rubycas-server 0.6.0 → 0.7.0

data/casserver_db.log

@@ -0,0 +1,88 @@
+# Logfile created on Thu Mar 08 17:06:32 -0500 2007 by logger.rb/1.5.2.9
+  SQL (0.000991)   SELECT name FROM sqlite_master WHERE type = 'table'
+  SQL (0.102929)   CREATE TABLE casserver_schema_infos ("id" INTEGER PRIMARY KEY NOT NULL, "version" float DEFAULT NULL) 
+  CASServer::Models::SchemaInfo Load (0.000248)   SELECT * FROM casserver_schema_infos LIMIT 1
+  SQL (0.000000)   SQLite3::SQLException: no such table: casserver_login_tickets: DROP TABLE casserver_login_tickets
+  SQL (0.088360)   CREATE TABLE casserver_login_tickets ("id" INTEGER PRIMARY KEY NOT NULL, "ticket" varchar(255) NOT NULL, "created_on" datetime NOT NULL, "consumed" datetime DEFAULT NULL, "client_hostname" varchar(255) NOT NULL) 
+  SQL (0.000000)   SQLite3::SQLException: no such table: casserver_service_tickets: DROP TABLE casserver_service_tickets
+  SQL (0.073950)   CREATE TABLE casserver_service_tickets ("id" INTEGER PRIMARY KEY NOT NULL, "ticket" varchar(255) NOT NULL, "service" varchar(255) NOT NULL, "created_on" datetime NOT NULL, "consumed" datetime DEFAULT NULL, "client_hostname" varchar(255) NOT NULL, "username" varchar(255) NOT NULL, "type" varchar(255) NOT NULL, "proxy_granting_ticket_id" integer DEFAULT NULL) 
+  SQL (0.000000)   SQLite3::SQLException: no such table: casserver_ticket_granting_tickets: DROP TABLE casserver_ticket_granting_tickets
+  SQL (0.074600)   CREATE TABLE casserver_ticket_granting_tickets ("id" INTEGER PRIMARY KEY NOT NULL, "ticket" varchar(255) NOT NULL, "created_on" datetime NOT NULL, "client_hostname" varchar(255) NOT NULL, "username" varchar(255) NOT NULL) 
+  SQL (0.000000)   SQLite3::SQLException: no such table: casserver_proxy_granting_tickets: DROP TABLE casserver_proxy_granting_tickets
+  SQL (0.090874)   CREATE TABLE casserver_proxy_granting_tickets ("id" INTEGER PRIMARY KEY NOT NULL, "ticket" varchar(255) NOT NULL, "created_on" datetime NOT NULL, "client_hostname" varchar(255) NOT NULL, "iou" varchar(255) NOT NULL, "service_ticket_id" integer NOT NULL) 
+  SQL (0.000414)   INSERT INTO casserver_schema_infos ("version") VALUES(0.1)
+  CASServer::Models::ServiceTicket Load (0.000325)   SELECT * FROM casserver_service_tickets WHERE (created_on < '2007-03-08 17:04:11') AND ( (casserver_service_tickets."type" = 'ServiceTicket' OR casserver_service_tickets."type" = 'ProxyTicket' ) ) 
+  CASServer::Models::LoginTicket Load (0.000234)   SELECT * FROM casserver_login_tickets WHERE (created_on < '2007-03-08 17:04:11') 
+  CASServer::Models::ProxyGrantingTicket Load (0.000242)   SELECT * FROM casserver_proxy_granting_tickets WHERE (created_on < '2007-03-06 17:09:11') 
+  CASServer::Models::TicketGrantingTicket Load (0.000228)   SELECT * FROM casserver_ticket_granting_tickets WHERE (created_on < '2007-03-06 17:09:11') 
+  SQL (0.001784)   SELECT name FROM sqlite_master WHERE type = 'table'
+  CASServer::Models::SchemaInfo Load (0.000302)   SELECT * FROM casserver_schema_infos LIMIT 1
+  CASServer::Models::ServiceTicket Load (0.000226)   SELECT * FROM casserver_service_tickets WHERE (created_on < '2007-03-08 17:06:34') AND ( (casserver_service_tickets."type" = 'ServiceTicket' OR casserver_service_tickets."type" = 'ProxyTicket' ) ) 
+  CASServer::Models::LoginTicket Load (0.000158)   SELECT * FROM casserver_login_tickets WHERE (created_on < '2007-03-08 17:06:34') 
+  CASServer::Models::ProxyGrantingTicket Load (0.000164)   SELECT * FROM casserver_proxy_granting_tickets WHERE (created_on < '2007-03-06 17:11:34') 
+  CASServer::Models::TicketGrantingTicket Load (0.000240)   SELECT * FROM casserver_ticket_granting_tickets WHERE (created_on < '2007-03-06 17:11:34') 
+  SQL (0.001727)   SELECT name FROM sqlite_master WHERE type = 'table'
+  CASServer::Models::SchemaInfo Load (0.000334)   SELECT * FROM casserver_schema_infos LIMIT 1
+  CASServer::Models::ServiceTicket Load (0.000223)   SELECT * FROM casserver_service_tickets WHERE (created_on < '2007-03-08 17:27:21') AND ( (casserver_service_tickets."type" = 'ServiceTicket' OR casserver_service_tickets."type" = 'ProxyTicket' ) ) 
+  CASServer::Models::LoginTicket Load (0.000162)   SELECT * FROM casserver_login_tickets WHERE (created_on < '2007-03-08 17:27:21') 
+  CASServer::Models::ProxyGrantingTicket Load (0.000164)   SELECT * FROM casserver_proxy_granting_tickets WHERE (created_on < '2007-03-06 17:32:21') 
+  CASServer::Models::TicketGrantingTicket Load (0.000175)   SELECT * FROM casserver_ticket_granting_tickets WHERE (created_on < '2007-03-06 17:32:21') 
+  SQL (0.001986)   SELECT name FROM sqlite_master WHERE type = 'table'
+  CASServer::Models::SchemaInfo Load (0.000366)   SELECT * FROM casserver_schema_infos LIMIT 1
+  CASServer::Models::ServiceTicket Load (0.000251)   SELECT * FROM casserver_service_tickets WHERE (created_on < '2007-03-08 17:28:07') AND ( (casserver_service_tickets."type" = 'ServiceTicket' OR casserver_service_tickets."type" = 'ProxyTicket' ) ) 
+  CASServer::Models::LoginTicket Load (0.000185)   SELECT * FROM casserver_login_tickets WHERE (created_on < '2007-03-08 17:28:07') 
+  CASServer::Models::ProxyGrantingTicket Load (0.000210)   SELECT * FROM casserver_proxy_granting_tickets WHERE (created_on < '2007-03-06 17:33:07') 
+  CASServer::Models::TicketGrantingTicket Load (0.000170)   SELECT * FROM casserver_ticket_granting_tickets WHERE (created_on < '2007-03-06 17:33:07') 
+  SQL (0.001746)   SELECT name FROM sqlite_master WHERE type = 'table'
+  CASServer::Models::SchemaInfo Load (0.000303)   SELECT * FROM casserver_schema_infos LIMIT 1
+  CASServer::Models::ServiceTicket Load (0.000223)   SELECT * FROM casserver_service_tickets WHERE (created_on < '2007-03-08 17:54:26') AND ( (casserver_service_tickets."type" = 'ServiceTicket' OR casserver_service_tickets."type" = 'ProxyTicket' ) ) 
+  CASServer::Models::LoginTicket Load (0.000178)   SELECT * FROM casserver_login_tickets WHERE (created_on < '2007-03-08 17:54:26') 
+  CASServer::Models::ProxyGrantingTicket Load (0.000175)   SELECT * FROM casserver_proxy_granting_tickets WHERE (created_on < '2007-03-06 17:59:26') 
+  CASServer::Models::TicketGrantingTicket Load (0.000169)   SELECT * FROM casserver_ticket_granting_tickets WHERE (created_on < '2007-03-06 17:59:26') 
+  SQL (0.001771)   SELECT name FROM sqlite_master WHERE type = 'table'
+  CASServer::Models::SchemaInfo Load (0.000445)   SELECT * FROM casserver_schema_infos LIMIT 1
+  CASServer::Models::ServiceTicket Load (0.000221)   SELECT * FROM casserver_service_tickets WHERE (created_on < '2007-03-08 17:54:32') AND ( (casserver_service_tickets."type" = 'ServiceTicket' OR casserver_service_tickets."type" = 'ProxyTicket' ) ) 
+  CASServer::Models::LoginTicket Load (0.000171)   SELECT * FROM casserver_login_tickets WHERE (created_on < '2007-03-08 17:54:32') 
+  CASServer::Models::ProxyGrantingTicket Load (0.000163)   SELECT * FROM casserver_proxy_granting_tickets WHERE (created_on < '2007-03-06 17:59:32') 
+  CASServer::Models::TicketGrantingTicket Load (0.000161)   SELECT * FROM casserver_ticket_granting_tickets WHERE (created_on < '2007-03-06 17:59:32') 
+  SQL (0.002972)   SELECT name FROM sqlite_master WHERE type = 'table'
+  CASServer::Models::SchemaInfo Load (0.000419)   SELECT * FROM casserver_schema_infos LIMIT 1
+  CASServer::Models::ServiceTicket Load (0.000233)   SELECT * FROM casserver_service_tickets WHERE (created_on < '2007-03-08 17:55:13') AND ( (casserver_service_tickets."type" = 'ServiceTicket' OR casserver_service_tickets."type" = 'ProxyTicket' ) ) 
+  CASServer::Models::LoginTicket Load (0.000185)   SELECT * FROM casserver_login_tickets WHERE (created_on < '2007-03-08 17:55:13') 
+  CASServer::Models::ProxyGrantingTicket Load (0.000166)   SELECT * FROM casserver_proxy_granting_tickets WHERE (created_on < '2007-03-06 18:00:13') 
+  CASServer::Models::TicketGrantingTicket Load (0.000161)   SELECT * FROM casserver_ticket_granting_tickets WHERE (created_on < '2007-03-06 18:00:13') 
+  SQL (0.000631)   INSERT INTO casserver_login_tickets ("created_on", "ticket", "client_hostname", "consumed") VALUES('2007-03-08 18:00:45', 'LT-1173394845r40D9611E5DEBE39C26FAFD7E295', 'mzukowski.urbacon.net', NULL)
+  CASServer::Models::LoginTicket Load (0.000656)   SELECT * FROM casserver_login_tickets WHERE (casserver_login_tickets."ticket" = 'LT-1173394845r40D9611E5DEBE39C26FAFD7E295') LIMIT 1
+  CASServer::Models::LoginTicket Update (0.000583)   UPDATE casserver_login_tickets SET "client_hostname" = 'mzukowski.urbacon.net', "ticket" = 'LT-1173394845r40D9611E5DEBE39C26FAFD7E295', "consumed" = '2007-03-08 18:00:52', "created_on" = '2007-03-08 18:00:45' WHERE id = 1
+  SQL (0.000385)   INSERT INTO casserver_login_tickets ("created_on", "ticket", "client_hostname", "consumed") VALUES('2007-03-08 18:00:52', 'LT-1173394852r4A6A482E92868C23EAD492788D', 'mzukowski.urbacon.net', NULL)
+  SQL (0.000323)   INSERT INTO casserver_ticket_granting_tickets ("created_on", "ticket", "username", "client_hostname") VALUES('2007-03-08 18:00:52', 'TGC-1173394852r1E2C91CD940D7A6E3129DE72680', 'mzukowski', 'mzukowski.urbacon.net')
+  SQL (0.003985)   SELECT name FROM sqlite_master WHERE type = 'table'
+  CASServer::Models::SchemaInfo Load (0.000317)   SELECT * FROM casserver_schema_infos LIMIT 1
+  CASServer::Models::ServiceTicket Load (0.000235)   SELECT * FROM casserver_service_tickets WHERE (created_on < '2007-03-08 18:04:03') AND ( (casserver_service_tickets."type" = 'ServiceTicket' OR casserver_service_tickets."type" = 'ProxyTicket' ) ) 
+  CASServer::Models::LoginTicket Load (0.000520)   SELECT * FROM casserver_login_tickets WHERE (created_on < '2007-03-08 18:04:03') 
+  CASServer::Models::LoginTicket Destroy (0.000475)    DELETE FROM casserver_login_tickets
+ WHERE id = 1
+
+  CASServer::Models::LoginTicket Destroy (0.000108)    DELETE FROM casserver_login_tickets
+ WHERE id = 2
+
+  CASServer::Models::ProxyGrantingTicket Load (0.000182)   SELECT * FROM casserver_proxy_granting_tickets WHERE (created_on < '2007-03-06 18:09:03') 
+  CASServer::Models::TicketGrantingTicket Load (0.000173)   SELECT * FROM casserver_ticket_granting_tickets WHERE (created_on < '2007-03-06 18:09:03') 
+  SQL (0.000521)   INSERT INTO casserver_login_tickets ("created_on", "ticket", "client_hostname", "consumed") VALUES('2007-03-08 18:09:09', 'LT-1173395349r21CE5E4AE47C71F250F632563D8', 'mzukowski.urbacon.net', NULL)
+  CASServer::Models::LoginTicket Load (0.000479)   SELECT * FROM casserver_login_tickets WHERE (casserver_login_tickets."ticket" = 'LT-1173395349r21CE5E4AE47C71F250F632563D8') LIMIT 1
+  CASServer::Models::LoginTicket Update (0.000399)   UPDATE casserver_login_tickets SET "client_hostname" = 'mzukowski.urbacon.net', "ticket" = 'LT-1173395349r21CE5E4AE47C71F250F632563D8', "consumed" = '2007-03-08 18:09:16', "created_on" = '2007-03-08 18:09:09' WHERE id = 1
+  SQL (0.000385)   INSERT INTO casserver_login_tickets ("created_on", "ticket", "client_hostname", "consumed") VALUES('2007-03-08 18:09:16', 'LT-1173395356r4E1EB273E2EBF9E418F47C9B3E2', 'mzukowski.urbacon.net', NULL)
+  SQL (0.000330)   INSERT INTO casserver_ticket_granting_tickets ("created_on", "ticket", "username", "client_hostname") VALUES('2007-03-08 18:09:16', 'TGC-1173395356r53A8C4AD580D74F60C8A10CEFB', 'mzukowski', 'mzukowski.urbacon.net')
+  SQL (0.003537)   SELECT name FROM sqlite_master WHERE type = 'table'
+  CASServer::Models::SchemaInfo Load (0.000343)   SELECT * FROM casserver_schema_infos LIMIT 1
+  CASServer::Models::ServiceTicket Load (0.000233)   SELECT * FROM casserver_service_tickets WHERE (created_on < '2007-03-08 18:04:49') AND ( (casserver_service_tickets."type" = 'ServiceTicket' OR casserver_service_tickets."type" = 'ProxyTicket' ) ) 
+  CASServer::Models::LoginTicket Load (0.000187)   SELECT * FROM casserver_login_tickets WHERE (created_on < '2007-03-08 18:04:49') 
+  CASServer::Models::ProxyGrantingTicket Load (0.000164)   SELECT * FROM casserver_proxy_granting_tickets WHERE (created_on < '2007-03-06 18:09:49') 
+  CASServer::Models::TicketGrantingTicket Load (0.000229)   SELECT * FROM casserver_ticket_granting_tickets WHERE (created_on < '2007-03-06 18:09:49') 
+  CASServer::Models::LoginTicket Load (0.000505)   SELECT * FROM casserver_login_tickets WHERE (casserver_login_tickets."ticket" = 'LT-1173395349r21CE5E4AE47C71F250F632563D8') LIMIT 1
+  CASServer::Models::LoginTicket Update (0.000681)   UPDATE casserver_login_tickets SET "client_hostname" = 'mzukowski.urbacon.net', "ticket" = 'LT-1173395349r21CE5E4AE47C71F250F632563D8', "consumed" = '2007-03-08 18:09:55', "created_on" = '2007-03-08 18:09:09' WHERE id = 1
+  SQL (0.000567)   INSERT INTO casserver_login_tickets ("created_on", "ticket", "client_hostname", "consumed") VALUES('2007-03-08 18:10:02', 'LT-1173395402r347DF2CB4392E0DC7511B4B0A6B', 'mzukowski.urbacon.net', NULL)
+  CASServer::Models::LoginTicket Load (0.000516)   SELECT * FROM casserver_login_tickets WHERE (casserver_login_tickets."ticket" = 'LT-1173395402r347DF2CB4392E0DC7511B4B0A6B') LIMIT 1
+  CASServer::Models::LoginTicket Update (0.000494)   UPDATE casserver_login_tickets SET "client_hostname" = 'mzukowski.urbacon.net', "ticket" = 'LT-1173395402r347DF2CB4392E0DC7511B4B0A6B', "consumed" = '2007-03-08 18:10:04', "created_on" = '2007-03-08 18:10:02' WHERE id = 3
+  SQL (0.000247)   INSERT INTO casserver_login_tickets ("created_on", "ticket", "client_hostname", "consumed") VALUES('2007-03-08 18:10:04', 'LT-1173395404r19BD3B2C6C6B95CD4F16E04CB1B', 'mzukowski.urbacon.net', NULL)
+  SQL (0.000340)   INSERT INTO casserver_ticket_granting_tickets ("created_on", "ticket", "username", "client_hostname") VALUES('2007-03-08 18:10:04', 'TGC-1173395404r20594EBFDC11A5D7E1437046197', 'mzukowski', 'mzukowski.urbacon.net')

data/config/hoe.rb

@@ -0,0 +1,76 @@
+require 'rubycas-server/version'
+
+AUTHOR = 'Matt Zukowski'  # can also be an array of Authors
+EMAIL = "matt@zukowski.ca"
+DESCRIPTION = "Provides single sign-on authentication for web applications using the CAS protocol."
+GEM_NAME = 'rubycas-server' # what ppl will type to install your gem
+RUBYFORGE_PROJECT = 'rubycas-server' # The unix name for your project
+HOMEPATH = "http://#{RUBYFORGE_PROJECT}.rubyforge.org"
+DOWNLOAD_PATH = "http://rubyforge.org/projects/#{RUBYFORGE_PROJECT}"
+EXTRA_DEPENDENCIES = [
+  'activesupport',
+  'activerecord',
+  ['picnic', '>= 0.7.0']
+]    # An array of rubygem dependencies [name, version]
+
+@config_file = "~/.rubyforge/user-config.yml"
+@config = nil
+RUBYFORGE_USERNAME = "unknown"
+def rubyforge_username
+  unless @config
+    begin
+      @config = YAML.load(File.read(File.expand_path(@config_file)))
+    rescue
+      puts <<-EOS
+ERROR: No rubyforge config file found: #{@config_file}
+Run 'rubyforge setup' to prepare your env for access to Rubyforge
+ - See http://newgem.rubyforge.org/rubyforge.html for more details
+      EOS
+      exit
+    end
+  end
+  RUBYFORGE_USERNAME.replace @config["username"]
+end
+
+ENV['NODOT'] = '1'
+
+REV = nil
+# UNCOMMENT IF REQUIRED:
+#REV = YAML.load(`svn info`)['Revision']
+VERS = CASServer::VERSION::STRING + (REV ? ".#{REV}" : "")
+RDOC_OPTS = ['--quiet', '--title', 'rubycas-server documentation',
+    "--opname", "index.html",
+    "--line-numbers",
+    "--main", "README",
+    "--inline-source"]
+
+class Hoe
+  def extra_deps
+    @extra_deps.reject! { |x| Array(x).first == 'hoe' }
+    @extra_deps
+  end
+end
+
+# Generate all the Rake tasks
+# Run 'rake -T' to see list of generated tasks (from gem root directory)
+$hoe = Hoe.new(GEM_NAME, VERS) do |p|
+  p.developer(AUTHOR, EMAIL)
+  p.description = DESCRIPTION
+  p.summary = DESCRIPTION
+  p.url = HOMEPATH
+  p.rubyforge_name = RUBYFORGE_PROJECT if RUBYFORGE_PROJECT
+  p.test_globs = ["test/**/test_*.rb"]
+  p.clean_globs |= ['**/.*.sw?', '*.gem', '.config', '**/.DS_Store']  #An array of file patterns to delete on clean.
+
+  # == Optional
+  p.changes = p.paragraphs_of("History.txt", 0..1).join("\n\n")
+  #p.extra_deps = EXTRA_DEPENDENCIES
+
+    p.spec_extras = {:executables => ['rubycas-server', 'rubycas-server-ctl']}    # A hash of extra values to set in the gemspec.
+  end
+
+CHANGES = $hoe.paragraphs_of('History.txt', 0..1).join("\\n\\n")
+PATH    = (RUBYFORGE_PROJECT == GEM_NAME) ? RUBYFORGE_PROJECT : "#{RUBYFORGE_PROJECT}"
+$hoe.remote_rdoc_dir = File.join(PATH.gsub(/^#{RUBYFORGE_PROJECT}\/?/,''), 'rdoc')
+$hoe.rsync_args = '-av --delete --ignore-errors'
+$hoe.spec.post_install_message = File.open(File.dirname(__FILE__) + "/../PostInstall.txt").read rescue ""

data/config/requirements.rb

@@ -0,0 +1,15 @@
+require 'fileutils'
+include FileUtils
+
+require 'rubygems'
+%w[rake hoe newgem rubigen].each do |req_gem|
+  begin
+    require req_gem
+  rescue LoadError
+    puts "This Rakefile requires the '#{req_gem}' RubyGem."
+    puts "Installation: gem install #{req_gem} -y"
+    exit
+  end
+end
+
+$:.unshift(File.join(File.dirname(__FILE__), %w[.. lib]))

data/config.example.yml

@@ -119,6 +119,9 @@ database:
 # If you prefer to have your passwords stored in an encrypted form, have a 
 # look at the SQLEncrypted authenticator: 
 # http://code.google.com/p/rubycas-server/wiki/UsingTheSQLEncryptedAuthenticator
+#
+# If your users table stores passwords with MD5 hashing (for example as with
+# Drupal) try using the SQLMd5 version of the SQL authenticator.
 # 
 # Example:
 #
@@ -134,6 +137,61 @@ database:
 #  username_column: username
 #  password_column: password
 #
+# When replying to a CAS client's validation request, the server will normally
+# provide the client with the authenticated user's username. However it is now
+# possible for the server to provide the client with additional attributes.
+# You can configure the SQL authenticator to provide data from additional
+# columns in the users table by listing the names of the columns under the 
+# 'extra_attributes' option. Note though that this functionality is experimental.
+# It should work with RubyCAS-Client, but may or may not work with other CAS
+# clients. 
+#
+# For example, with this configuration, the 'full_name' and 'access_level'
+# columns will be provided to your CAS clients along with the username:
+#
+#authenticator:
+#  class: CASServer::Authenticators::SQL
+#  database:
+#    adapter: mysql
+#    database: some_database_with_users_table
+#  user_table: users
+#  username_column: username
+#  password_column: password
+#  extra_attributes: full_name, access_level
+#
+#
+# === Google Authentication ====================================================
+#
+# The Google authenticator allows users to log in to your CAS server using
+# their Google account credentials (i.e. the same email and password they
+# would use to log in to Google services like Gmail). This authenticator
+# requires no special configuration -- just specify its class name:
+#
+#authenticator:
+#  class: CASServer::Authenticators::Google
+#
+# Note that as with all authenticators, it is possible to use the Google 
+# authenticator alongside other authenticators. For example, CAS can first
+# attempt to validate the account with Google, and if that fails, fall back
+# to some other local authentication mechanism.
+#
+# For example:
+#
+#authenticator:
+#  -
+#    class: CASServer::Authenticators::Google
+#  -
+#    class: CASServer::Authenticators::SQL
+#    database:
+#      adapter: mysql
+#      database: some_database_with_users_table
+#      user: root
+#      password:
+#      server: localhost
+#    user_table: user
+#    username_column: username
+#    password_column: password
+#
 #
 # === ActiveDirectory Authentication ===========================================
 #
@@ -145,9 +203,11 @@ database:
 # to be an administrative account -- it only has to be able to search for other
 # users.
 # 
-# Note that the auth_user parameter must be the user's CN (Common Name)!
-# In Active Directory, the CN is genarally the user's full name, which is not 
-# the same as their username (sAMAccountName).
+# Note that the auth_user parameter must be the user's CN (Common Name).
+# In Active Directory, the CN is genarally the user's full name, which is NOT 
+# generally the same as their username (sAMAccountName).
+#
+# For example:
 #
 #authenticator: 
 #  class: CASServer::Authenticators::ActiveDirectoryLDAP
@@ -159,6 +219,22 @@ database:
 #    auth_user: authenticator
 #    auth_password: itsasecret
 #
+# A more complicated example, where the authenticator will use TLS encryption,
+# will ignore users with disabled accounts, and will pass on the 'cn' and 'mail' 
+# attributes to CAS clients:
+#
+#authenticator:
+#  class: CASServer::Authenticators::ActiveDirectoryLDAP
+#  ldap:
+#    server: ad.example.net
+#    port: 636
+#    base: dc=example,dc=net
+#    filter: (objectClass=person) & !(msExchHideFromAddressLists=TRUE)
+#    auth_user: authenticator
+#    auth_password: itsasecret
+#    encryption: simple_tls
+#  extra_attributes: cn, mail
+#
 # It is possible to authenticate against Active Directory without the
 # authenticator user, but this requires that users type in their CN as
 # the username rather than typing in their sAMAccountName. In other words
@@ -173,14 +249,42 @@ database:
 # The configuration is similar, except you don't need an authenticator
 # username or password. Note that this authenticator hasn't been widely
 # tested, so it is not guaranteed to work.
-#=====
+#
 #authenticator:
-#  class: CASServer::Authenticators::ActiveDirectoryLDAP
+#  class: CASServer::Authenticators::LDAP
 #  ldap:
-#    server: ad.example.net
+#    server: ldap.example.net
+#    port: 389
+#    base: dc=example,dc=net
+#    filter: (objectClass=person)
+#
+# If you need more secure connections via TSL, specify the 'encryption'
+# option and change the port:
+#
+#authenticator:
+#  class: CASServer::Authenticators::LDAP
+#  ldap:
+#    server: ldap.example.net
+#    port: 636
+#    base: dc=example,dc=net
+#    filter: (objectClass=person)
+#    encryption: simple_tls
+#
+# If you need additional data about the user passed to the client (for example,
+# their 'cn' and 'mail' attributes, you can specify the list of attributes
+# under the extra_attributes config option: 
+#
+#authenticator:
+#  class: CASServer::Authenticators::LDAP
+#  ldap:
+#    server: ldap.example.net
 #    port: 389
 #    base: dc=example,dc=net
 #    filter: (objectClass=person)
+#  extra_attributes: cn, mail
+#
+# Note that the above functionality is somewhat limited by client compatibility.
+# See the SQL authenticator notes above for more info.
 #
 #
 # === Custom Authentication ====================================================
@@ -285,6 +389,26 @@ log:
 #  file: /var/log/casserver_db.log
 
 
+##### SINGLE SIGN-OUT ##########################################################
+
+# When a user logs in to a CAS-enabled client application, that application
+# generally opens its own local user session. When the user then logs out
+# through the CAS server, each of the CAS-enabled client applications need
+# to be notified so that they can close their own local sessions for that user.
+#
+# Up until recently this was not possible within CAS. However, a method for
+# performing this notification was recently added to the protocol (in CAS 3.1). 
+# This works exactly as described above -- when the user logs out, the CAS 
+# server individually contacts each client service and notifies it of the 
+# logout. Currently not all client applications support this, so this
+# behaviour is disabled by default. To enable it, uncomment the following
+# configuration line. Note that currently it is not possible to enable
+# or disable single-sign-out on a per-service basis, but this functionality
+# is planned for a future release.
+
+#enable_single_sign_out: true
+
+
 ##### OTHER ####################################################################
 
 # You can set various ticket expiry times (specify the value in seconds).

data/lib/casserver/authenticators/base.rb

@@ -12,6 +12,11 @@ module CASServer
       def configure(options)
         raise ArgumentError, "options must be a HashWithIndifferentAccess" unless options.kind_of? HashWithIndifferentAccess
         @options = options.dup
+        @extra_attributes = {}
+      end
+      
+      def extra_attributes
+        @extra_attributes
       end
       
       protected
@@ -19,6 +24,21 @@ module CASServer
         @username = credentials[:username]
         @password = credentials[:password]
         @service = credentials[:service]
+        @request = credentials[:request]
+      end
+      
+      def extra_attributes_to_extract
+        if @options[:extra_attributes].kind_of? Array
+          attrs = @options[:extra_attributes]
+        elsif @options[:extra_attributes].kind_of? String
+          attrs = @options[:extra_attributes].split(',').collect{|col| col.strip}
+        else
+          $LOG.error("Can't figure out attribute list from #{@options[:extra_attributes].inspect}. This must be an Aarray of column names or a comma-separated list.")
+          attrs = []
+        end
+        
+        $LOG.debug("#{self.class.name} will try to extract the following extra_attributes: #{attrs.inspect}")
+        return attrs
       end
     end
   end

data/lib/casserver/authenticators/client_certificate.rb

@@ -0,0 +1,46 @@
+require 'casserver/authenticators/base'
+
+# NOT YET IMPLEMENTED
+#
+# This authenticator will authenticate the user based on a client SSL certificate.
+#
+# You will probably want to use this along with another authenticator, chaining
+# it so that if the client does not provide a certificate, the server can
+# fall back to some other authentication mechanism.
+#
+# Here's an example of how to use two chained authenticators in the config.yml
+# file. The server will first use the ClientCertificate authenticator, and 
+# only fall back to the SQL authenticator of the first one fails:
+#
+# authenticator:
+#  -
+#    class: CASServer::Authenticators::ClientCertificate
+#  -
+#    class: CASServer::Authenticators::SQL
+#    database:
+#      adapter: mysql
+#      database: some_database_with_users_table
+#      user: root
+#      password:
+#      server: localhost
+#    user_table: user
+#    username_column: username
+#    password_column: password
+#
+class CASServer::Authenticators::ClientCertificate < CASServer::Authenticators::Base
+  def validate(credentials)
+    read_standard_credentials(credentials)
+    
+    @client_cert = credentials[:request]['SSL_CLIENT_CERT']
+    
+    # note that I haven't actually tested to see if SSL_CLIENT_CERT gets
+    # filled with data when a client cert is provided, but this should be
+    # the case at least in theory :)
+    
+    return false if @client_cert.blank?
+    
+    # IMPLEMENT SSL CERTIFICATE VALIDATION CODE HERE
+    
+    return true # if SSL certificate is valid, false otherwise
+  end
+end

data/lib/casserver/authenticators/google.rb

@@ -0,0 +1,54 @@
+require 'casserver/authenticators/base'
+require 'uri'
+require 'net/http'
+require 'net/https'
+require 'timeout'
+
+# Validates Google accounts against Google's authentication service -- in other 
+# words, this authenticator allows users to log in to CAS using their
+# Gmail/Google accounts.
+class CASServer::Authenticators::Google < CASServer::Authenticators::Base
+  def validate(credentials)
+    read_standard_credentials(credentials)
+
+    return false if @username.blank? || @password.blank?
+   
+    auth_data = {
+      'Email'   => @username, 
+      'Passwd'  => @password, 
+      'service' => 'xapi', 
+      'source'  => 'RubyCAS-Server',
+      'accountType' => 'HOSTED_OR_GOOGLE'
+    }
+   
+    url = URI.parse('https://www.google.com/accounts/ClientLogin')
+    http = Net::HTTP.new(url.host, url.port)
+    http.use_ssl = true
+    
+    # TODO: make the timeout configurable
+    wait_seconds = 10
+    begin
+      timeout(wait_seconds) do
+        res = http.start do |conn|
+          req = Net::HTTP::Post.new(url.path)
+          req.set_form_data(auth_data,'&')
+          conn.request(req)
+        end
+        
+        case res
+        when Net::HTTPSuccess
+          true
+        when Net::HTTPForbidden
+          false
+        else
+          $LOG.error("Unexpected response from Google while validating credentials: #{res.inspect} ==> #{res.body}.")
+          raise CASServer::AuthenticatorError, "Unexpected response received from Google while validating credentials."
+        end
+      end
+    rescue Timeout::Error
+      $LOG.error("Google did not respond to the credential validation request. We waited for #{wait_seconds.inspect} seconds before giving up.")
+      raise CASServer::AuthenticatorError, "Timeout while waiting for Google to validate credentials."
+    end
+
+  end
+end