RubyGems - snaury-thin-auth-ntlm - Versions diffs - 0.0.2 → 0.0.3 - Mend

snaury-thin-auth-ntlm 0.0.2 → 0.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

data/VERSION.yml +4 -0
data/lib/thin/ntlm/connection.rb +85 -49
data/thin-auth-ntlm.gemspec +48 -0
metadata +8 -5

data/VERSION.yml ADDED Viewed

@@ -0,0 +1,4 @@
+---
+:major: 0
+:minor: 0
+:patch: 3

data/lib/thin/ntlm/connection.rb CHANGED Viewed

@@ -1,7 +1,8 @@
+require 'weakref'
 require 'win32/sspi/server'
 module Thin
-  class NTLMConnection < Connection
+  class NTLMWrapper
     AUTHORIZATION_MESSAGE = <<END
 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
 <html><head>
@@ -24,34 +25,38 @@ END
     NTLM_REQUEST_PACKAGE = 'NTLM'.freeze
     NTLM_ALLOWED_PACKAGE = 'NTLM|Negotiate'.freeze
-    def unbind
-      ntlm_cleanup
-    ensure
-      super
+    def initialize(app, connection)
+      @app = app
+      @connection = WeakRef.new(connection)
     end
-    def process
+    def deferred?(env)
+      @app.respond_to?(:deferred?) && @app.deferred?(env)
+    end
+    def call(env)
       # check if browser wants to reauthenticate
-      if @authenticated_as && http_authorization
+      if @authenticated_as && http_authorization(env)
         @authenticated_as = nil
       end
       # require authentication
       unless @authenticated_as
-        unless @authentication_stage
-          @post_ntlm_can_persist = @can_persist
-          @authentication_stage = 1
-        end
-        result = ntlm_process
-        return post_process(result) unless @authenticated_as
+        @connection.ntlm_start
+        @authentication_stage ||= 1
+        result = process(env)
+        return result unless @authenticated_as
+        @connection.ntlm_stop
       end
-      @request.env[REMOTE_USER] = @authenticated_as
-      @can_persist = @post_ntlm_can_persist
-      return super
+      # pass thru
+      env[REMOTE_USER] = @authenticated_as
+      @app.call(env)
     end
-    def http_authorization
-      auth = @request.env[HTTP_AUTHORIZATION]
+    # Returns stripped HTTP-Authorization header, nil if none or empty
+    def http_authorization(env)
+      auth = env[HTTP_AUTHORIZATION]
       if auth
         auth = auth.strip
         auth = nil if auth.empty?
@@ -59,14 +64,23 @@ END
       auth
     end
-    def ntlm_acquire(package = 'NTLM')
-      ntlm_cleanup
+    # Returns token type and value from HTTP-Authorization header
+    def token(env)
+      auth = http_authorization(env)
+      return [nil, nil] unless auth && auth.match(/\A(#{NTLM_ALLOWED_PACKAGE}) (.*)\Z/)
+      [$1, Base64.decode64($2.strip)]
+    end
+    # Acquires new OS credentials handle
+    def acquire(package = 'NTLM')
+      cleanup
       @ntlm = Win32::SSPI::NegotiateServer.new(package)
       @ntlm.acquire_credentials_handle
       @ntlm
     end
-    def ntlm_cleanup
+    # Frees credentials handle, if acquired
+    def cleanup
       if @ntlm
         @ntlm.cleanup rescue nil
         @ntlm = nil
@@ -74,55 +88,77 @@ END
       nil
     end
-    def ntlm_token
-      auth = http_authorization
-      return [nil, nil] unless auth && auth.match(/\A(#{NTLM_ALLOWED_PACKAGE}) (.*)\Z/)
-      [$1, Base64.decode64($2.strip)]
-    end
-    def ntlm_process
+    # Processes current authentication stage
+    # Returns rack response if authentication is incomplete
+    # Sets @authenticated_as to username if authentication successful
+    def process(env)
       case @authentication_stage
       when 1 # we are waiting for type1 message
-        package, t1 = ntlm_token
-        return ntlm_request_auth(NTLM_REQUEST_PACKAGE, false) if t1.nil?
-        return ntlm_request_auth unless request.persistent?
+        package, t1 = token(env)
+        return request_auth(NTLM_REQUEST_PACKAGE, false) if t1.nil?
+        return request_auth unless request.persistent?
         begin
-          ntlm_acquire(package)
+          acquire(package)
           t2 = @ntlm.accept_security_context(t1)
         rescue
-          return ntlm_request_auth
+          return request_auth
         end
-        ntlm_request_auth("#{package} #{t2}", false, 2)
+        request_auth("#{package} #{t2}", false, 2)
       when 2 # we are waiting for type3 message
-        package, t3 = ntlm_token
-        return ntlm_request_auth(NTLM_REQUEST_PACKAGE, false) if t3.nil?
-        return ntlm_request_auth unless package == @ntlm.package
-        return ntlm_request_auth unless request.persistent?
+        package, t3 = token(env)
+        return request_auth(NTLM_REQUEST_PACKAGE, false) if t3.nil?
+        return request_auth unless package == @ntlm.package
+        return request_auth unless request.persistent?
         begin
           t2 = @ntlm.accept_security_context(t3)
           @authenticated_as = @ntlm.get_username_from_context
-          @authentication_stage = 1 # in case IE8 wants to reauthenticate
+          @authentication_stage = nil # in case IE wants to reauthenticate
         rescue
-          return ntlm_request_auth
+          return request_auth
         end
-        return ntlm_request_auth unless @authenticated_as
-        ntlm_cleanup
+        return request_auth unless @authenticated_as
+        cleanup
       else
         raise "Invalid value for @authentication_stage=#{@authentication_stage} detected"
       end
-    rescue Exception
-      handle_error
-      terminate_request
-      nil
     end
-    def ntlm_request_auth(auth = nil, finished = true, next_stage = 1)
+    # Returns response with authentication request to the client
+    def request_auth(auth = nil, finished = true, next_stage = 1)
       @authentication_stage = next_stage
-      @can_persist = !finished
+      @connection.can_persist! unless finished
       head = {}
       head[WWW_AUTHENTICATE] = auth if auth
       head[CONTENT_TYPE] = CONTENT_TYPE_AUTH
-      return [401, head, [AUTHORIZATION_MESSAGE]]
+      [401, head, [AUTHORIZATION_MESSAGE]]
+    end
+  end
+  class NTLMConnection < Connection
+    def app=(app)
+      super NTLMWrapper.new(app, self)
+    end
+    def unbind
+      @app.cleanup if @app && @app.respond_to?(:cleanup)
+    ensure
+      super
+    end
+    # Saves original can_persist? value (NTLM will force persistence)
+    def ntlm_start
+      unless @ntlm_in_progress
+        @ntlm_saved_can_persist = @can_persist
+        @ntlm_in_progress = true
+      end
+    end
+    # Restores previous can_persist? value
+    def ntlm_stop
+      if @ntlm_in_progress
+        @can_persist = @ntlm_saved_can_persist
+        @ntlm_in_progress = false
+      end
     end
   end
 end

data/thin-auth-ntlm.gemspec ADDED Viewed

@@ -0,0 +1,48 @@
+# Generated by jeweler
+# DO NOT EDIT THIS FILE
+# Instead, edit Jeweler::Tasks in Rakefile, and run `rake gemspec`
+# -*- encoding: utf-8 -*-
+Gem::Specification.new do |s|
+  s.name = %q{thin-auth-ntlm}
+  s.version = "0.0.3"
+  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
+  s.authors = ["Alexey Borzenkov"]
+  s.date = %q{2009-08-12}
+  s.email = %q{snaury@gmail.com}
+  s.extra_rdoc_files = [
+    "LICENSE.txt",
+     "README.txt"
+  ]
+  s.files = [
+    "LICENSE.txt",
+     "README.txt",
+     "Rakefile",
+     "VERSION.yml",
+     "lib/thin-auth-ntlm.rb",
+     "lib/thin/ntlm/backends/tcp_server.rb",
+     "lib/thin/ntlm/connection.rb",
+     "thin-auth-ntlm.gemspec"
+  ]
+  s.rdoc_options = ["--charset=UTF-8"]
+  s.require_paths = ["lib"]
+  s.rubygems_version = %q{1.3.4}
+  s.summary = %q{Allows you to force NTLM authentication on Thin TCP servers.}
+  if s.respond_to? :specification_version then
+    current_version = Gem::Specification::CURRENT_SPECIFICATION_VERSION
+    s.specification_version = 3
+    if Gem::Version.new(Gem::RubyGemsVersion) >= Gem::Version.new('1.2.0') then
+      s.add_runtime_dependency(%q<thin>, [">= 1.0.0"])
+      s.add_runtime_dependency(%q<rubysspi-server>, [">= 0.0.1"])
+    else
+      s.add_dependency(%q<thin>, [">= 1.0.0"])
+      s.add_dependency(%q<rubysspi-server>, [">= 0.0.1"])
+    end
+  else
+    s.add_dependency(%q<thin>, [">= 1.0.0"])
+    s.add_dependency(%q<rubysspi-server>, [">= 0.0.1"])
+  end
+end

metadata CHANGED Viewed

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: snaury-thin-auth-ntlm
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - Alexey Borzenkov
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
-date: 2009-05-18 00:00:00 -07:00
+date: 2009-08-12 00:00:00 -07:00
 default_executable:
 dependencies:
 - !ruby/object:Gem::Dependency
@@ -45,11 +45,14 @@ files:
 - LICENSE.txt
 - README.txt
 - Rakefile
+- VERSION.yml
 - lib/thin-auth-ntlm.rb
 - lib/thin/ntlm/backends/tcp_server.rb
 - lib/thin/ntlm/connection.rb
-has_rdoc: true
+- thin-auth-ntlm.gemspec
+has_rdoc: false
 homepage:
+licenses:
 post_install_message:
 rdoc_options:
 - --charset=UTF-8
@@ -70,9 +73,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubyforge_project:
-rubygems_version: 1.2.0
+rubygems_version: 1.3.5
 signing_key:
-specification_version: 2
+specification_version: 3
 summary: Allows you to force NTLM authentication on Thin TCP servers.
 test_files: []