rubycas-server 0.7.1.1 → 1.0

data/lib/casserver/authenticators/active_directory_ldap.rb

@@ -8,4 +8,12 @@ class CASServer::Authenticators::ActiveDirectoryLDAP < CASServer::Authenticators
   def default_username_attribute
     "sAMAccountName"
   end
+
+  def extract_extra_attributes(ldap_entry)
+    super(ldap_entry)
+    if @extra_attributes["objectGUID"]
+      @extra_attributes["guid"] = @extra_attributes["objectGUID"].to_s.unpack("H*").to_s
+    end
+    ldap_entry
+  end
 end

data/lib/casserver/authenticators/active_resource.rb

@@ -0,0 +1,125 @@
+require 'casserver/authenticators/base'
+
+begin
+  require 'active_resource'
+rescue LoadError
+  require 'rubygems'
+  begin
+    gem 'activeresource', '~> 3.0.0'
+  rescue Gem::LoadError
+    $stderr.puts
+    $stderr.puts "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+    $stderr.puts
+    $stderr.puts "To use the ActiveResource authenticator, you must first install the 'activeresource' gem."
+    $stderr.puts
+    $stderr.puts "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+    exit 1
+  end
+  require 'active_resource'
+end
+
+module CASServer
+  module Authenticators
+
+    module Helpers
+      class Identity < ActiveResource::Base
+
+        # define method_name accessor
+        cattr_accessor(:method_name) do
+          :authenticate # default value
+        end
+
+        def self.method_type
+          @@method_type ||= :post
+        end
+
+        def self.method_type= type
+          methods = [:get, :post, :put, :delete]
+          raise ArgumentError, "Method type should be one of #{methods.map { |m| m.to_s.upcase }.join(', ')}" unless methods.include? type.to_sym
+          @@method_type = type
+        end
+
+        # Autenticate an identity using the given method
+        # @param [Hash] credentials
+        def self.authenticate(credentials = {})
+          response = send(method_type, method_name, credentials)
+          new.from_authentication_data(response)
+        end
+
+        # Used to load object attributes from the given response
+        def from_authentication_data response
+          load_attributes_from_response(response)
+        end
+      end
+    end
+
+    class ActiveResource < Base
+
+      # This is called at server startup.
+      # Any class-wide initializiation for the authenticator should be done here.
+      # (e.g. establish database connection).
+      # You can leave this empty if you don't need to set up anything.
+      def self.setup(options)
+        raise AuthenticatorError, 'You must define at least site option' unless options[:site]
+        # apply options to active resource object
+        options.each do |method, arg|
+          Helpers::Identity.send "#{method}=", arg if Helpers::Identity.respond_to? "#{method}="
+        end
+        $LOG.info "ActiveResource configuration loaded"
+      end
+
+      # Override this to implement your authentication credential validation.
+      # This is called each time the user tries to log in. The credentials hash
+      # holds the credentials as entered by the user (generally under :username
+      # and :password keys; :service and :request are also included by default)
+      #
+      # Note that the standard credentials can be read in to instance variables
+      # by calling #read_standard_credentials.
+      def validate(credentials)
+        begin
+          $LOG.debug("Starting Active Resource authentication")
+          result = Helpers::Identity.authenticate(credentials.except(:request))
+          extract_extra_attributes(result) if result
+          !!result
+        rescue ::ActiveResource::ConnectionError => e
+          $LOG.warn("Error during authentication: #{e}")
+          false
+        end
+      end
+
+      private
+
+      def extract_extra_attributes(resource)
+        @extra_attributes = {}
+        $LOG.debug("Parsing extra attributes")
+        if @options[:extra_attributes]
+          extra_attributes_to_extract.each do |attr|
+            @extra_attributes[attr] = resource.send(attr).to_s
+          end
+        else
+          @extra_attributes = resource.attributes
+        end
+        # do filtering
+        extra_attributes_to_filter.each do |attr|
+          @extra_attributes.delete(attr)
+        end
+      end
+
+      # extract attributes to filter from the given configuration
+      def extra_attributes_to_filter
+        # default value if not set
+        return ['password'] unless @options[:filter_attributes]
+        # parse option value
+        if @options[:filter_attributes].kind_of? Array
+          attrs = @options[:filter_attributes]
+        elsif @options[:filter_attributes].kind_of? String
+          attrs = @options[:filter_attributes].split(',').collect { |col| col.strip }
+        else
+          $LOG.error("Can't figure out attribute list from #{@options[:filter_attributes].inspect}. This must be an Aarray of column names or a comma-separated list.")
+          attrs = []
+        end
+        attrs
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/aes256.rb

@@ -0,0 +1,43 @@
+require "openssl"
+
+module Authlogic
+  module CryptoProviders
+    # This encryption method is reversible if you have the supplied key. So in order to use this encryption method you must supply it with a key first.
+    # In an initializer, or before your application initializes, you should do the following:
+    #
+    #   Authlogic::CryptoProviders::AES256.key = "my really long and unique key, preferrably a bunch of random characters"
+    #
+    # My final comment is that this is a strong encryption method, but its main weakness is that its reversible. If you do not need to reverse the hash
+    # then you should consider Sha512 or BCrypt instead.
+    #
+    # Keep your key in a safe place, some even say the key should be stored on a separate server.
+    # This won't hurt performance because the only time it will try and access the key on the separate server is during initialization, which only
+    # happens once. The reasoning behind this is if someone does compromise your server they won't have the key also. Basically, you don't want to
+    # store the key with the lock.
+    class AES256
+      class << self
+        attr_writer :key
+
+        def encrypt(*tokens)
+          aes.encrypt
+          aes.key = @key
+          [aes.update(tokens.join) + aes.final].pack("m").chomp
+        end
+
+        def matches?(crypted, *tokens)
+          aes.decrypt
+          aes.key = @key
+          (aes.update(crypted.unpack("m").first) + aes.final) == tokens.join
+        rescue OpenSSL::CipherError
+          false
+        end
+
+        private
+          def aes
+            raise ArgumentError.new("You must provide a key like #{name}.key = my_key before using the #{name}") if @key.blank?
+            @aes ||= OpenSSL::Cipher::Cipher.new("AES-256-ECB")
+          end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/bcrypt.rb

@@ -0,0 +1,92 @@
+begin
+  require "bcrypt"
+rescue LoadError
+end
+
+module Authlogic
+  module CryptoProviders
+    # For most apps Sha512 is plenty secure, but if you are building an app that stores nuclear launch codes you might want to consier BCrypt. This is an extremely
+    # secure hashing algorithm, mainly because it is slow. A brute force attack on a BCrypt encrypted password would take much longer than a brute force attack on a
+    # password encrypted with a Sha algorithm. Keep in mind you are sacrificing performance by using this, generating a password takes exponentially longer than any
+    # of the Sha algorithms. I did some benchmarking to save you some time with your decision:
+    #
+    #   require "bcrypt"
+    #   require "digest"
+    #   require "benchmark"
+    #
+    #   Benchmark.bm(18) do |x|
+    #     x.report("BCrypt (cost = 10:") { 100.times { BCrypt::Password.create("mypass", :cost => 10) } }
+    #     x.report("BCrypt (cost = 2:") { 100.times { BCrypt::Password.create("mypass", :cost => 2) } }
+    #     x.report("Sha512:") { 100.times { Digest::SHA512.hexdigest("mypass") } }
+    #     x.report("Sha1:") { 100.times { Digest::SHA1.hexdigest("mypass") } }
+    #   end
+    #
+    #                           user     system      total        real
+    #   BCrypt (cost = 10): 10.780000   0.060000  10.840000 ( 11.100289)
+    #   BCrypt (cost = 2):  0.180000   0.000000   0.180000 (  0.181914)
+    #   Sha512:             0.000000   0.000000   0.000000 (  0.000829)
+    #   Sha1:               0.000000   0.000000   0.000000 (  0.000395)
+    #
+    # You can play around with the cost to get that perfect balance between performance and security.
+    #
+    # Decided BCrypt is for you? Just insall the bcrypt gem:
+    #
+    #   gem install bcrypt-ruby
+    #
+    # Tell acts_as_authentic to use it:
+    #
+    #   acts_as_authentic do |c|
+    #     c.crypto_provider = Authlogic::CryptoProviders::BCrypt
+    #   end
+    #
+    # You are good to go!
+    class BCrypt
+      class << self
+        # This is the :cost option for the BCrpyt library. The higher the cost the more secure it is and the longer is take the generate a hash. By default this is 10.
+        # Set this to whatever you want, play around with it to get that perfect balance between security and performance.
+        def cost
+          @cost ||= 10
+        end
+        attr_writer :cost
+
+        # Creates a BCrypt hash for the password passed.
+        def encrypt(*tokens)
+          ::BCrypt::Password.create(join_tokens(tokens), :cost => cost)
+        end
+
+        # Does the hash match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(hash, *tokens)
+          $LOG.debug hash
+          $LOG.debug tokens.inspect
+
+          hash = new_from_hash(hash)
+          return false if hash.blank?
+          hash == join_tokens(tokens)
+        end
+
+        # This method is used as a flag to tell Authlogic to "resave" the password upon a successful login, using the new cost
+        def cost_matches?(hash)
+          hash = new_from_hash(hash)
+          if hash.blank?
+            false
+          else
+            hash.cost == cost
+          end
+        end
+
+        private
+          def join_tokens(tokens)
+            tokens.flatten.join
+          end
+
+          def new_from_hash(hash)
+            begin
+              ::BCrypt::Password.new(hash)
+            rescue ::BCrypt::Errors::InvalidHash
+              return nil
+            end
+          end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/md5.rb

@@ -0,0 +1,34 @@
+require "digest/md5"
+
+module Authlogic
+  module CryptoProviders
+    # This class was made for the users transitioning from md5 based systems.
+    # I highly discourage using this crypto provider as it superbly inferior
+    # to your other options.
+    #
+    # Please use any other provider offered by Authlogic.
+    class MD5
+      class << self
+        attr_accessor :join_token
+
+        # The number of times to loop through the encryption.
+        def stretches
+          @stretches ||= 1
+        end
+        attr_writer :stretches
+
+        # Turns your raw password into a MD5 hash.
+        def encrypt(*tokens)
+          digest = tokens.flatten.join(join_token)
+          stretches.times { digest = Digest::MD5.hexdigest(digest) }
+          digest
+        end
+
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/sha1.rb

@@ -0,0 +1,59 @@
+require "digest/sha1"
+
+module Authlogic
+  module CryptoProviders
+    # This class was made for the users transitioning from restful_authentication.
+    # I highly discourage using this crypto provider as it inferior to your other options.
+    # Please use any other provider offered by Authlogic.
+    class Sha1
+      class << self
+        def join_token
+          @join_token ||= "--"
+        end
+        attr_writer :join_token
+
+        def digest_format=(format)
+          @digest_format = format
+        end
+
+        # This is for "old style" authentication with a custom format of digest
+        def digest(tokens)
+          if @digest_format
+            @digest_format.
+              gsub('PASSWORD', tokens.first).
+              gsub('SALT', tokens.last)
+          else
+            tokens.join(join_token)
+          end
+        end
+
+        # The number of times to loop through the encryption.
+        # This is ten because that is what restful_authentication defaults to.
+
+        def stretches
+          @stretches ||= 10
+        end
+        attr_writer :stretches
+
+        # Turns your raw password into a Sha1 hash.
+        def encrypt(*tokens)
+          tokens = tokens.flatten
+
+          if stretches > 1
+            hash = tokens.shift
+            stretches.times { hash = Digest::SHA1.hexdigest([hash, *tokens].join(join_token)) }
+          else
+            hash = Digest::SHA1.hexdigest( digest(tokens) )
+          end
+
+          hash
+        end
+
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/sha512.rb

@@ -0,0 +1,50 @@
+require "digest/sha2"
+
+module Authlogic
+  # The acts_as_authentic method has a crypto_provider option. This allows you to use any type of encryption you like.
+  # Just create a class with a class level encrypt and matches? method. See example below.
+  #
+  # === Example
+  #
+  #   class MyAwesomeEncryptionMethod
+  #     def self.encrypt(*tokens)
+  #       # the tokens passed will be an array of objects, what type of object is irrelevant,
+  #       # just do what you need to do with them and return a single encrypted string.
+  #       # for example, you will most likely join all of the objects into a single string and then encrypt that string
+  #     end
+  #
+  #     def self.matches?(crypted, *tokens)
+  #       # return true if the crypted string matches the tokens.
+  #       # depending on your algorithm you might decrypt the string then compare it to the token, or you might
+  #       # encrypt the tokens and make sure it matches the crypted string, its up to you
+  #     end
+  #   end
+  module CryptoProviders
+    # = Sha512
+    #
+    # Uses the Sha512 hash algorithm to encrypt passwords.
+    class Sha512
+      class << self
+        attr_accessor :join_token
+
+        # The number of times to loop through the encryption. This is ten because that is what restful_authentication defaults to.
+        def stretches
+          @stretches ||= 20
+        end
+        attr_writer :stretches
+
+        # Turns your raw password into a Sha512 hash.
+        def encrypt(*tokens)
+          digest = tokens.flatten.join(join_token)
+          stretches.times { digest = Digest::SHA512.hexdigest(digest) }
+          digest
+        end
+
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/base.rb

@@ -2,23 +2,42 @@ module CASServer
   module Authenticators
     class Base
       attr_accessor :options
-      attr_reader :username # make this accessible so that we can pick up any 
+      attr_reader :username # make this accessible so that we can pick up any
                             # transformations done within the authenticator
-    
-      def validate(credentials)
-        raise NotImplementedError, "This method must be implemented by a class extending #{self.class}"
+
+      # This is called at server startup.
+      # Any class-wide initializiation for the authenticator should be done here.
+      # (e.g. establish database connection).
+      # You can leave this empty if you don't need to set up anything.
+      def self.setup(options)
       end
-      
+
+      # This is called prior to #validate (i.e. each time the user tries to log in).
+      # Any per-instance initialization for the authenticator should be done here.
+      #
+      # By default this makes the authenticator options hash available for #validate
+      # under @options and initializes @extra_attributes to an empty hash.
       def configure(options)
         raise ArgumentError, "options must be a HashWithIndifferentAccess" unless options.kind_of? HashWithIndifferentAccess
         @options = options.dup
         @extra_attributes = {}
       end
-      
+
+      # Override this to implement your authentication credential validation.
+      # This is called each time the user tries to log in. The credentials hash
+      # holds the credentials as entered by the user (generally under :username
+      # and :password keys; :service and :request are also included by default)
+      #
+      # Note that the standard credentials can be read in to instance variables
+      # by calling #read_standard_credentials.
+      def validate(credentials)
+        raise NotImplementedError, "This method must be implemented by a class extending #{self.class}"
+      end
+
       def extra_attributes
         @extra_attributes
       end
-      
+
       protected
       def read_standard_credentials(credentials)
         @username = credentials[:username]
@@ -26,7 +45,7 @@ module CASServer
         @service = credentials[:service]
         @request = credentials[:request]
       end
-      
+
       def extra_attributes_to_extract
         if @options[:extra_attributes].kind_of? Array
           attrs = @options[:extra_attributes]
@@ -36,13 +55,13 @@ module CASServer
           $LOG.error("Can't figure out attribute list from #{@options[:extra_attributes].inspect}. This must be an Aarray of column names or a comma-separated list.")
           attrs = []
         end
-        
+
         $LOG.debug("#{self.class.name} will try to extract the following extra_attributes: #{attrs.inspect}")
         return attrs
       end
     end
   end
-  
+
   class AuthenticatorError < Exception
   end
-end
+end