rubycas-server 0.5.0 → 0.5.0.186

data/CHANGELOG.txt

@@ -1,3 +1,11 @@
+=== In Progress...
+
+* Tickets generated by the server should now be a lot more secure.
+  The random string generator used for generating tickets now uses
+  Crypt::ISAAC. Tickets have also been extended in length; STs, PTs
+  and LTs can now extend up to 32 characters, and PGTs and PGT-IOUs 
+  up to 64.
+
 === 0.5.0 :: 2007-09-20
 
 * Gateway requests should now be handled correctly. When the request to the

data/README.txt

@@ -14,8 +14,8 @@ You can contact the author at:
 ==============================================================================
 
 RubyCAS-Server is free software; you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation; either version 2 of the License, or
+it under the terms of the GNU Lesser General Public License as published 
+by the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 
 RubyCAS-Server is distributed in the hope that it will be useful,
@@ -23,7 +23,7 @@ but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 
-You should have received a copy of the GNU General Public License
+You should have received a copy of the GNU Lesser General Public License
 along with RubyCAS-Server; if not, write to the Free Software
 Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 

data/Rakefile

@@ -26,8 +26,8 @@ DEPS = [
 
 
 NAME = "rubycas-server"
-REV = nil
-#REV = `svn info`[/Revision: (\d+)/, 1] rescue nil
+#REV = nil
+REV = `svn info`[/Revision: (\d+)/, 1] rescue nil
 VERS = ENV['VERSION'] || (CASServer::VERSION::STRING + (REV ? ".#{REV}" : ""))
                           CLEAN.include ['**/.*.sw?', '*.gem', '.config']
 RDOC_OPTS = ['--quiet', '--title', "RubyCAS-Server #{VERS} Documentation",

data/lib/casserver/cas.rb

@@ -74,8 +74,8 @@ module CASServer::CAS
       path = uri.path.empty? ? '/' : uri.path
       
       pgt = ProxyGrantingTicket.new
-      pgt.ticket = "PGT-" + CASServer::Utils.random_string
-      pgt.iou = "PGTIOU-" + CASServer::Utils.random_string
+      pgt.ticket = "PGT-" + CASServer::Utils.random_string(60)
+      pgt.iou = "PGTIOU-" + CASServer::Utils.random_string(57)
       pgt.service_ticket_id = st.id
       pgt.client_hostname = env['REMOTE_HOST'] || env['REMOTE_ADDR']
       

data/lib/casserver/utils.rb

@@ -1,8 +1,13 @@
 # Misc utility function used throughout by the RubyCAS-server.
 module CASServer
   module Utils
-    def random_string
-      "#{Time.now.to_i}r%X" % rand(10**32)
+    def random_string(max_length = 29)
+      rg =  Crypt::ISAAC.new
+      max = 4294619050
+      r = "#{Time.now.to_i}r%X%X%X%X%X%X%X%X" % 
+        [rg.rand(max), rg.rand(max), rg.rand(max), rg.rand(max), 
+         rg.rand(max), rg.rand(max), rg.rand(max), rg.rand(max)]
+      r[0..max_length-1]
     end
     module_function :random_string
       

data/lib/casserver.rb

@@ -19,14 +19,15 @@ end
 $: << $CASSERVER_HOME + "/../vendor/camping-1.5.180/lib"
 require 'camping'
 
+$: << $CASSERVER_HOME + "/../vendor/isaac_0.9.1"
+require 'crypt/ISAAC'
+
 require 'active_support'
 require 'yaml'
 
 # enable xhtml source code indentation for debugging views
 #Markaby::Builder.set(:indent, 2)
 
-# seed the random number generator (ruby does this by default, but it doesn't hurt to do it here just to be sure)
-srand
 
 # Camping.goes must be called after the authenticator class is loaded, otherwise weird things happen
 Camping.goes :CASServer

data/vendor/camping-1.5.180/lib/camping/webrick.rb

@@ -42,6 +42,9 @@ class CampingHandler < WEBrick::HTTPServlet::DefaultFileHandler
     end
     # Handler for WEBrick requests (also aliased as do_POST).
     def service(req, resp)
+puts @klass.inspect
+puts req.body.inspect
+puts req.meta_vars.inspect
         controller = @klass.run((req.body and StringIO.new(req.body)), req.meta_vars)
         resp.status = controller.status
         @local_path = nil

metadata

@@ -3,8 +3,8 @@ rubygems_version: 0.9.2
 specification_version: 1
 name: rubycas-server
 version: !ruby/object:Gem::Version 
-  version: 0.5.0
-date: 2007-09-20 00:00:00 -04:00
+  version: 0.5.0.186
+date: 2007-11-27 00:00:00 -05:00
 summary: Provides single sign on for web applications using the CAS protocol.
 require_paths: 
 - lib