p8-castronaut 0.6.1.1

data/lib/castronaut/authentication_result.rb

@@ -0,0 +1,24 @@
+module Castronaut
+
+  class AuthenticationResult
+    
+    attr_reader :username, :error_message
+        
+    def initialize(username, error_message=nil)
+      @username = username
+      @error_message = error_message
+      Castronaut.logger.info("#{self.class} - #{@error_message} for #{@username}") if @error_message && @username
+    end
+    
+    def valid?
+      error_message.nil?
+    end
+    
+    def invalid?
+      !valid?
+    end
+    
+  end
+
+end
+

data/lib/castronaut/configuration.rb

@@ -0,0 +1,108 @@
+require 'yaml'
+require 'logger'
+require 'fileutils'
+
+class Hodel3000CompliantLogger < Logger
+  def format_message(severity, timestamp, msg, progname)
+    "#{timestamp.strftime("%b %d %H:%M:%S")} [#{$PID}]: #{severity} - #{progname.gsub(/\n/, '').lstrip}\n"
+  end
+end
+
+module Castronaut
+
+  class Configuration
+    DefaultConfigFilePath = './castronaut.yml'
+
+    attr_accessor :config_file_path, :config_hash, :logger
+
+    def self.load(config_file_path = Castronaut::Configuration::DefaultConfigFilePath)
+      config = Castronaut::Configuration.new
+      config.config_file_path = config_file_path
+      config.config_hash = parse_yaml_config(config_file_path)
+      config.parse_config_into_settings(config.config_hash)
+      config.logger = config.setup_logger
+      config.debug_initialize if config.logger.debug?
+      config.connect_activerecord 
+      config
+    end
+
+    def self.parse_yaml_config(file_path)
+      YAML::load_file(file_path)
+    end
+
+    def parse_config_into_settings(config)
+      mod = Module.new do
+        config.each_pair do |k,v|
+          if self.methods.include?(k.to_s)
+            STDERR.puts "#{self.class} - Configuration tried to define #{k}, which was already defined." unless ENV["test"] == "true"
+            next
+          end
+          define_method(k) { v }
+        end
+      end
+      self.extend mod
+    end
+
+    def create_directory(dir)
+      FileUtils.mkdir_p(dir) unless File.exist?(dir)
+    end
+
+    def setup_logger
+      create_directory(log_directory)
+      log = Hodel3000CompliantLogger.new("#{log_directory}/castronaut.log", "daily")
+      log.level = eval(log_level)
+      log
+    end
+
+    def debug_initialize
+      logger.debug "#{self.class} - initializing with parameters"
+      config_hash.each_pair do |key, value|
+        logger.debug "--> #{key} = #{value.inspect}"
+      end
+      logger.debug "#{self.class} - initialization complete"
+    end
+
+    def can_fire_callbacks?
+      config_hash.keys.include?('callbacks') && !config_hash['callbacks'].nil?
+    end
+
+    def connect_activerecord
+      create_directory('db')
+
+      ActiveRecord::Base.logger = logger
+      ActiveRecord::Base.colorize_logging = false
+
+      connect_cas_to_activerecord
+      connect_adapter_to_activerecord if cas_adapter.has_key?('database')
+    end
+
+    def connect_cas_to_activerecord
+      logger.info "#{self.class} - Connecting to cas database using #{cas_database.inspect}"
+      ActiveRecord::Base.establish_connection(cas_database)
+
+      migration_path = File.expand_path(File.join(File.dirname(__FILE__), 'db'))
+
+      logger.debug "#{self.class} - Migrating to the latest version using migrations in #{migration_path}"
+      ActiveRecord::Migrator.migrate(migration_path, ENV["VERSION"] ? ENV["VERSION"].to_i : nil)
+    end
+
+    def connect_adapter_to_activerecord
+      logger.info "#{self.class} - Connecting to cas adapter database using #{cas_adapter['database'].inspect}"
+      if cas_adapter['adapter'] == "database"
+        Castronaut::Adapters::RestfulAuthentication::User.establish_connection(cas_adapter['database'])
+        Castronaut::Adapters::RestfulAuthentication::User.logger = logger
+      elsif cas_adapter['adapter'] == "development"
+        Castronaut::Adapters::Development::User.establish_connection(cas_adapter['database'])
+        Castronaut::Adapters::Development::User.logger = logger
+      end
+
+      unless ENV["test"] == "true"
+        if Castronaut::Adapters::RestfulAuthentication::User.connection.tables.empty?
+          STDERR.puts "#{self.class} - There are no tables in the given database.\nConfig details:\n#{config_hash.inspect}"
+          Kernel.exit(0)
+        end
+      end
+    end
+  end
+
+end

data/lib/castronaut/db/001_create_cas_database.rb

@@ -0,0 +1,47 @@
+class CreateCasDatabase < ActiveRecord::Migration
+  def self.up
+    create_table :login_tickets,   :force => true do |t|
+      t.column :ticket,           :string,    :null => false
+      t.column :client_hostname,  :string,    :null => false
+      t.column :consumed_at,      :datetime,  :null => true
+      t.column :created_at,       :datetime,  :null => false
+    end
+
+    create_table :service_tickets,   :force => true do |t|
+      t.column :proxy_granting_ticket_id,     :integer, :null => true
+      t.column :ticket_granting_ticket_id,    :integer, :null => true
+
+      t.column :ticket,           :string,    :null => false
+      t.column :client_hostname,  :string,    :null => false
+      t.column :service,          :text,      :null => false
+      t.column :username,         :string,    :null => false
+      t.column :type,             :string,    :null => true
+      t.column :consumed_at,      :datetime,  :null => true
+      t.column :created_at,       :datetime,  :null => false
+    end
+
+    create_table :ticket_granting_tickets,  :force => true do |t|
+      t.column :ticket,           :string,    :null => false
+      t.column :client_hostname,  :string,    :null => false
+      t.column :username,         :string,    :null => false
+
+      t.column :created_at,       :datetime,  :null => false
+    end
+
+    create_table :proxy_granting_tickets,  :force => true do |t|
+      t.column :service_ticket_id,  :integer,   :null => false
+
+      t.column :ticket,             :string,    :null => false
+      t.column :client_hostname,    :string,    :null => false
+      t.column :iou,                :string,    :null => false
+      t.column :created_at,         :datetime,  :null => false
+    end
+  end
+
+  def self.down
+    drop_table :proxy_granting_tickets
+    drop_table :ticket_granting_tickets
+    drop_table :service_tickets
+    drop_table :login_tickets
+  end
+end

data/lib/castronaut/models/consumeable.rb

@@ -0,0 +1,18 @@
+module Castronaut
+  module Models
+    
+    module Consumeable
+      
+      def consumed?
+        !consumed_at.nil?
+      end
+      
+      def consume!
+        self.consumed_at = Time.now
+        self.save!
+      end
+      
+    end
+    
+  end
+end

data/lib/castronaut/models/dispenser.rb

@@ -0,0 +1,14 @@
+module Castronaut
+  module Models
+    
+    module Dispenser
+
+      private
+       def dispense_ticket
+         write_attribute :ticket, "#{ticket_prefix}-#{Castronaut::Utilities::RandomString.generate}"
+       end
+      
+    end
+    
+  end
+end

data/lib/castronaut/models/login_ticket.rb

@@ -0,0 +1,53 @@
+module Castronaut
+  module Models
+
+    class LoginTicket < ActiveRecord::Base
+      include Castronaut::Models::Consumeable
+      include Castronaut::Models::Dispenser
+
+      MissingMessage = "Your login request did not include a login ticket. There may be a problem with the authentication system."
+      InvalidMessage = "The login ticket you provided is invalid. Please try logging in again."
+      AlreadyConsumedMessage = "The login ticket you provided has already been used up. Please try logging in again."
+      ExpiredMessage = "Your login ticket has expired. Please try logging in again."
+
+      before_validation :dispense_ticket, :if => :new_record?
+      validates_presence_of :ticket, :client_hostname 
+
+      def self.generate_from(client_host)
+        create! :client_hostname => client_host
+      end
+
+      def self.validate_ticket(ticket)
+        return Castronaut::TicketResult.new(nil, MissingMessage) if ticket.nil?
+
+        login_ticket = find_by_ticket(ticket)
+
+        return Castronaut::TicketResult.new(nil, InvalidMessage) if login_ticket.nil?
+
+        return Castronaut::TicketResult.new(login_ticket, AlreadyConsumedMessage) if login_ticket.consumed?
+
+        return Castronaut::TicketResult.new(login_ticket, ExpiredMessage) if login_ticket.expired?
+
+        login_ticket.consume!
+
+        Castronaut::TicketResult.new(login_ticket, nil, "success")
+      end
+
+      def expired?
+        #Time.now - lt.created_on < CASServer::Conf.login_ticket_expiry
+      end
+ 
+      def ticket_prefix
+        "LT"
+      end
+      
+      def username
+      end
+      
+      def proxies
+      end
+      
+    end
+
+  end
+end

data/lib/castronaut/models/proxy_granting_ticket.rb

@@ -0,0 +1,70 @@
+require 'uri'
+require 'net/https'
+
+module Castronaut
+  module Models
+
+    class ProxyGrantingTicket < ActiveRecord::Base
+      belongs_to :service_ticket
+
+      before_validation :dispense_ticket, :if => :new_record?
+      before_validation :dispense_iou, :if => :new_record?
+      
+      validates_presence_of :ticket, :client_hostname, :iou
+
+      def self.generate_ticket(proxy_granting_ticket_url, client_host, service_ticket)
+        
+        begin
+          uri = URI.parse(proxy_granting_ticket_url)
+        rescue URI::InvalidURIError
+          return Castronaut::TicketResult.new(nil, "Unable to parse pgt_url '#{proxy_granting_ticket_url}'", "warn")
+        end
+        
+        https = Net::HTTP.new(uri.host,uri.port)
+        https.use_ssl = true
+
+        https.start do |http_connection|
+          path = uri.path.empty? ? '/' : uri.path
+
+          proxy_granting_ticket = ProxyGrantingTicket.new(:service_ticket => service_ticket, :client_hostname => client_host)
+          proxy_granting_ticket.dispense_ticket
+          proxy_granting_ticket.dispense_iou
+          
+          path += (uri.query.nil? || uri.query.empty? ? '?' : '&') + "pgtId=#{proxy_granting_ticket.ticket}&pgtIou=#{proxy_granting_ticket.iou}"
+
+          http_response = http_connection.request_get(path)
+
+          if http_response.code.to_i == 200
+            proxy_granting_ticket.save!
+            
+            return Castronaut::TicketResult.new(proxy_granting_ticket, "PGT generated for pgt_url '#{proxy_granting_ticket_url}': #{proxy_granting_ticket.inspect}", "success")
+          else
+            return Castronaut::TicketResult.new(nil, "PGT callback server responded with a bad result code '#{http_response.code}'. PGT will not be stored.", "warn")
+          end
+        end
+      end
+      
+      def self.clean_up_proxy_granting_tickets_for(username)
+        proxy_granting_tickets = all(:include => :service_ticket, :conditions => ["service_tickets.username = ?", username])
+        proxy_granting_tickets.each { |pgt| pgt.destroy }
+        nil
+      end
+
+      def dispense_ticket
+        write_attribute(:ticket, "PGT-#{Castronaut::Utilities::RandomString.generate(60)}") if ticket.nil?
+      end
+      
+      def dispense_iou
+        write_attribute(:iou, "PGTIOU-#{Castronaut::Utilities::RandomString.generate(57)}") if iou.nil?
+      end
+      
+      def username
+      end
+      
+      def proxies
+      end
+      
+    end
+    
+  end
+end

data/lib/castronaut/models/proxy_ticket.rb

@@ -0,0 +1,43 @@
+require 'uri'
+require 'net/https'
+
+module Castronaut
+  module Models
+
+    class ProxyTicket < ServiceTicket
+
+      MissingMessage = "Ticket or service parameter was missing in the request."
+
+      belongs_to :proxy_granting_ticket
+
+      before_validation :dispense_ticket, :if => :new_record?
+      validates_presence_of :ticket, :client_hostname, :service, :username, :ticket_granting_ticket
+
+      def self.validate_ticket(service, ticket)
+        service_ticket_result = Castronaut::Models::ServiceTicket.validate_ticket(service, ticket, true)
+
+        return service_ticket_result if service_ticket_result.invalid?
+
+        if service_ticket_result.ticket === Castronaut::Models::ProxyTicket
+          if service_ticket_result.ticket.proxy_granting_ticket.nil?
+            return Castronaut::TicketResult.new(service_ticket_result.ticket, "Proxy ticket '#{service_ticket_result.ticket}' belonging to user '#{service_ticket_result.username}' is not associated with a proxy granting ticket.", "INTERNAL_ERROR")
+          elsif service_ticket_result.ticket.proxy_granting_ticket.service_ticket.nil?
+            return Castronaut::TicketResult.new(service_ticket_result.ticket, "Proxy granting ticket '#{service_ticket_result.ticket.proxy_granting_ticket}' (associated with proxy ticket '#{service_ticket_result.ticket}' and belonging to user '#{service_ticket_result.username}' is not associated with a service ticket.", "INTERNAL_ERROR")
+          end
+        end
+
+        Castronaut::TicketResult.new(service_ticket_result.ticket, nil, "success")
+      end
+
+      def ticket_prefix
+        "PT"
+      end
+      
+      def proxies
+        [proxy_granting_ticket.service_ticket.service]
+      end
+
+    end
+
+  end
+end

data/lib/castronaut/models/service_ticket.rb

@@ -0,0 +1,91 @@
+require 'uri'
+require 'net/https'
+
+module Castronaut
+  module Models
+
+    class ServiceTicket < ActiveRecord::Base
+      include Castronaut::Models::Consumeable
+      include Castronaut::Models::Dispenser
+
+      MissingMessage = "Ticket or service parameter was missing in the request."
+
+      belongs_to :ticket_granting_ticket
+      has_many :proxy_granting_tickets, :dependent => :destroy
+
+      before_validation :dispense_ticket, :if => :new_record?
+      validates_presence_of :ticket, :client_hostname, :service, :username, :ticket_granting_ticket
+
+      def self.generate_ticket_for(service, client_host, ticket_granting_ticket)
+        create! :service => service,
+                :username => ticket_granting_ticket.username,
+                :client_hostname => client_host,
+                :ticket_granting_ticket => ticket_granting_ticket
+      end
+
+      def self.validate_ticket(service, ticket, allow_proxy_tickets = false)
+
+        return Castronaut::TicketResult.new(nil, MissingMessage, "INVALID_REQUEST") unless service && ticket
+
+        service_ticket = find_by_ticket(ticket)
+
+        return Castronaut::TicketResult.new(nil, "Ticket #{ticket} not recognized.", "INVALID_TICKET") unless service_ticket
+
+        return Castronaut::TicketResult.new(service_ticket, "Ticket '#{ticket}' has already been used up.", "INVALID_TICKET") if service_ticket.consumed?
+
+        service_ticket.consume!
+
+        if service_ticket === Castronaut::Models::ProxyTicket && !allow_proxy_tickets
+          return Castronaut::TicketResult.new(service_ticket, "Ticket '#{ticket}' is a proxy ticket, but only service tickets are allowed here.", "INVALID_TICKET")
+        end
+
+        return Castronaut::TicketResult.new(service_ticket, "Ticket '#{ticket}' has expired.", "INVALID_TICKET") if service_ticket.expired?
+
+        mismatched_service_message = "The ticket '#{ticket}' belonging to user '#{service_ticket.username}' is valid, but the requested service '#{service}' does not match the service '#{service_ticket.service}' associated with this ticket."
+
+        return Castronaut::TicketResult.new(service_ticket, mismatched_service_message, "INVALID_SERVICE") unless service_ticket.matches_service?(service)
+
+        Castronaut::TicketResult.new(service_ticket, nil, "success")
+      end
+
+      def matches_service?(other_service)
+        service == other_service
+      end
+
+      def service_uri
+        return nil if service.blank?
+
+        begin
+          raw_uri = URI.parse(service)
+
+          if service.include? "?"
+            if raw_uri.query.empty?
+              query_separator = ""
+            else
+              query_separator = "&"
+            end
+          else
+            query_separator = "?"
+          end
+
+          "#{service}#{query_separator}ticket=#{ticket}"
+        rescue URI::InvalidURIError
+          nil
+        end
+      end
+
+      def ticket_prefix
+        "ST"
+      end
+
+      def expired?
+        # Time.now - service_ticket.created_on > CASServer::Conf.service_ticket_expiry
+      end
+      
+      def proxies
+      end
+      
+    end
+
+  end
+end