relevance-rubycas-server 0.6.99

data/custom_views.example.rb

@@ -0,0 +1,11 @@
+# Custom views file; add methods to the module definition below
+
+module CASServer::Views
+
+  # Override views here, for example, a custom login form:
+  def login_form
+    # Add your custom login form here, using Markaby
+    # See the original views.rb file at lib/casserver/views.rb for method names and usage
+  end
+
+end

data/lib/casserver.rb

@@ -0,0 +1,110 @@
+$: << File.dirname(File.expand_path(__FILE__))
+require 'casserver/environment'
+
+$APP_PATH ||= File.dirname(File.expand_path(__FILE__))
+
+# change to current directory when invoked on its own
+Dir.chdir($APP_PATH) if __FILE__ == $0
+
+$: << $APP_PATH + "/../vendor/isaac_0.9.1"
+require 'crypt/ISAAC'
+
+require 'active_support'
+require 'yaml'
+
+
+# Camping.goes must be called after the authenticator class is loaded, otherwise weird things happen
+Camping.goes :CASServer
+
+$CONFIG_FILE ||= '/etc/rubycas-server/config.yml'
+
+# for some reason this makes JRuby happy
+class CASServer::Models::Base
+end
+
+CASServer.picnic!
+
+$CONF[:expire_sessions] ||= false
+$CONF[:login_ticket_expiry] ||= 5.minutes
+$CONF[:service_ticket_expiry] ||= 5.minutes # CAS Protocol Spec, sec. 3.2.1 (recommended expiry time)
+$CONF[:proxy_granting_ticket_expiry] ||= 48.hours
+$CONF[:ticket_granting_ticket_expiry] ||= 48.hours
+$CONF[:log] ||= {:file => 'casserver.log', :level => 'DEBUG'}
+$CONF[:uri_path] ||= "/"
+
+unless $CONF[:authenticator]
+  $stderr.puts
+  $stderr.puts "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+  $stderr.puts
+  $stderr.puts "You have not yet defined an authenticator for your CAS server!"
+  $stderr.puts "Please consult your config file at #{$CONFIG_FILE.inspect} for details."
+  $stderr.puts
+  $stderr.puts "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+  exit 1
+end
+
+require 'casserver/utils'
+require 'casserver/models'
+require 'casserver/cas'
+require 'casserver/views'
+require 'casserver/controllers'
+
+if $CONF[:authenticator].instance_of? Array
+  $CONF[:authenticator].each_index do |auth_index| 
+    $CONF[:authenticator][auth_index] = HashWithIndifferentAccess.new($CONF[:authenticator][auth_index])
+  end
+end
+
+$AUTH = []
+begin
+  # attempt to instantiate the authenticator
+  if $CONF[:authenticator].instance_of? Array
+    $CONF[:authenticator].each { |authenticator| $AUTH << authenticator[:class].constantize.new}
+  else
+    $AUTH << $CONF[:authenticator][:class].constantize.new
+  end
+rescue NameError
+  if $CONF[:authenticator].instance_of? Array
+    $CONF[:authenticator].each do |authenticator|
+      if !authenticator[:source].nil?
+        # config.yml explicitly names source file
+        require authenticator[:source]
+      else
+        # the authenticator class hasn't yet been loaded, so lets try to load it from the casserver/authenticators directory
+        auth_rb = authenticator[:class].underscore.gsub('cas_server/', '')
+        require 'casserver/'+auth_rb
+      end
+      $AUTH << authenticator[:class].constantize.new
+    end
+  else
+    if !$CONF[:authenticator][:source].nil?
+      # config.yml explicitly names source file
+      require $CONF[:authenticator][:source]
+    else
+      # the authenticator class hasn't yet been loaded, so lets try to load it from the casserver/authenticators directory
+      auth_rb = $CONF[:authenticator][:class].underscore.gsub('cas_server/', '')
+      require 'casserver/'+auth_rb
+    end
+
+    $AUTH << $CONF[:authenticator][:class].constantize.new
+  end
+end
+
+$CONF[:public_dir] = {
+  :path => "/themes",
+  :dir  => File.expand_path(File.dirname(__FILE__))+"/themes"
+}
+
+def CASServer.create
+  $LOG.info "Creating RubyCAS-Server..."
+  CASServer::Models::Base.establish_connection(CASServer::Conf.database)
+  CASServer::Models.create_schema
+  
+  CASServer::Models::ServiceTicket.cleanup_expired(CASServer::Conf.service_ticket_expiry)
+  CASServer::Models::LoginTicket.cleanup_expired(CASServer::Conf.login_ticket_expiry)
+  CASServer::Models::ProxyGrantingTicket.cleanup_expired(CASServer::Conf.proxy_granting_ticket_expiry)
+  CASServer::Models::TicketGrantingTicket.cleanup_expired(CASServer::Conf.ticket_granting_ticket_expiry)
+end
+
+
+CASServer.start_picnic

data/lib/casserver/authenticators/active_directory_ldap.rb

@@ -0,0 +1,11 @@
+require 'casserver/authenticators/ldap'
+
+# Slightly modified version of the LDAP authenticator for Microsoft's ActiveDirectory.
+# The only difference is that the default_username_attribute for AD is 'sAMAccountName'
+# rather than 'uid'.
+class CASServer::Authenticators::ActiveDirectoryLDAP < CASServer::Authenticators::LDAP
+  protected
+  def default_username_attribute
+    "sAMAccountName"
+  end
+end

data/lib/casserver/authenticators/base.rb

@@ -0,0 +1,47 @@
+module CASServer
+  module Authenticators
+    class Base
+      attr_accessor :options
+      attr_reader :username # make this accessible so that we can pick up any 
+                            # transformations done within the authenticator
+    
+      def validate(credentials)
+        raise NotImplementedError, "This method must be implemented by a class extending #{self.class}"
+      end
+      
+      def configure(options)
+        raise ArgumentError, "options must be a HashWithIndifferentAccess" unless options.kind_of? HashWithIndifferentAccess
+        @options = options.dup
+      end
+      
+      def extra_attributes
+        @extra_attributes
+      end
+      
+      protected
+      def read_standard_credentials(credentials)
+        @username = credentials[:username]
+        @password = credentials[:password]
+        @service = credentials[:service]
+        @request = credentials[:request]
+      end
+      
+      def extra_attributes_to_extract
+        if @options[:extra_attributes].kind_of? Array
+          attrs = @options[:extra_attributes]
+        elsif @options[:extra_attributes].kind_of? String
+          attrs = @options[:extra_attributes].split(',').collect{|col| col.strip}
+        else
+          $LOG.error("Can't figure out attribute list from #{@options[:extra_attributes].inspect}. This must be an Aarray of column names or a comma-separated list.")
+          attrs = []
+        end
+        
+        $LOG.debug("#{self.class.name} will try to extract the following extra_attributes: #{attrs.inspect}")
+        return attrs
+      end
+    end
+  end
+  
+  class AuthenticatorError < Exception
+  end
+end

data/lib/casserver/authenticators/ldap.rb

@@ -0,0 +1,108 @@
+require 'casserver/authenticators/base'
+
+begin
+  require 'net/ldap'
+rescue LoadError
+  require 'rubygems'
+  begin
+    gem 'ruby-net-ldap', '~> 0.0.4'
+  rescue Gem::LoadError
+    $stderr.puts
+    $stderr.puts "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+    $stderr.puts
+    $stderr.puts "To use the LDAP/AD authenticator, you must first install the 'ruby-net-ldap' gem."
+    $stderr.puts
+    $stderr.puts "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+    exit 1
+  end
+  require 'net/ldap'
+end
+
+# Basic LDAP authenticator. Should be compatible with OpenLDAP and other similar LDAP servers,
+# although it hasn't been officially tested. See example config file for details on how
+# to configure it.
+class CASServer::Authenticators::LDAP < CASServer::Authenticators::Base
+  def validate(credentials)
+    read_standard_credentials(credentials)
+
+    return false if @password.blank?
+   
+    raise CASServer::AuthenticatorError, "Cannot validate credentials because the authenticator hasn't yet been configured" unless @options
+    raise CASServer::AuthenticatorError, "Invalid authenticator configuration!" unless @options[:ldap]
+    raise CASServer::AuthenticatorError, "You must specify an ldap server in the configuration!" unless @options[:ldap][:server]
+    
+    raise CASServer::AuthenticatorError, "The username '#{@username}' contains invalid characters." if (@username =~ /[*\(\)\0\/]/)
+    
+    preprocess_username
+    
+    @ldap = Net::LDAP.new
+    @ldap.host = @options[:ldap][:server]
+    @ldap.port = @options[:ldap][:port] if @options[:ldap][:port]
+    
+    begin
+      if @options[:ldap][:auth_user]
+        bind_with_preauthentication
+      else
+        bind_directly
+      end
+    rescue Net::LDAP::LdapError => e
+      raise CASServer::AuthenticatorError,
+        "LDAP authentication failed with '#{e}'. Check your authenticator configuration."
+    end
+  end
+  
+  protected
+    def default_username_attribute
+      "uid"
+    end
+  
+  private
+    def preprocess_username
+      # add prefix to username, if prefix was specified in the config
+      @username = @options[:ldap][:username_prefix] + @username if @options[:ldap][:username_prefix]
+    end
+    
+    def bind_with_preauthentication
+      # If an auth_user is specified, we will connect ("pre-authenticate") to the
+      # LDAP server using the authenticator account, and then attempt to bind as the
+      # user who is actually trying to authenticate. Note that you need to set up 
+      # the special authenticator account first. Also, auth_user must be the authenticator
+      # user's full CN, which is probably not the same as their username.
+      #
+      # This pre-authentication process is necessary because binding can only be done
+      # using the CN, so having just the username is not enough. We connect as auth_user, 
+      # and then try to find the target user's CN based on the given username. Then we bind
+      # as the target user to validate their credentials.
+      
+      raise CASServer::AuthenticatorError, "A password must be specified in the configuration for the authenticator user!" unless 
+        @options[:ldap][:auth_password]
+      
+      @ldap.authenticate(@options[:ldap][:auth_user], @options[:ldap][:auth_password])
+      
+      username_attribute = options[:ldap][:username_attribute] || default_username_attribute
+      
+      filter = Net::LDAP::Filter.construct(@options[:ldap][:filter]) if 
+        @options[:ldap][:filter] && !@options[:ldap][:filter].blank?
+      username_filter = Net::LDAP::Filter.eq(username_attribute, @username)
+      if filter
+        filter &= username_filter
+      else
+        filter = username_filter
+      end
+      
+      @ldap.bind_as(:base => @options[:ldap][:base], :password => @password, :filter => filter)
+    end
+    
+    def bind_directly
+      # When no auth_user is specified, we will try to connect directly as the user
+      # who is trying to authenticate. Note that for this to work, the username must
+      # be equivalent to the user's CN, and this is often not the case (for example,
+      # in Active Directory, the username is the 'sAMAccountName' attribute, while the
+      # user's CN is generally their full name.)
+      
+      cn = @username
+      
+      @ldap.authenticate(cn, @password)
+      @ldap.bind
+    end
+end

data/lib/casserver/authenticators/ntlm.rb

@@ -0,0 +1,88 @@
+# THIS AUTHENTICATOR DOES NOT WORK (not even close!)
+#
+# I started working on this but run into a wall, so I am commiting what I've got
+# done and leaving it here with hopes of one day finishing it.
+# 
+# The main problem is that although I've got the Lan Manager/NTLM password hash,
+# I'm not sure what to do with it. i.e. I need to check it against the AD or SMB
+# server or something... maybe faking an SMB share connection and using the LM
+# response for authentication might do the trick?
+
+require 'casserver/authenticators/base'
+
+# Ruby/NTLM package from RubyForge
+require 'net/ntlm'
+
+module CASServer
+  module Authenticators
+    class NTLM
+      # This will have to be somehow called by the top of the 'get' method
+      # in the Login controller (maybe via a hook?)... if this code fails
+      # then the controller should fall back to some other method of authentication
+      # (probably AD/LDAP or something).
+      def filter_for_top_of_login_get_controller_method
+        $LOG.debug @env.inspect
+        if @env['HTTP_AUTHORIZATION'] =~ /NTLM ([^\s]+)/
+          # if we're here, then the client has sent back a Type1 or Type3 message
+          # in reply to our NTLM challenge or our Type2 message
+          data_raw = Base64.decode64($~[1])
+          $LOG.debug "T1 RAW: #{t1_raw}"
+          t = Net::NTLM::Message::Message.parse(t1_raw)
+          if t.kind_of? Net::NTLM::Type1
+            t1 = t
+          elsif t.kind_of? Net::NTLM::Type3
+            t3 = t
+          else
+            raise "Invalid NTLM reply from client."
+          end
+          
+          if t1
+            $LOG.debug "T1: #{t1.inspect}"
+            
+            # now put together a Type2 message asking for the client to send
+            # back NTLM credentials (LM hash and such)
+            t2 = Net::NTLM::Message::Type2.new
+            t2.set_flag :UNICODE
+            t2.set_flag :NTLM
+            t2.context = 0x0000000000000000 # this can probably just be left unassigned
+            t2.challenge = 0x0123456789abcdef # this should be a random 8-byte integer
+            
+            $LOG.debug "T2: #{t2.inspect}"
+            $LOG.debug "T2: #{t2.serialize}"
+            headers["WWW-Authenticate"] = "NTLM #{t2.encode64}"
+            
+            # the client should respond to this with a Type3 message...
+            r('401', '', headers)
+            return
+          else
+            # NOTE: for some reason the server never receives the T3 response, even though monitoring
+            # the HTTP traffic I can see that the client does send it back... there's probably
+            # another bug hiding somewhere here
+          
+            lm_response = t3.lm_response
+            ntlm_response = t3.ntlm_response
+            username = t3.user
+            # this is where we run up against a wall... we need some way to check the lm and/or ntlm
+            # reponse against the authentication server (probably Active Directory)... maybe a samba
+            # call would do it?
+            $LOG.debug "T3 LM: #{lm_response.inspect}"
+            $LOG.debug "T3 NTLM: #{ntlm_response.inspect}"
+            
+            # assuming the authentication was successful, we'll now need to do something in the 
+            # controller acting as if we'd received correct login credentials (i.e. proceed as if
+            # CAS authentication was successful).... if authentication failed, then we should
+            # just fall back to old-school web-based authentication, asking the user to enter
+            # their username and password the normal CAS way
+          end
+        else
+          # this sends the initial NTLM challenge, asking the browser
+          # to send back a Type1 message
+          headers['WWW-Authenticate'] = "NTLM"
+          headers['Connection'] = "Close"
+          r('401', '', headers)
+          return
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/sql.rb

@@ -0,0 +1,102 @@
+require 'casserver/authenticators/base'
+
+begin
+  require 'active_record'
+rescue LoadError
+  require 'rubygems'
+  require 'active_record'
+end
+
+# Authenticates against a plain SQL table. 
+# 
+# This assumes that all of your users are stored in a table that has a 'username' 
+# column and a 'password' column. When the user logs in, CAS conects to the 
+# database and looks for a matching username/password in the users table. If a 
+# matching username and password is found, authentication is successful.
+#
+# Any database backend supported by ActiveRecord can be used.
+# 
+# Config example:
+#
+#   authenticator:
+#     class: CASServer::Authenticators::SQL
+#     database:
+#       adapter: mysql
+#       database: some_database_with_users_table
+#       username: root
+#       password: 
+#       server: localhost
+#     user_table: users
+#     username_column: username
+#     password_column: password
+#
+# When replying to a CAS client's validation request, the server will normally
+# provide the client with the authenticated user's username. However it is now
+# possible for the server to provide the client with additional attributes.
+# You can configure the SQL authenticator to provide data from additional
+# columns in the users table by listing the names of the columns under the 
+# 'extra_attributes' option. Note though that this functionality is experimental.
+# It should work with RubyCAS-Client, but may or may not work with other CAS
+# clients. 
+#
+# For example, with this configuration, the 'full_name' and 'access_level'
+# columns will be provided to your CAS clients along with the username:
+#
+#   authenticator:
+#     class: CASServer::Authenticators::SQL
+#     database:
+#       adapter: mysql
+#       database: some_database_with_users_table
+#     user_table: users
+#     username_column: username
+#     password_column: password
+#     extra_attributes: full_name, access_level
+# 
+class CASServer::Authenticators::SQL < CASServer::Authenticators::Base
+
+  def validate(credentials)
+    read_standard_credentials(credentials)
+    
+    raise CASServer::AuthenticatorError, "Cannot validate credentials because the authenticator hasn't yet been configured" unless @options
+    raise CASServer::AuthenticatorError, "Invalid authenticator configuration!" unless @options[:database]
+    
+    CASUser.establish_connection @options[:database]
+    CASUser.set_table_name @options[:user_table] || "users"
+    
+    username_column = @options[:username_column] || 'username'
+    password_column = @options[:password_column] || 'password'
+    
+    results = CASUser.find(:all, :conditions => ["#{username_column} = ? AND #{password_column} = ?", @username, @password])
+    
+    if results.size > 0
+      $LOG.warn("#{self.class}: Multiple matches found for user #{@username.inspect}") if results.size > 1
+      
+      unless @options[:extra_attributes].blank?
+        if results.size > 1
+          $LOG.warn("#{self.class}: Unable to extract extra_attributes because multiple matches were found for #{@username.inspect}")
+        else
+          user = results.first
+          
+          @extra_attributes = {}
+          extra_attributes_to_extract.each do |col|
+            @extra_attributes[col] = user.send(col)
+          end
+          
+          if @extra_attributes.empty?
+            $LOG.warn("#{self.class}: Did not read any extra_attributes for user #{@username.inspect} even though an :extra_attributes option was provided.")
+          else
+            $LOG.debug("#{self.class}: Read the following extra_attributes for user #{@username.inspect}: #{@extra_attributes.inspect}")
+          end
+        end
+      end
+      
+      return true
+    else
+      return false
+    end
+  end
+  
+  class CASUser < ActiveRecord::Base
+  end
+
+end