rack-cas 0.10.1 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e30e5b118a618b8b272d36176d0297a3b6bb9ce9
-  data.tar.gz: 69b1b0c2de4fdb69220eaee104766eae66897b85
+  metadata.gz: 38012fd82aee3a253f981902a280b0b7ec6d04e5
+  data.tar.gz: 3cbf759de026aca104498d87770a12dd0895b03d
 SHA512:
-  metadata.gz: f85843bf2c05234cf863b2dd5c7653059deb871f76d4bfb6b147fce28731c150fa4f7145526a77e89af9bb75111d6c8c00685e2f592a319b86c3347b5eeb6944
-  data.tar.gz: 18101042feca858fb47f224d4887026d6a5cebbc12dd8a300c2ce2dcf92de2df4e118d017208517bdc19472e0e096f5d9f997e4f7264b69f38a58065924d40cb
+  metadata.gz: e1876204036636478a1bf8d46bceaf3f99a7e83751ab4bdbfdb3aa483312eaa1755aefc50e7731687fdf2c24f9fea023f12c073b6c2eb70a5292386d81789257
+  data.tar.gz: a0a8e8f896424d1ec98d4941f9698c8431269ba362372556b316e50861526ea1abb6484afd1fdc2f85087b9f9f9110715aa3d8510f0bd98eba3b2a075dd3f011

data/README.md

@@ -38,7 +38,7 @@ If the the server URL depends on your environment, you can define it in the acco
 
 ### Single Logout ###
 
-If you wish to enable [single logout](http://jasig.github.io/cas/4.0.0/installation/Logout-Single-Signout.html) you'll need to modify your configuration as below.
+If you wish to enable [single logout](http://jasig.github.io/cas/4.0.x/installation/Logout-Single-Signout.html) you'll need to modify your configuration as below.
 
 #### Active Record ####
 
@@ -50,7 +50,7 @@ config.rack_cas.session_store = RackCAS::ActiveRecordStore
 Edit your `config/initializers/session_store.rb` file with the following:
 ```ruby
 require 'rack-cas/session_store/rails/active_record'
-YourApp::Application.config.session_store :rack_cas_active_record_store
+YourApp::Application.config.session_store ActionDispatch::Session::RackCasActiveRecordStore
 ```
 Run:
 ```ruby
@@ -67,7 +67,7 @@ config.rack_cas.session_store = RackCAS::MongoidStore
 Edit your `config/initializers/session_store.rb` file with the following:
 ```ruby
 require 'rack-cas/session_store/rails/mongoid'
-YourApp::Application.config.session_store :rack_cas_mongoid_store
+YourApp::Application.config.session_store ActionDispatch::Session::RackCasMongoidStore
 ```
 Sinatra and Other Rack-Compatible Frameworks
 --------------------------------------------

data/lib/rack-cas/configuration.rb

@@ -1,6 +1,6 @@
 module RackCAS
   class Configuration
-    SETTINGS = [:server_url, :session_store, :exclude_path, :exclude_paths, :extra_attributes_filter, :verify_ssl_cert, :renew]
+    SETTINGS = [:server_url, :session_store, :exclude_path, :exclude_paths, :extra_attributes_filter, :verify_ssl_cert, :renew, :use_saml_validation]
 
     SETTINGS.each do |setting|
       attr_accessor setting

data/lib/rack-cas/saml_validation_response.rb

@@ -0,0 +1,106 @@
+module RackCAS
+  class SAMLValidationResponse
+    class AuthenticationFailure < StandardError; end
+    class TicketInvalidError < AuthenticationFailure; end
+
+    REQUEST_HEADERS = {
+      'Accept' => '*/*',
+      'Content-Type' => 'application/soap+xml; charset=utf-8'
+    }
+
+    def initialize(url, ticket)
+      @url = URL.parse(url)
+      @ticket = ticket
+    end
+
+    def user
+      if success?
+        xml.at('//Response/Assertion/AuthenticationStatement/Subject/NameIdentifier').text
+      else
+        raise AuthenticationFailure, failure_message
+      end
+    end
+
+    def extra_attributes
+      attrs = {}
+
+      raise AuthenticationFailure, failure_message unless success?
+
+      xml.at('//Response/Assertion/AttributeStatement').children.each do |node|
+        key = node.at('@AttributeName')
+
+        if key
+          values = node.xpath('AttributeValue').map { |n| n.text }
+
+          values = values.first if values.size == 1
+
+          attrs[key.text] = values
+        end
+      end
+
+      attrs
+    end
+
+    protected
+
+    def success?
+      @success ||= xml.at('//Response/Status/StatusCode/@Value').text == 'saml1p:Success'
+    end
+
+    def authentication_failure
+      @authentication_failure ||= !@success
+    end
+
+    def failure_message
+      if authentication_failure
+        xml.at('//Response/Status/StatusMessage').text.strip
+      end
+    end
+
+    def response
+      require 'net/http'
+      return @response unless @response.nil?
+
+      http = Net::HTTP.new(@url.host, @url.inferred_port)
+
+      if @url.scheme == 'https'
+        http.use_ssl = true
+        http.verify_mode = RackCAS.config.verify_ssl_cert? ? OpenSSL::SSL::VERIFY_PEER : OpenSSL::SSL::VERIFY_NONE
+      end
+
+      now = Time.now
+
+      data = %Q~<?xml version='1.0'?>
+      <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
+        <SOAP-ENV:Header/>
+        <SOAP-ENV:Body>
+          <samlp:Request xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" MajorVersion="1" MinorVersion="1" RequestID="_#{ip_address}.#{now.to_i}" IssueInstant="#{now.strftime("%FT%TZ")}">
+            <samlp:AssertionArtifact>#{@ticket}</samlp:AssertionArtifact>
+          </samlp:Request>
+        </SOAP-ENV:Body>
+      </SOAP-ENV:Envelope>~
+
+      @response = http.post(@url.request_uri, data, REQUEST_HEADERS)
+    end
+
+    def xml
+      return @xml unless @xml.nil?
+
+      @xml = Nokogiri::XML(response.body).remove_namespaces!
+    end
+
+    def ip_address
+      require 'socket'
+
+      return @ip_address unless @ip_address.nil?
+
+      begin
+        @ip_address = Socket.ip_address_list.detect{ |intf|
+            intf.ipv4? and !intf.ipv4_loopback? and !intf.ipv4_multicast? and !intf.ipv4_private?
+          }.ip_address
+      rescue
+        @ip_address = '127.0.0.1'
+      end
+    end
+  end
+end

data/lib/rack-cas/server.rb

@@ -1,4 +1,5 @@
 require 'rack-cas/url'
+require 'rack-cas/saml_validation_response'
 require 'rack-cas/service_validation_response'
 
 module RackCAS
@@ -23,12 +24,21 @@ module RackCAS
     end
 
     def validate_service(service_url, ticket)
-      response = ServiceValidationResponse.new validate_service_url(service_url, ticket)
+      unless RackCAS.config.use_saml_validation?
+        response = ServiceValidationResponse.new validate_service_url(service_url, ticket)
+      else
+        response = SAMLValidationResponse.new saml_validate_url(service_url), ticket
+      end
       [response.user, response.extra_attributes]
     end
 
     protected
 
+    def saml_validate_url(service_url)
+      service_url = URL.parse(service_url).remove_param('ticket').to_s
+      @url.dup.append_path('samlValidate').add_params(TARGET: service_url)
+    end
+
     def validate_service_url(service_url, ticket)
       service_url = URL.parse(service_url).remove_param('ticket').to_s
       @url.dup.append_path('serviceValidate').add_params(service: service_url, ticket: ticket)

data/lib/rack-cas/version.rb

@@ -1,3 +1,3 @@
 module RackCAS
-  VERSION = '0.10.1'
+  VERSION = '0.11.0'
 end

data/lib/rack/cas.rb

@@ -25,7 +25,7 @@ class Rack::CAS
 
       begin
         user, extra_attrs = get_user(request.url, cas_request.ticket)
-      rescue RackCAS::ServiceValidationResponse::TicketInvalidError
+      rescue RackCAS::ServiceValidationResponse::TicketInvalidError, RackCAS::SAMLValidationResponse::TicketInvalidError
         log env, 'rack-cas: Invalid ticket. Redirecting to CAS login.'
 
         return redirect_to server.login_url(cas_request.service_url).to_s

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-cas
 version: !ruby/object:Gem::Version
-  version: 0.10.1
+  version: 0.11.0
 platform: ruby
 authors:
 - Adam Crownoble
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-03-18 00:00:00.000000000 Z
+date: 2015-06-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -122,15 +122,13 @@ files:
 - lib/rack-cas/cas_request.rb
 - lib/rack-cas/configuration.rb
 - lib/rack-cas/railtie.rb
+- lib/rack-cas/saml_validation_response.rb
 - lib/rack-cas/server.rb
 - lib/rack-cas/service_validation_response.rb
 - lib/rack-cas/session_store/active_record.rb
-- lib/rack-cas/session_store/mongo.rb
 - lib/rack-cas/session_store/mongoid.rb
-- lib/rack-cas/session_store/rack/mongo.rb
 - lib/rack-cas/session_store/rack/mongoid.rb
 - lib/rack-cas/session_store/rails/active_record.rb
-- lib/rack-cas/session_store/rails/mongo.rb
 - lib/rack-cas/session_store/rails/mongoid.rb
 - lib/rack-cas/url.rb
 - lib/rack-cas/version.rb

data/lib/rack-cas/session_store/mongo.rb

@@ -1,45 +0,0 @@
-module RackCAS
-  module MongoStore
-    def collection
-      @collection
-    end
-
-    def initialize(app, options = {})
-      require 'mongo'
-
-      unless options[:collection]
-        raise "To avoid creating multiple connections to MongoDB, " +
-              "the Mongo Session Store will not create it's own connection " +
-              "to MongoDB - you must pass in a collection with the :collection option"
-      end
-
-      @collection = options[:collection].respond_to?(:call) ? options[:collection].call : options[:collection]
-
-      super
-    end
-
-    private
-    def get_session(env, sid)
-      sid ||= generate_sid
-      session = collection.find(_id: sid).first || {}
-      [sid, unpack(session['data'])]
-    end
-
-    def set_session(env, sid, session_data, options = {})
-      sid ||= generate_sid
-      collection.update({'_id' => sid},
-                        {'_id' => sid, 'data' => pack(session_data), 'updated_at' => Time.now},
-                        upsert: true)
-      sid # TODO: return boolean, right?
-    end
-
-    def pack(data)
-      [Marshal.dump(data)].pack('m*')
-    end
-
-    def unpack(packed)
-      return nil unless packed
-      Marshal.load(packed.unpack('m*').first)
-    end
-  end
-end

data/lib/rack-cas/session_store/rack/mongo.rb

@@ -1,10 +0,0 @@
-require 'rack-cas/session_store/mongo'
-require 'rack/session/abstract/id'
-
-module Rack
-  module Session
-    class RackCASMongoStore < Rack::Session::Abstract::ID
-      include RackCAS::MongoStore
-    end
-  end
-end

data/lib/rack-cas/session_store/rails/mongo.rb

@@ -1,10 +0,0 @@
-require 'rack-cas/session_store/mongo'
-require 'action_dispatch/middleware/session/abstract_store'
-
-module ActionDispatch
-  module Session
-    class RackCasMongoStore < AbstractStore
-      include RackCAS::MongoStore
-    end
-  end
-end