puavo_authentication 0.1.0 → 0.2.0

data/app/controllers/sessions_controller.rb

@@ -6,9 +6,9 @@ class SessionsController < ApplicationController
   end
 
   def create
-    if user = User.authenticate( params[:user][:uid], params[:user][:password] ) # REST/OAuth?
+    if user_dn = User.authenticate( params[:user][:uid], params[:user][:password] ) # REST/OAuth?
       flash[:notice] = t('flash.session.login_successful')
-      session[:dn] = user.dn
+      session[:dn] = user_dn
       session[:password_plaintext] = params[:user][:password]
 
       #redirect_back_or_default schools_url

data/lib/puavo/authentication.rb

@@ -4,35 +4,89 @@ module Puavo
       base.send :extend, ClassMethods
     end
 
+
     module ClassMethods
+
+      def dn_cache_key(login_uid)
+        "user_dn:#{ login_uid }"
+      end
+
+      def delete_caches(login_uid)
+        Rails.cache.delete dn_cache_key login_uid
+      end
+
+      # Authenticate user with login username and password.
+      # Returns user dn string on successful login or false on invalid login
       def authenticate(login, password)
-        logger.debug "Find user by uid from ldap"
-        logger.debug "uid: #{login}"
 
-        begin
+        # To authenticate an user we need to make a LDAP bind with user's dn
+        # and password. Lets look it up from cache:
+        user_dn = Rails.cache.fetch dn_cache_key(login) do
+          # On cache miss we need to use the Puavo credentials from config/ldap.yml
+          # to fetch the user object which contains the user dn.
+
+          # This find call actually initializes the LDAP connection under the
+          # hood with Puavo credentials.
           user = self.find(:first, :attribute => "uid", :value => login)
 
-          if user.bind(password)
-            host = LdapBase.configuration[:host]
-            base = LdapBase.base.to_s
-            user.remove_connection
-            LdapBase.ldap_setup_connection(host, base, user.dn, password)
-
-            # Allow authentication always if logged in user is ExteralService object
-            if user.class == ExternalService
-              return user
-            end
-
-            # Allow authetication only if user is School Admin in the some School or organisation owner.
-            if School.find( :first, :attribute => "puavoSchoolAdmin", :value => user.dn ) ||
-                LdapOrganisation.first.owner.include?(user.dn)
-              return user
-            end
+          # Remove connection made with Puavo credentials
+          self.remove_connection
+
+          if user.nil?
+            return nil
           end
-        rescue Exception => e
-          logger.info "Login failed: login: #{login}, Exception: #{e}"
+
+          user.dn
+        end
+
+        if user_dn.nil?
+          logger.info "Login failed for #{ login }: Unknown username"
           return false
         end
+
+        # Setup new ActiveLdap connections to use user's credentials
+        LdapBase.ldap_setup_connection(
+          LdapBase.configuration[:host],
+          LdapBase.base.to_s,
+          user_dn,
+          password)
+
+        # Do not never ever allow anonymous connections in Puavo. Should be
+        # false in config/ldap.yml, but we just make sure here.
+        self.connection.instance_variable_set :@allow_anonymous, false
+
+        # This is the first time when LDAP connection is used with the user's
+        # credentials. So this search call will initialize the connection and
+        # will raise ActiveLdap::AuthenticationError if user supplied a
+        # bad password.
+        begin
+          admin_permissions = School.search(
+            :filter => "(puavoSchoolAdmin=#{user_dn})",
+            :scope => :one, :attributes => ["puavoId"],
+            :limit => 1 )
+        rescue ActiveLdap::AuthenticationError
+          logger.info "Login failed for #{ login } (#{ user_dn }): Bad password"
+          return false
+        end
+
+        # Allow authentication if user is  a school admin in the some school.
+        if not admin_permissions.empty?
+          return user_dn
+        end
+
+        # Allow authentication if user is an organisation owner
+        organisation = LdapOrganisation.first
+        if organisation && organisation.owner.include?(user_dn)
+          return user_dn
+        end
+
+        # Allow authentication always if logged in user an external service
+        if user_dn.rdns[1]["ou"] == "System Accounts"
+          return user_dn
+        end
+
+        logger.info "Login failed for #{ login } (#{ user_dn }): Not school admin or organisation owner"
+        return false
       end
     end
   end

data/lib/puavo_authentication/controllers/helpers.rb

@@ -26,16 +26,15 @@ module PuavoAuthentication
           logger.debug "Using HTTP basic authentication"
           password = ""
 
-          user = authenticate_with_http_basic do |login, password|
+          user_dn = authenticate_with_http_basic do |login, password|
             if login.match(/^service\//)
               ExternalService.authenticate(login.match(/^service\/(.*)/)[1], password)
             else
               User.authenticate(login, password)
             end
           end
-          logger.debug "Basic Auth User: " + user.inspect
-          if user
-            session[:dn] = user.dn
+          if user_dn
+            session[:dn] = user_dn
             session[:password_plaintext] = password
             logger.debug "Logged in with http basic authentication"
           else
@@ -71,15 +70,16 @@ module PuavoAuthentication
         if session[:dn]
           dn = session[:dn]
           password = session[:password_plaintext]
+          logger.debug "Using user's credentials for LDAP connection"
         else
+          logger.debug "Using Puavo credentials for LDAP connection"
           dn =  default_ldap_configuration["bind_dn"]
           password = default_ldap_configuration["password"]
         end
         logger.debug "Set host, bind_dn, base and password by user:"
         logger.debug "host: #{host}"
         logger.debug "base: #{base}"
-        logger.debug "dn: #{session[:dn]}"
-        #logger.debug "password: #{session[:password_plaintext]}"
+        logger.debug "dn: #{dn}"
         LdapBase.ldap_setup_connection(host, base, dn, password)
       end
 

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: puavo_authentication
 version: !ruby/object:Gem::Version 
-  hash: 27
+  hash: 23
   prerelease: 
   segments: 
   - 0
-  - 1
+  - 2
   - 0
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors: 
 - Jouni Korhonen