omniauth-discourse.gemspec
+homepage: https://github.com/lackstein/omniauth-discourse
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.5.1
+signing_key: 
+specification_version: 4
+summary: A generic strategy for OmniAuth to authenticate against Discourse forum's
+  SSO.
+test_files: []