rubycas-server 0.7.1.1 → 1.0

data/lib/casserver/authenticators/client_certificate.rb

@@ -9,7 +9,7 @@ require 'casserver/authenticators/base'
 # fall back to some other authentication mechanism.
 #
 # Here's an example of how to use two chained authenticators in the config.yml
-# file. The server will first use the ClientCertificate authenticator, and 
+# file. The server will first use the ClientCertificate authenticator, and
 # only fall back to the SQL authenticator of the first one fails:
 #
 # authenticator:
@@ -30,17 +30,18 @@ require 'casserver/authenticators/base'
 class CASServer::Authenticators::ClientCertificate < CASServer::Authenticators::Base
   def validate(credentials)
     read_standard_credentials(credentials)
-    
+
     @client_cert = credentials[:request]['SSL_CLIENT_CERT']
-    
+
     # note that I haven't actually tested to see if SSL_CLIENT_CERT gets
     # filled with data when a client cert is provided, but this should be
     # the case at least in theory :)
-    
+
     return false if @client_cert.blank?
-    
+
     # IMPLEMENT SSL CERTIFICATE VALIDATION CODE HERE
-    
+    raise NotImplementedError, "#{self.class.name}#validate NOT YET IMPLEMENTED!"
+
     return true # if SSL certificate is valid, false otherwise
   end
 end

data/lib/casserver/authenticators/google.rb

@@ -4,7 +4,7 @@ require 'net/http'
 require 'net/https'
 require 'timeout'
 
-# Validates Google accounts against Google's authentication service -- in other 
+# Validates Google accounts against Google's authentication service -- in other
 # words, this authenticator allows users to log in to CAS using their
 # Gmail/Google accounts.
 class CASServer::Authenticators::Google < CASServer::Authenticators::Base
@@ -12,19 +12,23 @@ class CASServer::Authenticators::Google < CASServer::Authenticators::Base
     read_standard_credentials(credentials)
 
     return false if @username.blank? || @password.blank?
-   
+
     auth_data = {
-      'Email'   => @username, 
-      'Passwd'  => @password, 
-      'service' => 'xapi', 
+      'Email'   => @username,
+      'Passwd'  => @password,
+      'service' => 'xapi',
       'source'  => 'RubyCAS-Server',
       'accountType' => 'HOSTED_OR_GOOGLE'
     }
-   
+
     url = URI.parse('https://www.google.com/accounts/ClientLogin')
-    http = Net::HTTP.new(url.host, url.port)
+    if @options[:proxy]
+      http = Net::HTTP.Proxy(@options[:proxy][:host], @options[:proxy][:port], @options[:proxy][:username], @options[:proxy][:password]).new(url.host, url.port)
+    else
+      http = Net::HTTP.new(url.host, url.port)
+    end
     http.use_ssl = true
-    
+
     # TODO: make the timeout configurable
     wait_seconds = 10
     begin
@@ -34,7 +38,7 @@ class CASServer::Authenticators::Google < CASServer::Authenticators::Base
           req.set_form_data(auth_data,'&')
           conn.request(req)
         end
-        
+
         case res
         when Net::HTTPSuccess
           true

data/lib/casserver/authenticators/ldap.rb

@@ -5,12 +5,13 @@ begin
 rescue LoadError
   require 'rubygems'
   begin
-    gem 'ruby-net-ldap', '~> 0.0.4'
+    gem 'net-ldap', '~> 0.1.1'
   rescue Gem::LoadError
     $stderr.puts
     $stderr.puts "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
     $stderr.puts
-    $stderr.puts "To use the LDAP/AD authenticator, you must first install the 'ruby-net-ldap' gem."
+    $stderr.puts "To use the LDAP/AD authenticator, you must first install the 'net-ldap' gem."
+    $stderr.puts "        See http://github.com/RoryO/ruby-net-ldap for details."
     $stderr.puts
     $stderr.puts "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
     exit 1
@@ -26,47 +27,47 @@ class CASServer::Authenticators::LDAP < CASServer::Authenticators::Base
     read_standard_credentials(credentials)
 
     return false if @password.blank?
-   
+
     raise CASServer::AuthenticatorError, "Cannot validate credentials because the authenticator hasn't yet been configured" unless @options
     raise CASServer::AuthenticatorError, "Invalid LDAP authenticator configuration!" unless @options[:ldap]
     raise CASServer::AuthenticatorError, "You must specify a server host in the LDAP configuration!" unless @options[:ldap][:host] || @options[:ldap][:server]
-        
+
     raise CASServer::AuthenticatorError, "The username '#{@username}' contains invalid characters." if (@username =~ /[*\(\)\0\/]/)
-    
+
     preprocess_username
-    
+
     @ldap = Net::LDAP.new
-    
-    
+
+
     @options[:ldap][:host] ||= @options[:ldap][:server]
     @ldap.host = @options[:ldap][:host]
     @ldap.port = @options[:ldap][:port] if @options[:ldap][:port]
     @ldap.encryption(@options[:ldap][:encryption].intern) if @options[:ldap][:encryption]
-    
+
     begin
       if @options[:ldap][:auth_user]
         bind_success = bind_by_username_with_preauthentication
       else
         bind_success = bind_by_username
       end
-      
+
       return false unless bind_success
-      
+
       entry = find_user
       extract_extra_attributes(entry)
-      
+
       return true
     rescue Net::LDAP::LdapError => e
       raise CASServer::AuthenticatorError,
         "LDAP authentication failed with '#{e}'. Check your authenticator configuration."
     end
   end
-  
+
   protected
     def default_username_attribute
       "cn"
     end
-  
+
   private
     # Add prefix to username, if :username_prefix was specified in the :ldap config.
     def preprocess_username
@@ -78,56 +79,64 @@ class CASServer::Authenticators::LDAP < CASServer::Authenticators::Base
     # added to the LDAP query for the username.
     def bind_by_username
       username_attribute = options[:ldap][:username_attribute] || default_username_attribute
-      
+
       @ldap.bind_as(:base => @options[:ldap][:base], :password => @password, :filter => user_filter)
     end
 
     # If an auth_user is specified, we will connect ("pre-authenticate") with the
     # LDAP server using the authenticator account, and then attempt to bind as the
-    # user who is actually trying to authenticate. Note that you need to set up 
+    # user who is actually trying to authenticate. Note that you need to set up
     # the special authenticator account first. Also, auth_user must be the authenticator
     # user's full CN, which is probably not the same as their username.
     #
     # This pre-authentication process is necessary because binding can only be done
-    # using the CN, so having just the username is not enough. We connect as auth_user, 
+    # using the CN, so having just the username is not enough. We connect as auth_user,
     # and then try to find the target user's CN based on the given username. Then we bind
     # as the target user to validate their credentials.
     def bind_by_username_with_preauthentication
-      raise CASServer::AuthenticatorError, "A password must be specified in the configuration for the authenticator user!" unless 
+      raise CASServer::AuthenticatorError, "A password must be specified in the configuration for the authenticator user!" unless
         @options[:ldap][:auth_password]
-      
+
       @ldap.authenticate(@options[:ldap][:auth_user], @options[:ldap][:auth_password])
-      
+
       @ldap.bind_as(:base => @options[:ldap][:base], :password => @password, :filter => user_filter)
     end
-  
+
     # Combine the filter for finding the user with the optional extra filter specified in the config
     # (if any).
     def user_filter
       username_attribute = options[:ldap][:username_attribute] || default_username_attribute
-      
-      filter = Net::LDAP::Filter.eq(username_attribute, @username)
+
+      filter = Array(username_attribute).map { |ua| Net::LDAP::Filter.eq(ua, @username) }.reduce(:|)
       unless @options[:ldap][:filter].blank?
         filter &= Net::LDAP::Filter.construct(@options[:ldap][:filter])
       end
+
+      filter
     end
-  
+
     # Finds the user based on the user_filter (this is called after authentication).
     # We do this to make it possible to extract extra_attributes.
     def find_user
       results = @ldap.search( :base => options[:ldap][:base], :filter => user_filter)
       return results.first
     end
-  
+
     def extract_extra_attributes(ldap_entry)
       @extra_attributes = {}
       extra_attributes_to_extract.each do |attr|
-        v = !ldap_entry[attr].blank? && ldap_entry[attr].first
-        if v
+        v = ldap_entry[attr]
+        next if !v || (v.respond_to?(:empty?) && v.empty?)
+        if v.kind_of?(Array)
+           @extra_attributes[attr] = []
+           ldap_entry[attr].each do |a|
+             @extra_attributes[attr] << a.to_s
+           end
+        else
           @extra_attributes[attr] = v.to_s
         end
       end
-      
+
       if @extra_attributes.empty?
         $LOG.warn("#{self.class}: Did not read any extra_attributes for user #{@username.inspect} even though an :extra_attributes option was provided.")
       else

data/lib/casserver/authenticators/ntlm.rb

@@ -2,7 +2,7 @@
 #
 # I started working on this but run into a wall, so I am commiting what I've got
 # done and leaving it here with hopes of one day finishing it.
-# 
+#
 # The main problem is that although I've got the Lan Manager/NTLM password hash,
 # I'm not sure what to do with it. i.e. I need to check it against the AD or SMB
 # server or something... maybe faking an SMB share connection and using the LM
@@ -35,10 +35,10 @@ module CASServer
           else
             raise "Invalid NTLM reply from client."
           end
-          
+
           if t1
             $LOG.debug "T1: #{t1.inspect}"
-            
+
             # now put together a Type2 message asking for the client to send
             # back NTLM credentials (LM hash and such)
             t2 = Net::NTLM::Message::Type2.new
@@ -46,11 +46,11 @@ module CASServer
             t2.set_flag :NTLM
             t2.context = 0x0000000000000000 # this can probably just be left unassigned
             t2.challenge = 0x0123456789abcdef # this should be a random 8-byte integer
-            
+
             $LOG.debug "T2: #{t2.inspect}"
             $LOG.debug "T2: #{t2.serialize}"
             headers["WWW-Authenticate"] = "NTLM #{t2.encode64}"
-            
+
             # the client should respond to this with a Type3 message...
             r('401', '', headers)
             return
@@ -58,7 +58,7 @@ module CASServer
             # NOTE: for some reason the server never receives the T3 response, even though monitoring
             # the HTTP traffic I can see that the client does send it back... there's probably
             # another bug hiding somewhere here
-          
+
             lm_response = t3.lm_response
             ntlm_response = t3.ntlm_response
             username = t3.user
@@ -67,8 +67,8 @@ module CASServer
             # call would do it?
             $LOG.debug "T3 LM: #{lm_response.inspect}"
             $LOG.debug "T3 NTLM: #{ntlm_response.inspect}"
-            
-            # assuming the authentication was successful, we'll now need to do something in the 
+
+            # assuming the authentication was successful, we'll now need to do something in the
             # controller acting as if we'd received correct login credentials (i.e. proceed as if
             # CAS authentication was successful).... if authentication failed, then we should
             # just fall back to old-school web-based authentication, asking the user to enter
@@ -85,4 +85,4 @@ module CASServer
       end
     end
   end
-end
+end

data/lib/casserver/authenticators/open_id.rb

@@ -13,10 +13,10 @@ class CASServer::Authenticators::OpenID < CASServer::Authenticators::Base
   def validate(credentials)
     raise NotImplementedError, "The OpenID authenticator is not yet implemented. "+
       "See http://code.google.com/p/rubycas-server/issues/detail?id=36 if you are interested in helping this along."
-    
+
     read_standard_credentials(credentials)
-    
+
     store = OpenID::Store::Memory.new
     consumer = OpenID::Consumer.new({}, store)
   end
-end
+end

data/lib/casserver/authenticators/sql.rb

@@ -7,15 +7,15 @@ rescue LoadError
   require 'active_record'
 end
 
-# Authenticates against a plain SQL table. 
-# 
-# This assumes that all of your users are stored in a table that has a 'username' 
-# column and a 'password' column. When the user logs in, CAS conects to the 
-# database and looks for a matching username/password in the users table. If a 
+# Authenticates against a plain SQL table.
+#
+# This assumes that all of your users are stored in a table that has a 'username'
+# column and a 'password' column. When the user logs in, CAS conects to the
+# database and looks for a matching username/password in the users table. If a
 # matching username and password is found, authentication is successful.
 #
 # Any database backend supported by ActiveRecord can be used.
-# 
+#
 # Config example:
 #
 #   authenticator:
@@ -24,7 +24,7 @@ end
 #       adapter: mysql
 #       database: some_database_with_users_table
 #       username: root
-#       password: 
+#       password:
 #       server: localhost
 #     user_table: users
 #     username_column: username
@@ -34,10 +34,10 @@ end
 # provide the client with the authenticated user's username. However it is now
 # possible for the server to provide the client with additional attributes.
 # You can configure the SQL authenticator to provide data from additional
-# columns in the users table by listing the names of the columns under the 
+# columns in the users table by listing the names of the columns under the
 # 'extra_attributes' option. Note though that this functionality is experimental.
 # It should work with RubyCAS-Client, but may or may not work with other CAS
-# clients. 
+# clients.
 #
 # For example, with this configuration, the 'full_name' and 'access_level'
 # columns will be provided to your CAS clients along with the username:
@@ -50,24 +50,44 @@ end
 #     user_table: users
 #     username_column: username
 #     password_column: password
+#     ignore_type_column: true # indicates if you want to ignore Single Table Inheritance 'type' field
 #     extra_attributes: full_name, access_level
-# 
+#
 class CASServer::Authenticators::SQL < CASServer::Authenticators::Base
+  def self.setup(options)
+    raise CASServer::AuthenticatorError, "Invalid authenticator configuration!" unless options[:database]
+
+    user_model_name = "CASUser_#{options[:auth_index]}"
+    $LOG.debug "CREATING USER MODEL #{user_model_name}"
+
+    class_eval %{
+      class #{user_model_name} < ActiveRecord::Base
+      end
+    }
+
+    @user_model = const_get(user_model_name)
+    @user_model.establish_connection(options[:database])
+    @user_model.set_table_name(options[:user_table] || 'users')
+    @user_model.inheritance_column = 'no_inheritance_column' if options[:ignore_type_column]
+  end
+
+  def self.user_model
+    @user_model
+  end
 
   def validate(credentials)
     read_standard_credentials(credentials)
-    
-    raise CASServer::AuthenticatorError, "Cannot validate credentials because the authenticator hasn't yet been configured" unless @options
-    raise CASServer::AuthenticatorError, "Invalid authenticator configuration!" unless @options[:database]
-    
-    CASUser.establish_connection @options[:database]
-    CASUser.set_table_name @options[:user_table] || "users"
-    
+    raise_if_not_configured
+
+    user_model = self.class.user_model
+
     username_column = @options[:username_column] || 'username'
     password_column = @options[:password_column] || 'password'
     
-    results = CASUser.find(:all, :conditions => ["#{username_column} = ? AND #{password_column} = ?", @username, @password])
-    
+    $LOG.debug "#{self.class}: [#{user_model}] " + "Connection pool size: #{user_model.connection_pool.instance_variable_get(:@checked_out).length}/#{user_model.connection_pool.instance_variable_get(:@connections).length}"
+    results = user_model.find(:all, :conditions => ["#{username_column} = ? AND #{password_column} = ?", @username, @password])
+    user_model.connection_pool.checkin(user_model.connection)
+       
     if results.size > 0
       $LOG.warn("#{self.class}: Multiple matches found for user #{@username.inspect}") if results.size > 1
       
@@ -76,27 +96,38 @@ class CASServer::Authenticators::SQL < CASServer::Authenticators::Base
           $LOG.warn("#{self.class}: Unable to extract extra_attributes because multiple matches were found for #{@username.inspect}")
         else
           user = results.first
-          
-          @extra_attributes = {}
-          extra_attributes_to_extract.each do |col|
-            @extra_attributes[col] = user.send(col)
-          end
-          
-          if @extra_attributes.empty?
-            $LOG.warn("#{self.class}: Did not read any extra_attributes for user #{@username.inspect} even though an :extra_attributes option was provided.")
-          else
-            $LOG.debug("#{self.class}: Read the following extra_attributes for user #{@username.inspect}: #{@extra_attributes.inspect}")
-          end
+
+          extract_extra(user)
+          log_extra
         end
       end
-      
+
       return true
     else
       return false
     end
   end
-  
-  class CASUser < ActiveRecord::Base
+
+  protected
+
+  def raise_if_not_configured
+    raise CASServer::AuthenticatorError.new(
+      "Cannot validate credentials because the authenticator hasn't yet been configured"
+    ) unless @options
+  end
+
+  def extract_extra user
+    @extra_attributes = {}
+    extra_attributes_to_extract.each do |col|
+      @extra_attributes[col] = user.send(col)
+    end
   end
 
-end
+  def log_extra
+    if @extra_attributes.empty?
+      $LOG.warn("#{self.class}: Did not read any extra_attributes for user #{@username.inspect} even though an :extra_attributes option was provided.")
+    else
+      $LOG.debug("#{self.class}: Read the following extra_attributes for user #{@username.inspect}: #{@extra_attributes.inspect}")
+    end
+  end
+end