rack-cas 0.9.2 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 350e3d8a032b2ad286361155787f827f6a9071c4
-  data.tar.gz: b34dd4c7394b3f41c73fb3678aa21c4249e38786
+  metadata.gz: d5489d9f59ed22ec943c535fa71d22767989376f
+  data.tar.gz: 96d2bb87575ba742f39d8afc7ba15827eb44aa60
 SHA512:
-  metadata.gz: 98c519c6ad0608652e5f987d5ff5e2513f790498d1e6a25b50f139a7b59e4e0fea8098d6d3e564a7ad2f88ed28064372c32eadf647785eb691ea7dd1a3e57d2d
-  data.tar.gz: 649f1204ac2141fbc40613df5e25d121a6db57fd4fbbda7c0a04482bfa57b396c1f10694a7891b0b3154dc880c01a8595106aff3be42ee02b90f39b4d035c966
+  metadata.gz: 8f3844078c537810c728a96f37631aaa158df1935b696a5cbe9806810c0375db71070b401d80460b86f515a30dcbd94946a213b8ebe68922842b189be67df2db
+  data.tar.gz: e2f627bcdf127c60a051d1152d1f4a294e23fc6466275a5374f09f7f97107ebb0d8dae0aa0e54cb27c171b2609ed5db5b6844fc365680c9c5d3f50ff8c91e8d7

data/{README.markdown → README.md}

@@ -1,6 +1,6 @@
 Rack-CAS [![Build Status](https://travis-ci.org/biola/rack-cas.png?branch=master)](https://travis-ci.org/biola/rack-cas)
 ========
-Rack-CAS is simple [Rack](http://rack.github.com/) middleware to perform [CAS](http://jasig.org/cas) client authentication.
+Rack-CAS is simple [Rack](http://rack.github.com/) middleware to perform [CAS](http://en.wikipedia.org/wiki/Central_Authentication_Service) client authentication.
 
 Features
 ========
@@ -19,7 +19,7 @@ One of the included session stores must be used.
 Requirements
 ============
 * Ruby >= 1.9.2
-* A working [CAS server](http://rubycas.github.com)
+* A working [CAS server](http://casino.rbcas.com)
 * An app that [returns a `401 Unauthorized`](#integration) status when authentication is requried
 
 Installation
@@ -31,54 +31,54 @@ Rails
 Add `gem 'rack-cas'` to your [`Gemfile`](http://gembundler.com/gemfile.html) and run `bundle install`
 
 Once the necessary gems have been installed, in your `config/application.rb` add:
-
-    config.rack_cas.server_url = 'https://cas.example.com/'
-
+```ruby
+config.rack_cas.server_url = 'https://cas.example.com/'
+```
 If the the server URL depends on your environment, you can define it in the according file: `config/environments/<env>.rb`
 
-### Single Sign Out ###
+### Single Logout ###
 
-If you wish to enable [single sign out](https://wiki.jasig.org/display/CASUM/Single+Sign+Out) you'll need to modify your configuration as below.
+If you wish to enable [single logout](http://jasig.github.io/cas/4.0.0/installation/Logout-Single-Signout.html) you'll need to modify your configuration as below.
 
 #### Active Record ####
 
 Set the `session_store` in your `config/application.rb`:
-
-    require 'rack-cas/session_store/active_record'
-    config.rack_cas.session_store = RackCAS::ActiveRecordStore
-
+```ruby
+require 'rack-cas/session_store/active_record'
+config.rack_cas.session_store = RackCAS::ActiveRecordStore
+```
 Edit your `config/initializers/session_store.rb` file with the following:
-
-    require 'rack-cas/session_store/rails/active_record'
-    YourApp::Application.config.session_store :rack_cas_active_record_store
-
+```ruby
+require 'rack-cas/session_store/rails/active_record'
+YourApp::Application.config.session_store :rack_cas_active_record_store
+```
 Run:
-
-    rails generate cas_session_store_migration
-    rake db:migrate
-
+```ruby
+rails generate cas_session_store_migration
+rake db:migrate
+```
 #### Mongoid ####
 
 Set the `session_store` in your `config/application.rb`:
-
-    require 'rack-cas/session_store/mongoid'
-    config.rack_cas.session_store = RackCAS::MongoidStore
-
+```ruby
+require 'rack-cas/session_store/mongoid'
+config.rack_cas.session_store = RackCAS::MongoidStore
+```
 Edit your `config/initializers/session_store.rb` file with the following:
-
-    require 'rack-cas/session_store/rails/mongoid'
-    YourApp::Application.config.session_store :rack_cas_mongoid_store
-
+```ruby
+require 'rack-cas/session_store/rails/mongoid'
+YourApp::Application.config.session_store :rack_cas_mongoid_store
+```
 Sinatra and Other Rack-Compatible Frameworks
 --------------------------------------------
 
 Add `gem 'rack-cas'` to your [`Gemfile`](http://gembundler.com/gemfile.html) and run `bundle install`
 
 Add the following to your `config.ru` file:
-
-    require 'rack/cas'
-    use Rack::CAS, server_url: 'https://login.example.com/cas'
-
+```ruby
+require 'rack/cas'
+use Rack::CAS, server_url: 'https://login.example.com/cas'
+```
 See the [example Sinatra app](https://gist.github.com/adamcrown/a7e757759469033584c4) to get started.
 
 ### Single Sign Out ###
@@ -92,25 +92,25 @@ Excluding Paths
 ---------------
 
 If you have some parts of your app that should not be CAS authenticated (such as an API namespace), just pass `exclude_path` to the middleware. You can pass in a string that matches the beginning of the path, a regular expression or an array of strings and regular expressions.
-
-    use Rack::CAS, server_url: '...', exclude_path: '/api'
-    use Rack::CAS, server_url: '...', exclude_path: /\.json/
-    use Rack::CAS, server_url: '...', exclude_paths: ['/api', /\.json/]
-
+```ruby
+use Rack::CAS, server_url: '...', exclude_path: '/api'
+use Rack::CAS, server_url: '...', exclude_path: /\.json/
+use Rack::CAS, server_url: '...', exclude_paths: ['/api', /\.json/]
+```
 The same options can be passed to `FakeCAS`.
-
-    use Rack::FakeCAS, exclude_path: '/api'
-
+```ruby
+use Rack::FakeCAS, exclude_path: '/api'
+```
 Integration
 ===========
 Your app should __return a [401 status](http://httpstatus.es/401)__ whenever a request is made that requires authentication. Rack-CAS will catch these responses and attempt to authenticate via your CAS server.
 
 Once authentication with the CAS server has completed, Rack-CAS will set the following session variables:
-
-    request.session['cas']['user'] #=> johndoe
-    request.session['cas']['extra_attributes'] #=> { 'first_name' => 'John', 'last_name' => ... }
-
-__NOTE:__ `extra_attributes` will be an empty hash unless they've been [configured on your CAS server](https://github.com/rubycas/rubycas-server/wiki/Extra-user-attributes).
+```ruby
+request.session['cas']['user'] #=> johndoe
+request.session['cas']['extra_attributes'] #=> { 'first_name' => 'John', 'last_name' => ... }
+```
+__NOTE:__ `extra_attributes` will be an empty hash unless they've been [configured on your CAS server](http://casino.rbcas.com/docs/configuration/#ldap).
 
 Testing
 =======
@@ -118,36 +118,36 @@ Testing
 Controller Tests
 ----------------
 Testing your controllers and such should be as simple as setting the session variables manually in a helper.
-
-    def set_current_user(user)
-      session['cas'] = { 'user' => user.username, 'extra_attributes' => {} }
-    end
-
+```ruby
+def set_current_user(user)
+  session['cas'] = { 'user' => user.username, 'extra_attributes' => {} }
+end
+```
 Integration Tests
 -----------------
 Integration testing using something like [Capybara](http://jnicklas.github.com/capybara/) is a bit trickier because the session can't be manipulated directly. So for integration tests, I recommend using the provided `Rack::FakeCAS` middleware instead of `Rack::CAS`.
-
-    require 'rack/fake_cas'
-    use Rack::FakeCAS
-
+```ruby
+require 'rack/fake_cas'
+use Rack::FakeCAS
+```
 In addition you can pass a Hash to configure extra attributes for predefined
 usernames.
-
-    use Rack::FakeCAS, {}, {'john' => {'name' => 'John Doe'}}
-
+```ruby
+use Rack::FakeCAS, {}, {'john' => {'name' => 'John Doe'}}
+```
 If you are using Rails, FakeCAS is automatically used in the test environment by default. If you would like to activate it in any other environment, add the following to the corresponding `config/environments/<env>.rb`:
-
-    config.rack_cas.fake = true
-
+```ruby
+config.rack_cas.fake = true
+```
 You can also configure extra attribute mappings through the Rails config:
-
-    config.rack_cas.fake_attributes = { 'john' => { 'name' => 'John Doe' } }
-
+```ruby
+config.rack_cas.fake_attributes = { 'john' => { 'name' => 'John Doe' } }
+```
 Then you can simply do the following in your integration tests in order to log in.
-
-    visit '/restricted_path'
-    fill_in 'username', with: 'johndoe'
-    fill_in 'password', with: 'any password'
-    click_button 'Login'
-
+```ruby
+visit '/restricted_path'
+fill_in 'username', with: 'johndoe'
+fill_in 'password', with: 'any password'
+click_button 'Login'
+```
 __NOTE:__ The FakeCAS middleware will authenticate any username with any password and so should never be used in production.

data/lib/rack-cas.rb

@@ -1,4 +1,12 @@
+require 'rack-cas/configuration'
 require 'rack-cas/railtie' if defined?(Rails)
 
 module RackCAS
-end
+  def self.configure
+    yield config
+  end
+
+  def self.config
+    @config ||= Configuration.new
+  end
+end

data/lib/rack-cas/configuration.rb

@@ -0,0 +1,36 @@
+module RackCAS
+  class Configuration
+    SETTINGS = [:server_url, :session_store, :exclude_path, :exclude_paths, :extra_attributes_filter, :verify_ssl_cert]
+
+    SETTINGS.each do |setting|
+      attr_accessor setting
+
+      define_method "#{setting}?" do
+        !(send(setting).nil? || send(setting) == [])
+      end
+    end
+
+    def initialize
+      @verify_ssl_cert = true
+    end
+
+    def extra_attributes_filter
+      Array(@extra_attributes_filter)
+    end
+
+    def update(settings_hash)
+      settings_hash.each do |setting, value|
+        unless SETTINGS.include? setting.to_sym
+          raise ArgumentError, "invalid setting: #{setting}"
+        end
+
+        self.public_send "#{setting}=", value
+      end
+
+      raise ArgumentError, 'server_url is required' unless server_url?
+      if session_store? && !session_store.respond_to?(:destroy_session_by_cas_ticket)
+        raise ArgumentError, 'session_store does not support single-sign-out'
+      end
+    end
+  end
+end

data/lib/rack-cas/service_validation_response.rb

@@ -83,7 +83,10 @@ module RackCAS
       return @response unless @response.nil?
 
       http = Net::HTTP.new(@url.host, @url.inferred_port)
-      http.use_ssl = true if @url.scheme == 'https'
+      if @url.scheme == 'https'
+        http.use_ssl = true
+        http.verify_mode = RackCAS.config.verify_ssl_cert? ? OpenSSL::SSL::VERIFY_PEER : OpenSSL::SSL::VERIFY_NONE
+      end
 
       http.start do |conn|
         @response = conn.get(@url.request_uri, REQUEST_HEADERS)

data/lib/rack-cas/version.rb

@@ -1,3 +1,3 @@
 module RackCAS
-  VERSION = '0.9.2'
+  VERSION = '0.10.0'
 end

data/lib/rack/cas.rb

@@ -8,21 +8,15 @@ class Rack::CAS
 
   def initialize(app, config={})
     @app = app
-    @server_url = config.delete(:server_url)
-    @session_store = config.delete(:session_store)
-    @config = config || {}
 
-    raise ArgumentError, 'server_url is required' if @server_url.nil?
-    if @session_store && !@session_store.respond_to?(:destroy_session_by_cas_ticket)
-      raise ArgumentError, 'session_store does not support single-sign-out'
-    end
+    RackCAS.config.update config
   end
 
   def call(env)
     request = Rack::Request.new(env)
     cas_request = CASRequest.new(request)
 
-    if cas_request.path_matches? @config[:exclude_paths] || @config[:exclude_path]
+    if cas_request.path_matches? RackCAS.config.exclude_path || RackCAS.config.exclude_paths
       return @app.call(env)
     end
 
@@ -48,10 +42,10 @@ class Rack::CAS
       return redirect_to server.logout_url(request.params).to_s
     end
 
-    if cas_request.single_sign_out? && @session_store
+    if cas_request.single_sign_out? && RackCAS.config.session_store?
       log env, 'rack-cas: Intercepting single-sign-out request.'
 
-      @session_store.destroy_session_by_cas_ticket(cas_request.ticket)
+      RackCAS.config.session_store.destroy_session_by_cas_ticket(cas_request.ticket)
       return [200, {'Content-Type' => 'text/plain'}, ['CAS Single-Sign-Out request intercepted.']]
     end
 
@@ -69,7 +63,7 @@ class Rack::CAS
   protected
 
   def server
-    @server ||= RackCAS::Server.new(@server_url)
+    @server ||= RackCAS::Server.new(RackCAS.config.server_url)
   end
 
   def get_user(service_url, ticket)
@@ -77,10 +71,7 @@ class Rack::CAS
   end
 
   def store_session(request, user, ticket, extra_attrs = {})
-    if @config[:extra_attributes_filter]
-      filter = Array(@config[:extra_attributes_filter]).map(&:to_s)
-      extra_attrs = extra_attrs.select { |key, val| filter.include? key }
-    end
+    extra_attrs.select! { |key, val| RackCAS.config.extra_attributes_filter.map(&:to_s).include? key.to_s }
 
     request.session['cas'] = { 'user' => user, 'ticket' => ticket, 'extra_attributes' => extra_attrs }
   end
@@ -96,4 +87,4 @@ class Rack::CAS
       env['rack.errors'].write(message)
     end
   end
-end
+end

data/lib/rack/fake_cas.rb

@@ -28,11 +28,15 @@ class Rack::FakeCAS
       @request.session.clear
       redirect_to "#{@request.script_name}/"
 
+    # built-in way to get to the login page without needing to return a 401 status
+    when '/fake_cas_login'
+      render_login_page
+
     else
       response = @app.call(env)
 
       if response[0] == 401 # access denied
-        [ 200, { 'Content-Type' => 'text/html' }, [login_page] ]
+        render_login_page
       else
         response
       end
@@ -41,6 +45,10 @@ class Rack::FakeCAS
 
   protected
 
+  def render_login_page
+    [ 200, { 'Content-Type' => 'text/html' }, [login_page] ]
+  end
+
   def login_page
     <<-EOS
 <!doctype html>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-cas
 version: !ruby/object:Gem::Version
-  version: 0.9.2
+  version: 0.10.0
 platform: ruby
 authors:
 - Adam Crownoble
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-09-05 00:00:00.000000000 Z
+date: 2015-03-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -58,14 +58,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.11'
+        version: '3.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.11'
+        version: '3.2'
+- !ruby/object:Gem::Dependency
+  name: rspec-its
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: rack-test
   requirement: !ruby/object:Gem::Requirement
@@ -101,11 +115,12 @@ extensions: []
 extra_rdoc_files: []
 files:
 - MIT-LICENSE
-- README.markdown
+- README.md
 - lib/generators/cas_session_store_migration_generator.rb
 - lib/generators/templates/migration.rb
 - lib/rack-cas.rb
 - lib/rack-cas/cas_request.rb
+- lib/rack-cas/configuration.rb
 - lib/rack-cas/railtie.rb
 - lib/rack-cas/server.rb
 - lib/rack-cas/service_validation_response.rb
@@ -147,4 +162,3 @@ signing_key:
 specification_version: 4
 summary: Rack-based CAS client
 test_files: []
-has_rdoc: